mirror of
https://github.com/meshtastic/firmware.git
synced 2025-08-13 00:35:16 +00:00
Merge branch 'master' into develop
This commit is contained in:
commit
53cd6bdf15
41
.github/actions/setup-base/action.yml
vendored
Normal file
41
.github/actions/setup-base/action.yml
vendored
Normal file
@ -0,0 +1,41 @@
|
|||||||
|
name: 'Setup Build Base Composite Action'
|
||||||
|
description: 'Base build actions for Meshtastic Platform IO steps'
|
||||||
|
|
||||||
|
runs:
|
||||||
|
using: "composite"
|
||||||
|
steps:
|
||||||
|
- name: Checkout code
|
||||||
|
uses: actions/checkout@v3
|
||||||
|
with:
|
||||||
|
submodules: "recursive"
|
||||||
|
ref: ${{github.event.pull_request.head.ref}}
|
||||||
|
repository: ${{github.event.pull_request.head.repo.full_name}}
|
||||||
|
|
||||||
|
- name: Install cppcheck
|
||||||
|
shell: bash
|
||||||
|
run: |
|
||||||
|
sudo apt-get install -y cppcheck
|
||||||
|
|
||||||
|
- name: Setup Python
|
||||||
|
uses: actions/setup-python@v4
|
||||||
|
with:
|
||||||
|
python-version: 3.x
|
||||||
|
|
||||||
|
- name: Cache python libs
|
||||||
|
uses: actions/cache@v3
|
||||||
|
id: cache-pip # needed in if test
|
||||||
|
with:
|
||||||
|
path: ~/.cache/pip
|
||||||
|
key: ${{ runner.os }}-pip
|
||||||
|
|
||||||
|
- name: Upgrade python tools
|
||||||
|
shell: bash
|
||||||
|
run: |
|
||||||
|
python -m pip install --upgrade pip
|
||||||
|
pip install -U platformio adafruit-nrfutil
|
||||||
|
pip install -U meshtastic --pre
|
||||||
|
|
||||||
|
- name: Upgrade platformio
|
||||||
|
shell: bash
|
||||||
|
run: |
|
||||||
|
pio upgrade
|
54
.github/workflows/build_esp32.yml
vendored
Normal file
54
.github/workflows/build_esp32.yml
vendored
Normal file
@ -0,0 +1,54 @@
|
|||||||
|
name: Build ESP32
|
||||||
|
|
||||||
|
on:
|
||||||
|
workflow_call:
|
||||||
|
inputs:
|
||||||
|
board:
|
||||||
|
required: true
|
||||||
|
type: string
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
build-esp32:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
steps:
|
||||||
|
- uses: actions/checkout@v3
|
||||||
|
- name: Build base
|
||||||
|
id: base
|
||||||
|
uses: ./.github/actions/setup-base
|
||||||
|
|
||||||
|
- name: Pull web ui
|
||||||
|
uses: dsaltares/fetch-gh-release-asset@master
|
||||||
|
with:
|
||||||
|
repo: "meshtastic/web"
|
||||||
|
file: "build.tar"
|
||||||
|
target: "build.tar"
|
||||||
|
token: ${{ secrets.GITHUB_TOKEN }}
|
||||||
|
|
||||||
|
- name: Unpack web ui
|
||||||
|
run: |
|
||||||
|
tar -xf build.tar -C data/static
|
||||||
|
rm build.tar
|
||||||
|
|
||||||
|
- name: Build ESP32
|
||||||
|
run: bin/build-esp32.sh ${{ inputs.board }}
|
||||||
|
|
||||||
|
- name: Pull OTA Firmware
|
||||||
|
uses: dsaltares/fetch-gh-release-asset@master
|
||||||
|
with:
|
||||||
|
repo: "meshtastic/firmware-ota"
|
||||||
|
file: "firmware.bin"
|
||||||
|
target: "release/bleota.bin"
|
||||||
|
token: ${{ secrets.GITHUB_TOKEN }}
|
||||||
|
|
||||||
|
- name: Get release version string
|
||||||
|
shell: bash
|
||||||
|
run: echo "version=$(./bin/buildinfo.py long)" >> $GITHUB_OUTPUT
|
||||||
|
id: version
|
||||||
|
|
||||||
|
- name: Store binaries as an artifact
|
||||||
|
uses: actions/upload-artifact@v3
|
||||||
|
with:
|
||||||
|
name: firmware-${{ inputs.board }}-${{ steps.version.outputs.version }}.zip
|
||||||
|
path: |
|
||||||
|
release/*.bin
|
||||||
|
release/*.elf
|
33
.github/workflows/build_nrf52.yml
vendored
Normal file
33
.github/workflows/build_nrf52.yml
vendored
Normal file
@ -0,0 +1,33 @@
|
|||||||
|
name: Build NRF52
|
||||||
|
|
||||||
|
on:
|
||||||
|
workflow_call:
|
||||||
|
inputs:
|
||||||
|
board:
|
||||||
|
required: true
|
||||||
|
type: string
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
build-nrf52:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
steps:
|
||||||
|
- uses: actions/checkout@v3
|
||||||
|
- name: Build base
|
||||||
|
id: base
|
||||||
|
uses: ./.github/actions/setup-base
|
||||||
|
|
||||||
|
- name: Build NRF52
|
||||||
|
run: bin/build-nrf52.sh ${{ inputs.board }}
|
||||||
|
|
||||||
|
- name: Get release version string
|
||||||
|
run: echo "version=$(./bin/buildinfo.py long)" >> $GITHUB_OUTPUT
|
||||||
|
id: version
|
||||||
|
|
||||||
|
- name: Store binaries as an artifact
|
||||||
|
uses: actions/upload-artifact@v3
|
||||||
|
with:
|
||||||
|
name: firmware-${{ inputs.board }}-${{ steps.version.outputs.version }}.zip
|
||||||
|
path: |
|
||||||
|
release/*.uf2
|
||||||
|
release/*.elf
|
||||||
|
release/*.zip
|
32
.github/workflows/build_rpi2040.yml
vendored
Normal file
32
.github/workflows/build_rpi2040.yml
vendored
Normal file
@ -0,0 +1,32 @@
|
|||||||
|
name: Build RPI2040
|
||||||
|
|
||||||
|
on:
|
||||||
|
workflow_call:
|
||||||
|
inputs:
|
||||||
|
board:
|
||||||
|
required: true
|
||||||
|
type: string
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
build-rpi2040:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
steps:
|
||||||
|
- uses: actions/checkout@v3
|
||||||
|
- name: Build base
|
||||||
|
id: base
|
||||||
|
uses: ./.github/actions/setup-base
|
||||||
|
|
||||||
|
- name: Build Raspberry Pi 2040
|
||||||
|
run: ./bin/build-rpi2040.sh ${{ inputs.board }}
|
||||||
|
|
||||||
|
- name: Get release version string
|
||||||
|
run: echo "version=$(./bin/buildinfo.py long)" >> $GITHUB_OUTPUT
|
||||||
|
id: version
|
||||||
|
|
||||||
|
- name: Store binaries as an artifact
|
||||||
|
uses: actions/upload-artifact@v3
|
||||||
|
with:
|
||||||
|
name: firmware-${{ inputs.board }}-${{ steps.version.outputs.version }}.zip
|
||||||
|
path: |
|
||||||
|
release/*.uf2
|
||||||
|
release/*.elf
|
260
.github/workflows/main_matrix.yml
vendored
260
.github/workflows/main_matrix.yml
vendored
@ -23,52 +23,22 @@ jobs:
|
|||||||
matrix:
|
matrix:
|
||||||
include:
|
include:
|
||||||
- board: rak11200
|
- board: rak11200
|
||||||
- board: tlora-v1
|
|
||||||
- board: tlora-v2-1-1.6
|
- board: tlora-v2-1-1.6
|
||||||
- board: tbeam
|
- board: tbeam
|
||||||
- board: heltec-v2.1
|
- board: heltec-v2.1
|
||||||
- board: meshtastic-diy-v1
|
- board: meshtastic-diy-v1
|
||||||
- board: rak4631
|
- board: rak4631
|
||||||
- board: t-echo
|
- board: t-echo
|
||||||
- board: nano-g1
|
|
||||||
- board: station-g1
|
- board: station-g1
|
||||||
- board: m5stack-coreink
|
- board: m5stack-coreink
|
||||||
- board: tbeam-s3-core
|
- board: tbeam-s3-core
|
||||||
# - board: pico
|
|
||||||
|
|
||||||
runs-on: ubuntu-latest
|
runs-on: ubuntu-latest
|
||||||
steps:
|
steps:
|
||||||
- name: Checkout code
|
- uses: actions/checkout@v3
|
||||||
uses: actions/checkout@v3
|
- name: Build base
|
||||||
with:
|
id: base
|
||||||
submodules: "recursive"
|
uses: ./.github/actions/setup-base
|
||||||
ref: ${{github.event.pull_request.head.ref}}
|
|
||||||
repository: ${{github.event.pull_request.head.repo.full_name}}
|
|
||||||
|
|
||||||
- name: Install cppcheck
|
|
||||||
run: |
|
|
||||||
sudo apt-get install -y cppcheck
|
|
||||||
|
|
||||||
- name: Setup Python
|
|
||||||
uses: actions/setup-python@v4
|
|
||||||
with:
|
|
||||||
python-version: 3.x
|
|
||||||
|
|
||||||
- name: Cache python libs
|
|
||||||
uses: actions/cache@v3
|
|
||||||
id: cache-pip # needed in if test
|
|
||||||
with:
|
|
||||||
path: ~/.cache/pip
|
|
||||||
key: ${{ runner.os }}-pip
|
|
||||||
|
|
||||||
- name: Upgrade python tools and install platformio
|
|
||||||
run: |
|
|
||||||
python -m pip install --upgrade pip
|
|
||||||
pip install -U platformio
|
|
||||||
|
|
||||||
- name: Upgrade platformio
|
|
||||||
run: |
|
|
||||||
pio upgrade
|
|
||||||
|
|
||||||
- name: Check ${{ matrix.board }}
|
- name: Check ${{ matrix.board }}
|
||||||
run: bin/check-all.sh ${{ matrix.board }}
|
run: bin/check-all.sh ${{ matrix.board }}
|
||||||
@ -97,73 +67,9 @@ jobs:
|
|||||||
- board: m5stack-core
|
- board: m5stack-core
|
||||||
- board: m5stack-coreink
|
- board: m5stack-coreink
|
||||||
- board: tbeam-s3-core
|
- board: tbeam-s3-core
|
||||||
|
uses: ./.github/workflows/build_esp32.yml
|
||||||
runs-on: ubuntu-latest
|
with:
|
||||||
steps:
|
board: ${{ matrix.board }}
|
||||||
- name: Checkout code
|
|
||||||
uses: actions/checkout@v3
|
|
||||||
with:
|
|
||||||
submodules: "recursive"
|
|
||||||
ref: ${{github.event.pull_request.head.ref}}
|
|
||||||
repository: ${{github.event.pull_request.head.repo.full_name}}
|
|
||||||
|
|
||||||
- name: Setup Python
|
|
||||||
uses: actions/setup-python@v4
|
|
||||||
with:
|
|
||||||
python-version: 3.x
|
|
||||||
|
|
||||||
- name: Cache python libs
|
|
||||||
uses: actions/cache@v3
|
|
||||||
id: cache-pip # needed in if test
|
|
||||||
with:
|
|
||||||
path: ~/.cache/pip
|
|
||||||
key: ${{ runner.os }}-pip
|
|
||||||
|
|
||||||
- name: Upgrade python tools
|
|
||||||
run: |
|
|
||||||
python -m pip install --upgrade pip
|
|
||||||
pip install -U platformio adafruit-nrfutil
|
|
||||||
|
|
||||||
- name: Upgrade platformio
|
|
||||||
run: |
|
|
||||||
pio upgrade
|
|
||||||
|
|
||||||
- name: Pull web ui
|
|
||||||
uses: dsaltares/fetch-gh-release-asset@master
|
|
||||||
with:
|
|
||||||
repo: "meshtastic/web"
|
|
||||||
file: "build.tar"
|
|
||||||
target: "build.tar"
|
|
||||||
token: ${{ secrets.GITHUB_TOKEN }}
|
|
||||||
|
|
||||||
- name: Unpack web ui
|
|
||||||
run: |
|
|
||||||
tar -xf build.tar -C data/static
|
|
||||||
rm build.tar
|
|
||||||
|
|
||||||
- name: Build ESP32
|
|
||||||
run: bin/build-esp32.sh ${{ matrix.board }}
|
|
||||||
|
|
||||||
- name: Pull OTA Firmware
|
|
||||||
uses: dsaltares/fetch-gh-release-asset@master
|
|
||||||
with:
|
|
||||||
repo: "meshtastic/firmware-ota"
|
|
||||||
file: "firmware.bin"
|
|
||||||
target: "release/bleota.bin"
|
|
||||||
token: ${{ secrets.GITHUB_TOKEN }}
|
|
||||||
|
|
||||||
- name: Get release version string
|
|
||||||
run: echo "version=$(./bin/buildinfo.py long)" >> $GITHUB_OUTPUT
|
|
||||||
id: version
|
|
||||||
|
|
||||||
- name: Store binaries as an artifact
|
|
||||||
uses: actions/upload-artifact@v3
|
|
||||||
with:
|
|
||||||
name: firmware-${{ matrix.board }}-${{ steps.version.outputs.version }}.zip
|
|
||||||
path: |
|
|
||||||
release/*.bin
|
|
||||||
release/*.elf
|
|
||||||
retention-days: 30
|
|
||||||
|
|
||||||
build-nrf52:
|
build-nrf52:
|
||||||
strategy:
|
strategy:
|
||||||
@ -176,53 +82,9 @@ jobs:
|
|||||||
- board: t-echo
|
- board: t-echo
|
||||||
- board: pca10059_diy_eink
|
- board: pca10059_diy_eink
|
||||||
- board: feather_diy
|
- board: feather_diy
|
||||||
|
uses: ./.github/workflows/build_nrf52.yml
|
||||||
runs-on: ubuntu-latest
|
with:
|
||||||
steps:
|
board: ${{ matrix.board }}
|
||||||
- name: Checkout code
|
|
||||||
uses: actions/checkout@v3
|
|
||||||
with:
|
|
||||||
submodules: "recursive"
|
|
||||||
ref: ${{github.event.pull_request.head.ref}}
|
|
||||||
repository: ${{github.event.pull_request.head.repo.full_name}}
|
|
||||||
|
|
||||||
- name: Setup Python
|
|
||||||
uses: actions/setup-python@v4
|
|
||||||
with:
|
|
||||||
python-version: 3.x
|
|
||||||
|
|
||||||
- name: Cache python libs
|
|
||||||
uses: actions/cache@v3
|
|
||||||
id: cache-pip # needed in if test
|
|
||||||
with:
|
|
||||||
path: ~/.cache/pip
|
|
||||||
key: ${{ runner.os }}-pip
|
|
||||||
|
|
||||||
- name: Upgrade python tools
|
|
||||||
run: |
|
|
||||||
python -m pip install --upgrade pip
|
|
||||||
pip install -U platformio adafruit-nrfutil
|
|
||||||
|
|
||||||
- name: Upgrade platformio
|
|
||||||
run: |
|
|
||||||
pio upgrade
|
|
||||||
|
|
||||||
- name: Build NRF52
|
|
||||||
run: bin/build-nrf52.sh ${{ matrix.board }}
|
|
||||||
|
|
||||||
- name: Get release version string
|
|
||||||
run: echo "version=$(./bin/buildinfo.py long)" >> $GITHUB_OUTPUT
|
|
||||||
id: version
|
|
||||||
|
|
||||||
- name: Store binaries as an artifact
|
|
||||||
uses: actions/upload-artifact@v3
|
|
||||||
with:
|
|
||||||
name: firmware-${{ matrix.board }}-${{ steps.version.outputs.version }}.zip
|
|
||||||
path: |
|
|
||||||
release/*.uf2
|
|
||||||
release/*.elf
|
|
||||||
release/*.zip
|
|
||||||
retention-days: 30
|
|
||||||
|
|
||||||
build-rpi2040:
|
build-rpi2040:
|
||||||
strategy:
|
strategy:
|
||||||
@ -231,84 +93,17 @@ jobs:
|
|||||||
matrix:
|
matrix:
|
||||||
include:
|
include:
|
||||||
- board: pico
|
- board: pico
|
||||||
|
uses: ./.github/workflows/build_rpi2040.yml
|
||||||
runs-on: ubuntu-latest
|
with:
|
||||||
steps:
|
board: ${{ matrix.board }}
|
||||||
- name: Checkout code
|
|
||||||
uses: actions/checkout@v3
|
|
||||||
with:
|
|
||||||
submodules: "recursive"
|
|
||||||
ref: ${{github.event.pull_request.head.ref}}
|
|
||||||
repository: ${{github.event.pull_request.head.repo.full_name}}
|
|
||||||
|
|
||||||
- name: Setup Python
|
|
||||||
uses: actions/setup-python@v4
|
|
||||||
with:
|
|
||||||
python-version: 3.x
|
|
||||||
|
|
||||||
- name: Cache python libs
|
|
||||||
uses: actions/cache@v3
|
|
||||||
id: cache-pip # needed in if test
|
|
||||||
with:
|
|
||||||
path: ~/.cache/pip
|
|
||||||
key: ${{ runner.os }}-pip
|
|
||||||
|
|
||||||
- name: Upgrade python tools
|
|
||||||
run: |
|
|
||||||
python -m pip install --upgrade pip
|
|
||||||
pip install -U platformio adafruit-nrfutil
|
|
||||||
|
|
||||||
- name: Upgrade platformio
|
|
||||||
run: |
|
|
||||||
pio upgrade
|
|
||||||
|
|
||||||
- name: Build Raspberry Pi 2040
|
|
||||||
run: ./bin/build-rpi2040.sh ${{ matrix.board }}
|
|
||||||
|
|
||||||
- name: Get release version string
|
|
||||||
run: echo "version=$(./bin/buildinfo.py long)" >> $GITHUB_OUTPUT
|
|
||||||
id: version
|
|
||||||
|
|
||||||
- name: Store binaries as an artifact
|
|
||||||
uses: actions/upload-artifact@v3
|
|
||||||
with:
|
|
||||||
name: firmware-${{ matrix.board }}-${{ steps.version.outputs.version }}.zip
|
|
||||||
path: |
|
|
||||||
release/*.uf2
|
|
||||||
release/*.elf
|
|
||||||
retention-days: 30
|
|
||||||
|
|
||||||
build-native:
|
build-native:
|
||||||
runs-on: ubuntu-latest
|
runs-on: ubuntu-latest
|
||||||
steps:
|
steps:
|
||||||
- name: Checkout code
|
- uses: actions/checkout@v3
|
||||||
uses: actions/checkout@v3
|
- name: Build base
|
||||||
with:
|
id: base
|
||||||
submodules: "recursive"
|
uses: ./.github/actions/setup-base
|
||||||
ref: ${{github.event.pull_request.head.ref}}
|
|
||||||
repository: ${{github.event.pull_request.head.repo.full_name}}
|
|
||||||
|
|
||||||
- name: Setup Python
|
|
||||||
uses: actions/setup-python@v4
|
|
||||||
with:
|
|
||||||
python-version: 3.x
|
|
||||||
|
|
||||||
- name: Cache python libs
|
|
||||||
uses: actions/cache@v3
|
|
||||||
id: cache-pip # needed in if test
|
|
||||||
with:
|
|
||||||
path: ~/.cache/pip
|
|
||||||
key: ${{ runner.os }}-pip
|
|
||||||
|
|
||||||
- name: Upgrade python tools
|
|
||||||
run: |
|
|
||||||
python -m pip install --upgrade pip
|
|
||||||
pip install -U platformio adafruit-nrfutil
|
|
||||||
pip install -U meshtastic --pre
|
|
||||||
|
|
||||||
- name: Upgrade platformio
|
|
||||||
run: |
|
|
||||||
pio upgrade
|
|
||||||
|
|
||||||
# We now run integration test before other build steps (to quickly see runtime failures)
|
# We now run integration test before other build steps (to quickly see runtime failures)
|
||||||
- name: Build for native
|
- name: Build for native
|
||||||
@ -335,8 +130,27 @@ jobs:
|
|||||||
release/meshtasticd_linux_amd64
|
release/meshtasticd_linux_amd64
|
||||||
release/device-*.sh
|
release/device-*.sh
|
||||||
release/device-*.bat
|
release/device-*.bat
|
||||||
retention-days: 30
|
|
||||||
|
- name: Docker login
|
||||||
|
if: ${{ github.event_name == 'workflow_dispatch' }}
|
||||||
|
uses: docker/login-action@v2
|
||||||
|
with:
|
||||||
|
username: meshtastic
|
||||||
|
password: ${{ secrets.DOCKER_TOKEN }}
|
||||||
|
|
||||||
|
- name: Docker setup
|
||||||
|
if: ${{ github.event_name == 'workflow_dispatch' }}
|
||||||
|
uses: docker/setup-buildx-action@v2
|
||||||
|
|
||||||
|
- name: Docker build and push
|
||||||
|
if: ${{ github.event_name == 'workflow_dispatch' }}
|
||||||
|
uses: docker/build-push-action@v3
|
||||||
|
with:
|
||||||
|
context: .
|
||||||
|
file: ./Dockerfile
|
||||||
|
push: true
|
||||||
|
tags: meshtastic/device-simulator:latest
|
||||||
|
|
||||||
after-checks:
|
after-checks:
|
||||||
runs-on: ubuntu-latest
|
runs-on: ubuntu-latest
|
||||||
needs: [check]
|
needs: [check]
|
||||||
|
40
.github/workflows/sec_sast_flawfinder.yml
vendored
Normal file
40
.github/workflows/sec_sast_flawfinder.yml
vendored
Normal file
@ -0,0 +1,40 @@
|
|||||||
|
---
|
||||||
|
name: Flawfinder Scan
|
||||||
|
|
||||||
|
on:
|
||||||
|
push:
|
||||||
|
branches: [master, develop]
|
||||||
|
paths-ignore:
|
||||||
|
- "**.md"
|
||||||
|
- "version.properties"
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
flawfinder:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
name: Flawfinder
|
||||||
|
|
||||||
|
steps:
|
||||||
|
# step 1
|
||||||
|
- name: clone application source code
|
||||||
|
uses: actions/checkout@v3
|
||||||
|
|
||||||
|
# step 2
|
||||||
|
- name: flawfinder_scan
|
||||||
|
uses: david-a-wheeler/flawfinder@2.0.19
|
||||||
|
with:
|
||||||
|
arguments: '--sarif ./'
|
||||||
|
output: 'flawfinder_report.sarif'
|
||||||
|
|
||||||
|
# step 3
|
||||||
|
- name: save report as pipeline artifact
|
||||||
|
uses: actions/upload-artifact@v3
|
||||||
|
with:
|
||||||
|
name: flawfinder_report.sarif
|
||||||
|
path: flawfinder_report.sarif
|
||||||
|
|
||||||
|
# step 4
|
||||||
|
- name: publish code scanning alerts
|
||||||
|
uses: github/codeql-action/upload-sarif@v2
|
||||||
|
with:
|
||||||
|
sarif_file: flawfinder_report.sarif
|
||||||
|
category: flawfinder
|
44
.github/workflows/sec_sast_semgrep_cron.yml
vendored
Normal file
44
.github/workflows/sec_sast_semgrep_cron.yml
vendored
Normal file
@ -0,0 +1,44 @@
|
|||||||
|
---
|
||||||
|
name: Semgrep Full Scan
|
||||||
|
|
||||||
|
on:
|
||||||
|
workflow_dispatch:
|
||||||
|
branches:
|
||||||
|
- master
|
||||||
|
schedule:
|
||||||
|
- cron: '0 1 * * 6'
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
|
||||||
|
semgrep-full:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
container:
|
||||||
|
image: returntocorp/semgrep
|
||||||
|
|
||||||
|
steps:
|
||||||
|
|
||||||
|
# step 1
|
||||||
|
- name: clone application source code
|
||||||
|
uses: actions/checkout@v3
|
||||||
|
|
||||||
|
# step 2
|
||||||
|
- name: full scan
|
||||||
|
run: |
|
||||||
|
semgrep \
|
||||||
|
--sarif --output report.sarif \
|
||||||
|
--metrics=off \
|
||||||
|
--config="p/default"
|
||||||
|
|
||||||
|
# step 3
|
||||||
|
- name: save report as pipeline artifact
|
||||||
|
uses: actions/upload-artifact@v3
|
||||||
|
with:
|
||||||
|
name: report.sarif
|
||||||
|
path: report.sarif
|
||||||
|
|
||||||
|
# step 4
|
||||||
|
- name: publish code scanning alerts
|
||||||
|
uses: github/codeql-action/upload-sarif@v2
|
||||||
|
with:
|
||||||
|
sarif_file: report.sarif
|
||||||
|
category: semgrep
|
28
.github/workflows/sec_sast_semgrep_pull.yml
vendored
Normal file
28
.github/workflows/sec_sast_semgrep_pull.yml
vendored
Normal file
@ -0,0 +1,28 @@
|
|||||||
|
---
|
||||||
|
name: Semgrep Differential Scan
|
||||||
|
on:
|
||||||
|
pull_request
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
|
||||||
|
semgrep-diff:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
container:
|
||||||
|
image: returntocorp/semgrep
|
||||||
|
|
||||||
|
steps:
|
||||||
|
|
||||||
|
# step 1
|
||||||
|
- name: clone application source code
|
||||||
|
uses: actions/checkout@v3
|
||||||
|
with:
|
||||||
|
fetch-depth: 0
|
||||||
|
|
||||||
|
# step 2
|
||||||
|
- name: differential scan
|
||||||
|
run: |
|
||||||
|
semgrep scan \
|
||||||
|
--error \
|
||||||
|
--metrics=off \
|
||||||
|
--baseline-commit ${{ github.event.pull_request.base.sha }} \
|
||||||
|
--config="p/default"
|
2
.semgrepignore
Normal file
2
.semgrepignore
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
.github/workflows/main_matrix.yml
|
||||||
|
src/mesh/compression/unishox2.c
|
50
Dockerfile
50
Dockerfile
@ -1,15 +1,41 @@
|
|||||||
FROM debian:bullseye-slim AS builder
|
FROM debian:bullseye-slim AS builder
|
||||||
RUN apt-get update
|
|
||||||
RUN DEBIAN_FRONTEND=noninteractive TZ=Etc/UTC apt-get -y install wget python3 g++ zip python3-venv git vim
|
ENV DEBIAN_FRONTEND=noninteractive
|
||||||
RUN wget https://raw.githubusercontent.com/platformio/platformio-core-installer/master/get-platformio.py -O get-platformio.py; chmod +x get-platformio.py
|
ENV TZ=Etc/UTC
|
||||||
RUN python3 get-platformio.py
|
|
||||||
RUN git clone https://github.com/meshtastic/firmware --recurse-submodules
|
# http://bugs.python.org/issue19846
|
||||||
RUN cd firmware
|
# > At the moment, setting "LANG=C" on a Linux system *fundamentally breaks Python 3*, and that's not OK.
|
||||||
RUN chmod +x ./firmware/bin/build-native.sh
|
ENV LANG C.UTF-8
|
||||||
RUN . ~/.platformio/penv/bin/activate; cd firmware; sh ./bin/build-native.sh
|
|
||||||
|
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
|
||||||
|
|
||||||
|
# Install build deps
|
||||||
|
USER root
|
||||||
|
RUN apt-get update && \
|
||||||
|
apt-get -y install wget python3 g++ zip python3-venv git vim ca-certificates
|
||||||
|
|
||||||
|
# create a non-priveleged user & group
|
||||||
|
RUN groupadd -g 1000 mesh && useradd -ml -u 1000 -g 1000 mesh
|
||||||
|
|
||||||
|
USER mesh
|
||||||
|
RUN wget https://raw.githubusercontent.com/platformio/platformio-core-installer/master/get-platformio.py -qO /tmp/get-platformio.py && \
|
||||||
|
chmod +x /tmp/get-platformio.py && \
|
||||||
|
python3 /tmp/get-platformio.py && \
|
||||||
|
git clone https://github.com/meshtastic/firmware --recurse-submodules /tmp/firmware && \
|
||||||
|
cd /tmp/firmware && \
|
||||||
|
chmod +x /tmp/firmware/bin/build-native.sh && \
|
||||||
|
source ~/.platformio/penv/bin/activate && \
|
||||||
|
./bin/build-native.sh
|
||||||
|
|
||||||
FROM frolvlad/alpine-glibc
|
FROM frolvlad/alpine-glibc
|
||||||
WORKDIR /root/
|
|
||||||
COPY --from=builder /firmware/release/meshtasticd_linux_amd64 ./
|
RUN apk --update add --no-cache g++ shadow && \
|
||||||
RUN apk --update add --no-cache g++
|
groupadd -g 1000 mesh && useradd -ml -u 1000 -g 1000 mesh
|
||||||
CMD sh -cx "./meshtasticd_linux_amd64 --hwid '$RANDOM'"
|
|
||||||
|
COPY --from=builder /tmp/firmware/release/meshtasticd_linux_amd64 /home/mesh/
|
||||||
|
|
||||||
|
USER mesh
|
||||||
|
WORKDIR /home/mesh
|
||||||
|
CMD sh -cx "./meshtasticd_linux_amd64 --hwid '$RANDOM'"
|
||||||
|
|
||||||
|
HEALTHCHECK NONE
|
||||||
|
@ -10,7 +10,7 @@
|
|||||||
|
|
||||||
This repository contains the device firmware for the Meshtastic project.
|
This repository contains the device firmware for the Meshtastic project.
|
||||||
|
|
||||||
**[Building Instructions](https://meshtastic.org/docs/developers/Firmware/build)**
|
**[Building Instructions](https://meshtastic.org/docs/development/firmware/build)**
|
||||||
**[Flashing Instructions](https://meshtastic.org/docs/getting-started/flashing-firmware/)**
|
**[Flashing Instructions](https://meshtastic.org/docs/getting-started/flashing-firmware/)**
|
||||||
|
|
||||||
## Stats
|
## Stats
|
||||||
|
@ -10,9 +10,6 @@ OUTDIR=release/
|
|||||||
rm -f $OUTDIR/firmware*
|
rm -f $OUTDIR/firmware*
|
||||||
rm -r $OUTDIR/* || true
|
rm -r $OUTDIR/* || true
|
||||||
|
|
||||||
# Make sure our submodules are current
|
|
||||||
git submodule update
|
|
||||||
|
|
||||||
# Important to pull latest version of libs into all device flavors, otherwise some devices might be stale
|
# Important to pull latest version of libs into all device flavors, otherwise some devices might be stale
|
||||||
platformio pkg update
|
platformio pkg update
|
||||||
|
|
||||||
|
@ -12,9 +12,6 @@ rm -f $OUTDIR/firmware*
|
|||||||
mkdir -p $OUTDIR/
|
mkdir -p $OUTDIR/
|
||||||
rm -r $OUTDIR/* || true
|
rm -r $OUTDIR/* || true
|
||||||
|
|
||||||
# Make sure our submodules are current
|
|
||||||
git submodule update
|
|
||||||
|
|
||||||
# Important to pull latest version of libs into all device flavors, otherwise some devices might be stale
|
# Important to pull latest version of libs into all device flavors, otherwise some devices might be stale
|
||||||
platformio pkg update
|
platformio pkg update
|
||||||
|
|
||||||
|
@ -10,9 +10,6 @@ OUTDIR=release/
|
|||||||
rm -f $OUTDIR/firmware*
|
rm -f $OUTDIR/firmware*
|
||||||
rm -r $OUTDIR/* || true
|
rm -r $OUTDIR/* || true
|
||||||
|
|
||||||
# Make sure our submodules are current
|
|
||||||
git submodule update
|
|
||||||
|
|
||||||
# Important to pull latest version of libs into all device flavors, otherwise some devices might be stale
|
# Important to pull latest version of libs into all device flavors, otherwise some devices might be stale
|
||||||
platformio pkg update
|
platformio pkg update
|
||||||
|
|
||||||
|
@ -10,9 +10,6 @@ OUTDIR=release/
|
|||||||
rm -f $OUTDIR/firmware*
|
rm -f $OUTDIR/firmware*
|
||||||
rm -r $OUTDIR/* || true
|
rm -r $OUTDIR/* || true
|
||||||
|
|
||||||
# Make sure our submodules are current
|
|
||||||
git submodule update
|
|
||||||
|
|
||||||
# Important to pull latest version of libs into all device flavors, otherwise some devices might be stale
|
# Important to pull latest version of libs into all device flavors, otherwise some devices might be stale
|
||||||
platformio pkg update
|
platformio pkg update
|
||||||
|
|
||||||
|
@ -25,11 +25,11 @@ bool SX126xInterface<T>::init()
|
|||||||
pinMode(SX126X_POWER_EN, OUTPUT);
|
pinMode(SX126X_POWER_EN, OUTPUT);
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
#ifdef SX126X_RXEN // set not rx or tx mode
|
#if defined(SX126X_RXEN) && (SX126X_RXEN != RADIOLIB_NC) // set not rx or tx mode
|
||||||
digitalWrite(SX126X_RXEN, LOW); // Set low before becoming an output
|
digitalWrite(SX126X_RXEN, LOW); // Set low before becoming an output
|
||||||
pinMode(SX126X_RXEN, OUTPUT);
|
pinMode(SX126X_RXEN, OUTPUT);
|
||||||
#endif
|
#endif
|
||||||
#ifdef SX126X_TXEN
|
#if defined(SX126X_TXEN) && (SX126X_TXEN != RADIOLIB_NC)
|
||||||
digitalWrite(SX126X_TXEN, LOW);
|
digitalWrite(SX126X_TXEN, LOW);
|
||||||
pinMode(SX126X_TXEN, OUTPUT);
|
pinMode(SX126X_TXEN, OUTPUT);
|
||||||
#endif
|
#endif
|
||||||
@ -66,7 +66,7 @@ bool SX126xInterface<T>::init()
|
|||||||
DEBUG_MSG("Current limit set to %f\n", currentLimit);
|
DEBUG_MSG("Current limit set to %f\n", currentLimit);
|
||||||
DEBUG_MSG("Current limit set result %d\n", res);
|
DEBUG_MSG("Current limit set result %d\n", res);
|
||||||
|
|
||||||
#ifdef SX126X_TXEN
|
#if defined(SX126X_TXEN) && (SX126X_TXEN != RADIOLIB_NC)
|
||||||
// lora.begin sets Dio2 as RF switch control, which is not true if we are manually controlling RX and TX
|
// lora.begin sets Dio2 as RF switch control, which is not true if we are manually controlling RX and TX
|
||||||
if (res == RADIOLIB_ERR_NONE)
|
if (res == RADIOLIB_ERR_NONE)
|
||||||
res = lora.setDio2AsRfSwitch(true);
|
res = lora.setDio2AsRfSwitch(true);
|
||||||
@ -167,12 +167,16 @@ void SX126xInterface<T>::setStandby()
|
|||||||
checkNotification(); // handle any pending interrupts before we force standby
|
checkNotification(); // handle any pending interrupts before we force standby
|
||||||
|
|
||||||
int err = lora.standby();
|
int err = lora.standby();
|
||||||
|
|
||||||
|
if (err != RADIOLIB_ERR_NONE)
|
||||||
|
DEBUG_MSG("SX126x standby failed with error %d\n", err);
|
||||||
|
|
||||||
assert(err == RADIOLIB_ERR_NONE);
|
assert(err == RADIOLIB_ERR_NONE);
|
||||||
|
|
||||||
#ifdef SX126X_RXEN // we have RXEN/TXEN control - turn off RX and TX power
|
#if defined(SX126X_RXEN) && (SX126X_RXEN != RADIOLIB_NC) // we have RXEN/TXEN control - turn off RX and TX power
|
||||||
digitalWrite(SX126X_RXEN, LOW);
|
digitalWrite(SX126X_RXEN, LOW);
|
||||||
#endif
|
#endif
|
||||||
#ifdef SX126X_TXEN
|
#if defined(SX126X_TXEN) && (SX126X_TXEN != RADIOLIB_NC)
|
||||||
digitalWrite(SX126X_TXEN, LOW);
|
digitalWrite(SX126X_TXEN, LOW);
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
@ -197,10 +201,10 @@ void SX126xInterface<T>::addReceiveMetadata(MeshPacket *mp)
|
|||||||
template<typename T>
|
template<typename T>
|
||||||
void SX126xInterface<T>::configHardwareForSend()
|
void SX126xInterface<T>::configHardwareForSend()
|
||||||
{
|
{
|
||||||
#ifdef SX126X_TXEN // we have RXEN/TXEN control - turn on TX power / off RX power
|
#if defined(SX126X_TXEN) && (SX126X_TXEN != RADIOLIB_NC) // we have RXEN/TXEN control - turn on TX power / off RX power
|
||||||
digitalWrite(SX126X_TXEN, HIGH);
|
digitalWrite(SX126X_TXEN, HIGH);
|
||||||
#endif
|
#endif
|
||||||
#ifdef SX126X_RXEN
|
#if defined(SX126X_RXEN) && (SX126X_RXEN != RADIOLIB_NC)
|
||||||
digitalWrite(SX126X_RXEN, LOW);
|
digitalWrite(SX126X_RXEN, LOW);
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
@ -219,10 +223,10 @@ void SX126xInterface<T>::startReceive()
|
|||||||
|
|
||||||
setStandby();
|
setStandby();
|
||||||
|
|
||||||
#ifdef SX126X_RXEN // we have RXEN/TXEN control - turn on RX power / off TX power
|
#if defined(SX126X_RXEN) && (SX126X_RXEN != RADIOLIB_NC) // we have RXEN/TXEN control - turn on RX power / off TX power
|
||||||
digitalWrite(SX126X_RXEN, HIGH);
|
digitalWrite(SX126X_RXEN, HIGH);
|
||||||
#endif
|
#endif
|
||||||
#ifdef SX126X_TXEN
|
#if defined(SX126X_TXEN) && (SX126X_TXEN != RADIOLIB_NC)
|
||||||
digitalWrite(SX126X_TXEN, LOW);
|
digitalWrite(SX126X_TXEN, LOW);
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
|
@ -59,11 +59,11 @@ static const uint8_t SCK = 33;
|
|||||||
|
|
||||||
// https://docs.rakwireless.com/Product-Categories/WisBlock/RAK13300/
|
// https://docs.rakwireless.com/Product-Categories/WisBlock/RAK13300/
|
||||||
|
|
||||||
#define LORA_DIO0 -1 // a No connect on the SX1262/SX1268 module
|
#define LORA_DIO0 RADIOLIB_NC // a No connect on the SX1262/SX1268 module
|
||||||
#define LORA_RESET WB_IO4 // RST for SX1276, and for SX1262/SX1268
|
#define LORA_RESET WB_IO4 // RST for SX1276, and for SX1262/SX1268
|
||||||
#define LORA_DIO1 WB_IO6 // IRQ for SX1262/SX1268
|
#define LORA_DIO1 WB_IO6 // IRQ for SX1262/SX1268
|
||||||
#define LORA_DIO2 WB_IO5 // BUSY for SX1262/SX1268
|
#define LORA_DIO2 WB_IO5 // BUSY for SX1262/SX1268
|
||||||
#define LORA_DIO3 // Not connected on PCB, but internally on the TTGO SX1262/SX1268, if DIO3 is high the TXCO is enabled
|
#define LORA_DIO3 RADIOLIB_NC // Not connected on PCB, but internally on the TTGO SX1262/SX1268, if DIO3 is high the TXCO is enabled
|
||||||
|
|
||||||
#undef RF95_SCK
|
#undef RF95_SCK
|
||||||
#define RF95_SCK SCK
|
#define RF95_SCK SCK
|
||||||
@ -75,10 +75,9 @@ static const uint8_t SCK = 33;
|
|||||||
#define RF95_NSS SS
|
#define RF95_NSS SS
|
||||||
|
|
||||||
#define USE_SX1262
|
#define USE_SX1262
|
||||||
#define SX126X_CS (SS)// NSS for SX126X
|
#define SX126X_CS SS// NSS for SX126X
|
||||||
#define SX126X_DIO1 (LORA_DIO1)
|
#define SX126X_DIO1 LORA_DIO1
|
||||||
#define SX126X_BUSY (LORA_DIO2)
|
#define SX126X_BUSY LORA_DIO2
|
||||||
#define SX126X_RESET (LORA_RESET)
|
#define SX126X_RESET LORA_RESET
|
||||||
#define SX126X_TXEN (-1)
|
#define SX126X_POWER_EN WB_IO3
|
||||||
#define SX126X_RXEN (WB_IO3)
|
|
||||||
#define SX126X_E22 // DIO2 controlls an antenna switch and the TCXO voltage is controlled by DIO3
|
#define SX126X_E22 // DIO2 controlls an antenna switch and the TCXO voltage is controlled by DIO3
|
||||||
|
Loading…
Reference in New Issue
Block a user