Commander1024/ESP32_Serial_Swiss_Army_Knife
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Migrate to IDF 5.5.3 candidate

Browse Source 
Pin PlatformIO packages and toolchains, rebase protected SDK
overrides, and add WebSocket receive regression coverage. Document
isolated candidate validation, archive provenance, and remaining gates.
This commit is contained in:
Commander1024
2026-09-18 14:23:13 +02:00
parent cdc4d4a8df
commit 797d2681ac
32 changed files with 1394 additions and 123 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/security_overrides.py
+24 -7
View File
@@ -461,13 +461,13 @@ ENTRIES = (
)),
Entry("mbedtls_ssl_tls", "mbedtls", "idf",
"components/mbedtls/mbedtls/library/ssl_tls.c",
"b726c0c55bc5f32255f129d55f9f2fface85ce83de90a2d16c9017b93b738bff", (
"0154e70f20b465213d3f97a9c2b75e686d79ee83592f90e1d7e7d995593ca7e1", (
Edit(' MBEDTLS_SSL_DEBUG_RET(1, "calc_verify", ret);\n',
' MBEDTLS_SSL_DEBUG_RET(1, "calc_verify", ret);\n return ret;\n'),
), target="mbedtls"),
Entry("mbedtls_x509_create", "mbedtls", "idf",
"components/mbedtls/mbedtls/library/x509_create.c",
"fd399239aee30384786a19b47bfe5dd22b979d5d89bb38f29f0c82a3d81daaf7", (
"55edce5b8fcb039a404b84ea830f06d018128b155dfbf0d74d26b17247b546c6", (
Edit(" oid.p = mbedtls_calloc(1, oid.len);\n",
""" oid.p = mbedtls_calloc(1, oid.len);
if (oid.p == NULL) {
@@ -553,7 +553,7 @@ ENTRIES = (
)),
Entry("https_server", "esp_https_server", "idf",
"components/esp_https_server/src/https_server.c",
"6481942b62e51125e2a43441fa0900cbda74bd2ea05c82f0c29eb4933c31946e", (
"a2a5ca0549fbe8d1ddd7f9647a48a31fdd6329b997e1550ab69d6a10efecff0d", (
Edit('const static char *TAG = "esp_https_server";\n',
WIPE + 'const static char *TAG = "esp_https_server";\n'),
Edit(""" if (!transport_ctx) {
@@ -598,7 +598,7 @@ ENTRIES = (
)),
Entry("httpd_parse", "esp_http_server", "idf",
"components/esp_http_server/src/httpd_parse.c",
"6bba77064aaa68a06f8d4c01432064a1b050c91ed22741c547785b0d8a6c07d8", (
"db7fbbb322bccb4a21bc1607208a6bb7d1f4c0d7ecc3299de10c9e60edaa943b", (
Edit('static const char *TAG = "httpd_parse";\n',
WIPE + SCRATCH_RESIZE + 'static const char *TAG = "httpd_parse";\n'),
Edit(" size_t at_offset = parser_data->last.at - raux->scratch;\n",
@@ -623,12 +623,25 @@ ENTRIES = (
)),
Entry("esp_tls_mbedtls", "esp-tls", "idf",
"components/esp-tls/esp_tls_mbedtls.c",
"09210c5a601647ca5775d127a2951bab2f3e509192b53487bbea8a93d8731b78", (
"edc39052244526cb91c93a16bc765194031060e5560fd432e75542f2f6c8db53", (
Edit('static const char *TAG = "esp-tls-mbedtls";\n',
TLS_GUARDS + 'static const char *TAG = "esp-tls-mbedtls";\n'),
Edit(" mbedtls_ssl_conf_set_user_data_p(&tls->conf, cfg->userdata);\n",
TLS_POLICY + " mbedtls_ssl_conf_set_user_data_p(&tls->conf, cfg->userdata);\n"),
)),
# 5.5.3 introduced blocking header reads, but sizeof promotes negative
# receive errors to unsigned. These fixed header extents are at most 8 bytes.
Entry("httpd_ws", "esp_http_server", "idf",
"components/esp_http_server/src/httpd_ws.c",
"a02194bc8adb1a1707f680390f30ccfab95cd83230cbe4aedcadda2999c9649c",
tuple(Edit(f"HTTPD_RECV_OPT_BLOCKING) < sizeof({name}))",
f"HTTPD_RECV_OPT_BLOCKING) < (int)sizeof({name}))")
for name in ("second_byte", "aux->mask_key", "first_byte")) +
tuple(Edit(f'HTTPD_RECV_OPT_BLOCKING) < sizeof(length_bytes)) {{\n'
f' ESP_LOGW(TAG, LOG_FMT("Failed to receive {size} bytes length"));',
f'HTTPD_RECV_OPT_BLOCKING) < (int)sizeof(length_bytes)) {{\n'
f' ESP_LOGW(TAG, LOG_FMT("Failed to receive {size} bytes length"));')
for size in (2, 8))),
)
@@ -656,10 +669,10 @@ def apply_edits(text: str, edits: tuple[Edit, ...]) -> str:
def verify_version(idf: Path) -> Path:
version = idf / "components/esp_common/include/esp_idf_version.h"
text = version.read_text(encoding="utf-8")
for part, expected in (("MAJOR", "5"), ("MINOR", "5"), ("PATCH", "0")):
for part, expected in (("MAJOR", "5"), ("MINOR", "5"), ("PATCH", "3")):
found = re.findall(r"^#define ESP_IDF_VERSION_" + part + r"\s+(\d+)\s*$", text, re.M)
if found != [expected]:
raise OverrideError(f"requires ESP-IDF 5.5.0: {version} ({part}={found})")
raise OverrideError(f"requires ESP-IDF 5.5.3: {version} ({part}={found})")
return version
@@ -683,6 +696,10 @@ def render_entry(entry: Entry, roots: dict[str, Path]) -> tuple[Path, bytes]:
if actual != entry.sha256:
raise OverrideError(f"{entry.name}: SHA256 mismatch for {source}: expected {entry.sha256}, got {actual}; reaudit, do not repin blindly")
notice = MODIFICATION_NOTICE
if entry.root == "idf":
notice += ("/* Rebased to audited ESP-IDF 5.5.3 originals on 2026-09-16.\n"
" * All local corrections retained; see docs/idf_candidate_integration.md.\n"
" */\n")
if entry.component == "wolfssl__wolfssh":
notice += ("/* Ordering profile modified 2026-09-16: PR793/819/840/855/921\n"
" * plus project restricted no-EXT_INFO correction. Provenance and\n"