feat: OTA control plane (signed firmware releases, update scheduling, TLS, admin UI) #8

Merged

troed merged 13 commits from devel into main 2026-10-10 17:35:28 +02:00

Conversation 0 Commits 13 Files changed 29 +3320 -21

troed commented 2026-09-11 14:54:04 +02:00

Owner

Copy link

OTA control plane (crew)

Implements the crew side of the Starfleet OTA design
(docs/specs/2026-09-10-ota-design.md, spec + plan docs in this PR):

• crew/firmware.py (new): strict MAJOR.MINOR.PATCH version parsing,
  manifest validation, Ed25519 signature verification (new cryptography dep).
• Store: firmware_releases + firmware_updates tables (FK'd),
  devices.last_firmware_version with legacy-DB migration.
• API: PUT /firmware/{version} (multipart image+manifest+signature;
  strict validation pipeline; DB row rolled back on file-write failure),
  GET /firmware, the open-on-LAN download surface (latest.json,
  manifest.json, manifest.sig, image.bin), PUT/DELETE /devices/{id}/firmware-update, GET /devices/{id}/firmware-pending, and
  firmware fields on GET /devices rows (derived pending/applied status).
• CLI: TLS serving when api.tls_cert/api.tls_key are configured.
• Admin UI: Firmware page + per-device firmware rows with Schedule/Cancel.
• Docs: README config/API/section updates, AGENTS.md, regenerated
  screenshots.

Tests: 190 passing; ruff + mypy clean. Admin UI verified in a live browser
session (all badge states, schedule/cancel round-trips).

Follow-up plans (same spec, separate PRs): ② computer (server.ota.schedule
relay, wss migration, conformance) ③ communicator-esp32 (A/B partitions,
ota module) ④ communicator-sailfish (wss migration).

# OTA control plane (crew) Implements the crew side of the Starfleet OTA design (`docs/specs/2026-09-10-ota-design.md`, spec + plan docs in this PR): - **`crew/firmware.py`** (new): strict `MAJOR.MINOR.PATCH` version parsing, manifest validation, Ed25519 signature verification (new `cryptography` dep). - **Store**: `firmware_releases` + `firmware_updates` tables (FK'd), `devices.last_firmware_version` with legacy-DB migration. - **API**: `PUT /firmware/{version}` (multipart image+manifest+signature; strict validation pipeline; DB row rolled back on file-write failure), `GET /firmware`, the open-on-LAN download surface (`latest.json`, `manifest.json`, `manifest.sig`, `image.bin`), `PUT/DELETE /devices/{id}/firmware-update`, `GET /devices/{id}/firmware-pending`, and firmware fields on `GET /devices` rows (derived pending/applied status). - **CLI**: TLS serving when `api.tls_cert`/`api.tls_key` are configured. - **Admin UI**: Firmware page + per-device firmware rows with Schedule/Cancel. - **Docs**: README config/API/section updates, AGENTS.md, regenerated screenshots. Tests: 190 passing; ruff + mypy clean. Admin UI verified in a live browser session (all badge states, schedule/cancel round-trips). Follow-up plans (same spec, separate PRs): ② computer (`server.ota.schedule` relay, wss migration, conformance) ③ communicator-esp32 (A/B partitions, ota module) ④ communicator-sailfish (wss migration).

troed added 12 commits 2026-09-11 14:54:04 +02:00

docs: OTA design spec (signed firmware updates, A/B rollback, wss migration) c3cae0b746

docs: crew OTA control plane implementation plan ca89db67e3

feat(config): firmware dir, public base URL, signing key, and TLS cert paths 5d36ec4a5e

feat(firmware): version parsing, manifest validation, and Ed25519 signature check 9225a53d5f

feat(store): firmware releases, pending updates, and device firmware version 558fc4df39

feat(api): firmware release upload and validation, download surface, and update scheduling 4ba71d52d5

fix(api): 422 instead of 500 for non-UTF-8 signature payloads 8b96ff28cc

feat(cli): serve TLS when api.tls_cert and api.tls_key are configured f01bb27e43

feat(ui): firmware panel and per-device update scheduling 9e566c04d9

docs: firmware endpoints, config, and OTA control-plane overview be678638fc

fix(firmware): roll back release row on file-write failure; use live firmware version ... 8c681554d5

- store: add delete_firmware_release for release rollback
- put_firmware_release: return 500 and delete the row when release files fail to write, so the version is not permanently re-upload-blocked and downloads/latest.json do not point at a missing release
- list_devices: derive firmware version/status from the live value (strictly newer than the stored row) so the pending->applied flip is not one poll late
- tests: write-failure rollback, same-poll applied status, firmware-pending public base URL pin, and newest-first release list pin

docs: regenerate README screenshots with firmware UI 2d58193b16

troed added 1 commit 2026-10-06 09:18:07 +02:00

fix(firmware): persist device-reported version on the pending relay ... d58fb61899

The device reports its running firmware version on every connect. crew now
records it when computer asks for firmware-pending, so the derived
applied/pending status survives the device dropping out of computer's live
registry. An already-current device gets 404 (nothing pending), so computer
stops re-sending server.ota.schedule while crew still shows the update as
applied.

troed merged commit 072259b1a6 into main 2026-10-10 17:35:28 +02:00

troed referenced this pull request from a commit 2026-10-10 17:35:29 +02:00

Merge pull request 'feat: OTA control plane (signed firmware releases, update scheduling, TLS, admin UI)' (#8) from devel into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

starfleet/crew!8

No description provided.