v0.2.0

Fry Firmware v0.2.0

Contiguous-block heap gating so the ESP8266 refuses an unsafe TLS/OTA attempt
instead of crashing, ESP32 certificate verification against the full Mozilla
root store, a browser flasher on GitHub Pages, and NAPT documented as a
framework limitation with the evidence.

Fry Firmware v0.1.1

Fry Firmware v0.1.1

Two fixes, both proven on an ESP32 against the live hardwareapi.

WireGuard tunnels now come up

set_wg stored the whole host:port string as the endpoint and never recorded the port
separately. esp_wireguard passes that string straight to lwIP's dns_gethostbyname, which
cannot parse a trailing :port, so even an IP literal was treated as a hostname and
resolution never completed. Every attempt returned ESP_ERR_RETRY (0x201), surfacing as
wg: connect failed err=513, and the tunnel never established.

The connect call also treated that code as fatal. ESP_ERR_RETRY is an advisory to call
again while the lookup finishes, so it is now retried up to ten times at 500 ms and only for
that code. The NTP sync result, previously discarded, is honoured as well.

Verified on hardware: wg: handshake ok, confirmed server-side by a fresh handshake with
244 B received / 92 B sent, health reporting vpn=up, and three SOCKS5 relays at HTTP 200.

OTA no longer downgrades

The manifest check compared versions with strcmp(...) != 0, treating any difference as an
update in either direction. A device running a build newer than the published manifest
overwrote itself with the older image. Versions are now compared numerically and an update
only ever moves a device forward. Deliberate rollback remains slot-based.

The text comparison was also wrong on its own terms: 0.9.0 sorts above 0.10.0 as text.

Known issues

• ESP8266 OTA over HTTPS can exhaust the heap and reset the chip. Plain HTTP completes a full
  OTA cleanly. Gate on the largest free block rather than total free heap.
• ESP32-family TLS still uses setInsecure(); certificate verification is not yet enabled.
• NAPT is unavailable on this build, so the tunnel is relay-only via SOCKS5.

Fry Firmware v0.1.0

First release of the Fry Networks embedded firmware.

Turns an ESP-class board into a Fry dVPN endpoint miner.

• ESP32, ESP32-S3 and ESP32-C3: Bluetooth LE provisioning plus a WireGuard relay endpoint
• ESP8266: captive-portal provisioning plus a SOCKS5 bandwidth-sharing proxy
• Over-the-air updates driven by the signed manifest published with each release
• hardwareapi client for registration, lease renewal and proof-of-contribution reporting
• Miner identity derived on-device and persisted; the wallet is supplied during provisioning

Flash the image matching your board, then provision it with the Fry Android app.

Verified on hardware: an ESP8266 boots, provisions, joins Wi-Fi, serves SOCKS5 traffic and
completes a full over-the-air update with SHA-256 verification.

Known limitations in this release:

• Over-the-air updates on ESP8266 are verified over plain HTTP. The HTTPS path exhausts the
  available heap on that chip and should not be relied on yet.
• The hardwareapi server does not yet accept the IOTVPN miner code, so registration returns 401
  and the device reports it and carries on. Everything else runs normally.
• ESP32-S3 and ESP32-C3 images are built and published but have not been run on hardware.