Add verified WSS transport for legacy boards

Configure the default WSS endpoint and ISRG Root X2 trust anchor, preserve device authentication, enforce TLS and WebSocket handshake validation, and handle partial I/O and connection cleanup. Add host tests, server probes, package verification and integration documentation. Backend 443 /ws still returns HTTP 404; on-device validation remains pending.
2026-09-16 11:23:33 +08:00
parent 4b565958f9
commit 3e463f57b6
23 changed files with 809 additions and 396 deletions
@@ -0,0 +1,46 @@
+"""Verify the WSS flash package against the current legacy-board build."""
+import hashlib
+import json
+import re
+import subprocess
+import zipfile
+from pathlib import Path
+
+root = Path(__file__).resolve().parents[1]
+output = root / 'artifacts/wss'
+package = output / 'EG800AKCN_11LG-legacy-wss.zip'
+objdump = root / 'ql-cross-tool/win32/owtoolchain/gcc-arm-none-eabi/bin/arm-none-eabi-objdump.exe'
+app = root / 'ql-application/threadx/build/app.elf'
+symbols = subprocess.check_output([str(objdump.with_name('arm-none-eabi-nm.exe')), str(app)], text=True)
+required = ['talkingq_parse_wss_url', 'talkingq_root_ca', 'rws_check_handshake', 'rws_ssl_conn',
+            'mbedtls_ssl_set_hostname', 'mbedtls_ssl_get_verify_result', 'mbedtls_ssl_conf_authmode',
+            'mbedtls_ctr_drbg_random', 'mbedtls_sha1', 'mbedtls_base64_encode']
+for symbol in required:
+    assert re.search(r'\b' + symbol + r'$', symbols, re.M), 'Missing linked symbol: ' + symbol
+report = {'package': package.name, 'sha256': hashlib.sha256(package.read_bytes()).hexdigest(),
+          'linked_symbols': required, 'hardware_test': 'Not performed',
+          'backend': '443 /ws returns HTTP 404; 8080 is plaintext WS'}
+with zipfile.ZipFile(package) as archive:
+    assert archive.testzip() is None, 'ZIP CRC failure'
+    for name, source in {'cp.bin': 'ql-kernel/threadx/build/release_kernel.bin',
+                         'customer_app.bin': 'ql-application/threadx/build/app.bin'}.items():
+        data = archive.read(name)
+        assert data == (root / source).read_bytes(), 'Stale image: ' + name
+        report[name] = {'bytes': len(data), 'sha256': hashlib.sha256(data).hexdigest()}
+    assert b'wss://banban.api.talkingq.com:443/ws' in archive.read('customer_app.bin')
+    report['download_manifest'] = json.loads(archive.read('download.json'))
+with zipfile.ZipFile(root / 'artifacts/legacy-no-gnss/EG800AKCN_11LG-legacy-no-gnss.zip') as old:
+    with zipfile.ZipFile(package) as new:
+        assert old.read('cp.bin') == new.read('cp.bin'), 'Legacy kernel changed unexpectedly'
+printf_address = int(re.search(r'^([0-9a-fA-F]+) T printf$', symbols, re.M).group(1), 16)
+for symbol, binary, expected in [
+    ('quec_get_gnssid_task', root / 'ql-kernel/threadx/build/kernel.axf', '<RTI_LOG>'),
+    ('app_gnss_init', app, '0x%08x' % (printf_address | 1)),
+    ('set_gnss_mode', app, 'bx\tlr')]:
+    body = subprocess.check_output([str(objdump), '-d', '--disassemble=' + symbol, str(binary)], text=True)
+    assert '<' + symbol + '>:' in body and expected in body and 'task_create' not in body
+    (output / (symbol + '.disasm.txt')).write_text(body)
+report['verification'] = 'PASS: ZIP CRC, current APP/kernel identity, unchanged legacy kernel, GNSS bypass, WSS URL and TLS symbols'
+(output / 'verification.json').write_text(json.dumps(report, indent=2))
+print(report['verification'])
+print('SHA256:', report['sha256'])