install: stop fleet-converging on the OpenIPC default MAC

[widgetii]

Summary

OpenIPC's u-boot binaries ship with ethaddr=00:00:23:34:45:66 baked into the LZMA-compressed default env (verified for hi3516av200 and hi3516cv300). When a camera boots with an empty NAND env partition, u-boot loads that default into RAM. Anyone running saveenv then immortalizes the bogus MAC into flash — and a fleet of installed cameras converges on the same address. Lab observation: multiple cameras restored via defib install all came up as HWaddr 00:00:23:34:45:66.

Two fixes, both in defib install

1. Move env-partition wiping behind --wipe-env

Default off. The new u-boot fits inside the boot partition, so the env partition doesn't need to be erased. Erasing it actively destroys whatever ethaddr u-boot last persisted, forcing the fall-through to the bogus default.

2. Defensive ethaddr replacement before saveenv

Query printenv ethaddr, parse the value. If it's missing, malformed, or matches the OpenIPC default, generate a random locally-administered unicast MAC (first octet (rand & 0xfc) | 0x02) and setenv ethaddr so saveenv writes a unique address. Logs the rescue MAC so it's visible in install output.

New module src/defib/uboot_env.py holds the helpers and constants.

Test plan

• uv run pytest tests/test_uboot_env.py -v — 18/18 (format checks, locally-administered bit set, multicast bit clear, default detection in upper/lower case, malformed handling, printenv parsing edge cases)
• uv run pytest tests/ -x -q --ignore=tests/fuzz — 425 passed, 2 skipped
• uv run ruff check src/ tests/ — clean
• uv run mypy src/defib/cli/app.py src/defib/uboot_env.py --ignore-missing-imports — clean
• make -C agent test HOST_CC=gcc — 5406/5406
• Hardware on av200 NAND: pre-fix → HWaddr 00:00:23:34:45:66 (reproduces the bug);
  post-fix install → ethaddr was 00:00:23:34:45:66 (OpenIPC default) — assigning 6e:32:ed:20:ec:5e;
  after a real cold-boot the camera presents 6e:32:ed:20:ec:5e in both /sys/class/net/eth0/address and fw_printenv ethaddr, and the rest of the install env (mtdparts, bootcmd, bootargs) persists correctly through reboot.

Notes

• --wipe-env is preserved for cases where someone really does want a clean env (e.g. recovering from corrupted env). The default just stops doing it implicitly.
• The rescue MAC is locally-administered (bit 1 of first octet set), so it can never collide with any vendor OUI — including HiSilicon's 00:12:31:.... Cameras that have a real factory-derived MAC saved in env are detected by the is_unset_or_default_ethaddr check and left alone.

🤖 Generated with Claude Code