Skip to content

v0.2.4

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Apr 15:51
v0.2.4
a1064d0 
feat: OTA token auth, SHA-256 verification, and coredump Bearer auth

Security hardening for the OTA and coredump endpoints:

- OTA token auth: unitcams3/ota/set requires JSON {"url":"...","token":"..."}
  when OTA token is configured; bare URL still accepted when token is empty
- OTA SHA-256: optional sha256 field verified against full PSRAM firmware
  buffer before any flash write; hash stored in RTC_NOINIT_ATTR alongside URL
- Coredump Bearer auth: GET /api/coredump requires Authorization: Bearer token
  when coredump token is configured; 401 with WWW-Authenticate on failure
- /setup page: OTA Token and Coredump Token fields added; values never
  reflected in HTML (placeholder only); POST preserves existing token if
  field left blank
- config_mgr: ota_token and cd_token fields backed by NVS + Kconfig fallbacks
- IPC task stack raised to 2048 bytes (fixes boot-time double-exception)
- esp_driver_gpio removed from mqtt_mgr; LED GPIO moved to main.c callback
- Docs: CHANGELOG v0.2.4, CLAUDE.md, ARCHITECTURE.md, SECURITY.md, README.md

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Assets 7
Loading