Skip to content

Commit 9f3ac3a

Browse files
will-v-piwill-v-pi
authored
Add support for using GitHub release assets (#805)
* Add support for using GitHub release assets This adds support for using a GitHub release asset as the update (e.g. https://github.com/raspberrypi/debugprobe/releases/download/debugprobe-v2.3.1/debugprobe_on_pico2.uf2) github.com uses the new Sectigo E46 CA, so this appends that to the default_ca_cert, but the release assets redirect to... githubusercontent.com which uses Let's Encrypt RSA, so requires toggling that back on
1 parent 95f6ffa commit 9f3ac3a

3 files changed

Lines changed: 71 additions & 2 deletions

File tree

‎rpi-connect/rpi-connect-ota-demo/CMakeLists.txt‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,10 +57,18 @@ target_compile_definitions(rpi_connect_ota_demo_libs INTERFACE
5757
# For data-limited or metered connections: check once for a pending deployment
5858
# after boot sync instead of holding the SSE event stream open.
5959
# RPI_CONNECT_OTA_DEMO_POLL_ONLY=1
60-
# If artefacts are hosted on a server that does not chain to the Pi
61-
# Connect root CA, disable TLS verification for the download only;
60+
# If artefacts are hosted on a server that does not chain to the
61+
# Let's Encrypt X2 root CA, disable TLS verification for the download only;
6262
# integrity then rests on the deployment's SHA-256 checksum.
6363
# RPI_CONNECT_OTA_DEMO_UNVERIFIED_DOWNLOAD=1
64+
# If artefacts are hosted on a server that uses RSA keys instead of ECC ones,
65+
# add RSA support to the default mbedtls_config.h file, and use the
66+
# Let's Encrypt X1 root CA, which is RSA.
67+
# RPI_CONNECT_OTA_CONFIG_SUPPORT_RSA=1
68+
# If artefacts are hosted on GitHub, you can add these certificates for
69+
# verified downloads - also requires RPI_CONNECT_OTA_CONFIG_SUPPORT_RSA=1
70+
# because githubusercontent.com uses RSA certificates.
71+
# RPI_CONNECT_OTA_DEMO_ADD_GITHUB_CERTS=1
6472
# For debugging, uncomment any of these to enable verbose logging in the
6573
# libraries (or per-chunk progress etc. in the demo app):
6674
# RPI_CONNECT_DEBUG_ENABLE=1 # core rpi_connect debug (incl. HTTP request layer)

‎rpi-connect/rpi-connect-ota-demo/main_pico.c‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,10 @@
1919
#include "pico/unique_id.h"
2020
#include "hardware/watchdog.h"
2121

22+
#if RPI_CONNECT_OTA_DEMO_ADD_GITHUB_CERTS
23+
#include "sectigo_ca_cert.h"
24+
#endif
25+
2226
static char *rpi_connect_ota_demo_wifi_password;
2327
static char *rpi_connect_ota_demo_wifi_ssid;
2428

@@ -138,6 +142,19 @@ int main() {
138142
// Reload watchdog with ~16s now connected to WiFi
139143
reload_watchdog_timeout(false);
140144

145+
#if RPI_CONNECT_OTA_DEMO_ADD_GITHUB_CERTS
146+
// Append GitHub root CA to the default certificates
147+
const char * default_ca_cert = rpi_connect_default_ca_cert();
148+
size_t default_ca_cert_len = strlen(default_ca_cert);
149+
const char * const sectigo_e46_ca_cert = SECTIGO_E46_CA_CERT;
150+
size_t sectigo_e46_ca_cert_len = strlen(sectigo_e46_ca_cert);
151+
size_t new_ca_cert_len = default_ca_cert_len + sectigo_e46_ca_cert_len + 1;
152+
char * new_ca_cert = malloc(new_ca_cert_len);
153+
strcat(new_ca_cert, default_ca_cert);
154+
strcat(new_ca_cert, sectigo_e46_ca_cert);
155+
rpi_connect_set_ca_cert(new_ca_cert);
156+
#endif
157+
141158
retries = 5;
142159
while ((rc = rpi_connect_ota_demo_init(rpi_connect_client_id(), serial_number, "rpi_connect_ota_demo")) != PICO_OK && --retries) {
143160
sleep_ms(2000);
@@ -152,6 +169,10 @@ int main() {
152169
rc = 0;
153170

154171
end:
172+
#if RPI_CONNECT_OTA_DEMO_ADD_GITHUB_CERTS
173+
// Free the CA certitificates
174+
free(new_ca_cert);
175+
#endif
155176
cyw43_arch_disable_sta_mode();
156177
cyw43_arch_deinit();
157178
RPI_CONNECT_OTA_DEMO_INFO("Disconnected\n");

‎rpi-connect/rpi-connect-ota-demo/sectigo_ca_cert.h‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
/*
2+
* Copyright (c) 2025 Raspberry Pi (Trading) Ltd.
3+
*
4+
* SPDX-License-Identifier: BSD-3-Clause
5+
*/
6+
7+
#ifndef _SECTIGO_CA_CERT_H
8+
#define _SECTIGO_CA_CERT_H
9+
10+
#ifdef __cplusplus
11+
extern "C" {
12+
#endif
13+
14+
#define SECTIGO_E46_CA_CERT \
15+
"-----BEGIN CERTIFICATE-----\n" \
16+
"MIIDRjCCAsugAwIBAgIQGp6v7G3o4ZtcGTFBto2Q3TAKBggqhkjOPQQDAzCBiDEL\n" \
17+
"MAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNl\n" \
18+
"eSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMT\n" \
19+
"JVVTRVJUcnVzdCBFQ0MgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMjEwMzIy\n" \
20+
"MDAwMDAwWhcNMzgwMTE4MjM1OTU5WjBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMP\n" \
21+
"U2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIg\n" \
22+
"QXV0aGVudGljYXRpb24gUm9vdCBFNDYwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAR2\n" \
23+
"+pmpbiDt+dd34wc7qNs9Xzjoq1WmVk/WSOrsfy2qw7LFeeyZYX8QeccCWvkEN/U0\n" \
24+
"NSt3zn8gj1KjAIns1aeibVvjS5KToID1AZTc8GgHHs3u/iVStSBDHBv+6xnOQ6Oj\n" \
25+
"ggEgMIIBHDAfBgNVHSMEGDAWgBQ64QmG1M8ZwpZ2dEl23OA1xmNjmjAdBgNVHQ4E\n" \
26+
"FgQU0SLaTFnxS18mOKqd1u7rDcP7qWEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB\n" \
27+
"/wQFMAMBAf8wHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBEGA1UdIAQK\n" \
28+
"MAgwBgYEVR0gADBQBgNVHR8ESTBHMEWgQ6BBhj9odHRwOi8vY3JsLnVzZXJ0cnVz\n" \
29+
"dC5jb20vVVNFUlRydXN0RUNDQ2VydGlmaWNhdGlvbkF1dGhvcml0eS5jcmwwNQYI\n" \
30+
"KwYBBQUHAQEEKTAnMCUGCCsGAQUFBzABhhlodHRwOi8vb2NzcC51c2VydHJ1c3Qu\n" \
31+
"Y29tMAoGCCqGSM49BAMDA2kAMGYCMQCMCyBit99vX2ba6xEkDe+YO7vC0twjbkv9\n" \
32+
"PKpqGGuZ61JZryjFsp+DFpEclCVy4noCMQCwvZDXD/m2Ko1HA5Bkmz7YQOFAiNDD\n" \
33+
"49IWa2wdT7R3DtODaSXH/BiXv8fwB9su4tU=\n" \
34+
"-----END CERTIFICATE-----\n"
35+
36+
#ifdef __cplusplus
37+
}
38+
#endif
39+
40+
#endif // _SECTIGO_CA_CERT_H

0 commit comments

Comments
 (0)