Merge branch 'main' of github.com:CivicTechTO/tRacket-sensor into 21-access-point-dropdown

Author: tcsullivan

.github/workflows/dummy_priv_key.pem

@@ -24,7 +24,6 @@ jobs:
 
       - name: Create header files
         run: |
-          cp "${GITHUB_WORKSPACE}/.github/workflows/dummy_priv_key.pem" "${GITHUB_WORKSPACE}/priv_key.pem"
           cp "${GITHUB_WORKSPACE}/noisemeter-device/config.h.example" "${GITHUB_WORKSPACE}/noisemeter-device/config.h"
           python "${GITHUB_WORKSPACE}/noisemeter-device/certs.py" -s api.tracket.info > "${GITHUB_WORKSPACE}/noisemeter-device/certs.h"
 
@@ -33,3 +32,4 @@ jobs:
 
       - name: Build PlatformIO Project (esp32-breadboard)
         run: pio run -e esp32-breadboard
+

.github/workflows/main.yml

@@ -0,0 +1,42 @@
+name: OTA Release
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  generate:
+    name: Create release-artifacts
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/[email protected]
+      - uses: actions/[email protected]
+        with:
+          path: |
+            ~/.cache/pip
+            ~/.platformio/.cache
+          key: ${{ runner.os }}-pio
+      - uses: actions/[email protected]
+        with:
+          python-version: '3.9'
+      - name: Install Python packages
+        run: |
+          pip install --upgrade platformio
+          pip install --upgrade cryptography
+
+      - name: Create files
+        env:
+          OTA_KEY: ${{ secrets.OTA_SIGNING_KEY }}
+        run: |
+          echo "$OTA_KEY" > "${GITHUB_WORKSPACE}/priv_key.pem"
+          cp "${GITHUB_WORKSPACE}/noisemeter-device/config.h.example" "${GITHUB_WORKSPACE}/noisemeter-device/config.h"
+          python "${GITHUB_WORKSPACE}/noisemeter-device/certs.py" -s api.tracket.info > "${GITHUB_WORKSPACE}/noisemeter-device/certs.h"
+
+      - name: Build signed firmware
+        run: pio run -t ota -e esp32-pcb
+
+      - name: Upload signed firmware
+        uses: djn24/add-asset-to-release@v1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          path: 'firmware_signed.bin'

.github/workflows/ota-release.yml

@@ -0,0 +1,13 @@
+#!/bin/bash
+#
+# Run this script with a newly manufactured tRacket board connected to give it
+# a unique storage encryption key and flash the latest firmware.
+# The "tail" command will show the board's UUID; this needs to be added to the
+# server for device registration.
+
+dd if=/dev/urandom of=hmac_key bs=1 count=32
+echo "BURN" | pio pkg exec -- espefuse.py --port /dev/ttyACM0 burn_key BLOCK4 hmac_key HMAC_UP
+rm hmac_key
+pio run -t upload
+tail -F /dev/ttyACM0
+

bringup.sh

@@ -1,16 +1,13 @@
 Import("env")
 
-env.AddPostAction(
-    "$BUILD_DIR/${PROGNAME}.bin",
-    env.VerboseAction(
+env.AddCustomTarget(
+    name="ota",
+    dependencies="$BUILD_DIR/${PROGNAME}.bin",
+    actions=[
         "openssl dgst -sha256 -sign priv_key.pem -keyform PEM -out $BUILD_DIR/${PROGNAME}.sig -binary $BUILD_DIR/${PROGNAME}.bin",
-        "Creating OTA signature...")
-)
-
-env.AddPostAction(
-    "$BUILD_DIR/${PROGNAME}.bin",
-    env.VerboseAction(
-        "cat $BUILD_DIR/${PROGNAME}.sig $BUILD_DIR/${PROGNAME}.bin > ${PROGNAME}_signed.bin",
-        "Creating ${PROGNAME}_signed.bin")
+        "cat $BUILD_DIR/${PROGNAME}.sig $BUILD_DIR/${PROGNAME}.bin > ${PROGNAME}_signed.bin"
+    ],
+    title="OTA Signing",
+    description="Create a signed OTA update"
 )
 

build_hooks.py

@@ -14,7 +14,7 @@ include_dir = noisemeter-device
 default_envs = esp32-pcb
 
 [env]
-extra_scripts = post:build_hooks.py
+extra_scripts = build_hooks.py
 framework = arduino
 platform = [email protected]
 board_build.partitions = nmpartitions.csv