dangernoodle-io / breadboard / 27515650940

100%

push

github

feat(tls): opt-in per-transport TLS gates + capability flags + mode-aware buffers (B1-291, B1-274, B1-279) (#431)

BREAKING (pre-release): sink TLS is now opt-in, default OFF.

- new gates in components/bb_tls_creds/Kconfig: CONFIG_BB_MQTT_TLS_ENABLE,
  CONFIG_BB_HTTP_TLS_ENABLE (default n), CONFIG_BB_TLS_MUTUAL_ENABLE (default n,
  depends on a transport gate). default build = plaintext sinks (smallest
  footprint); consumers opt in per-transport. the OTA/update-check HTTPS path
  (esp_http_client crt-bundle) is independent of these sink gates.
- gate the TLS code in bb_mqtt (CA + cert/key), bb_sink_http (ca/cert/key), and
  bb_tls_creds (skip cert/key resolve under !MUTUAL). off-gate degrades to
  plaintext, no crash.
- bb_tls_info: PRE_HTTP companion registers /api/info capability flags
  mqtt_tls / http_tls / mutual_tls so clients can detect what's compiled in.
- mode-aware buffer defaults (B1-274): BB_PUB_WORKER_STACK gate-keyed
  (4096 plaintext / 8192 with a TLS gate); BB_HTTP_CLIENT_TASK_STACK_SIZE kept
  8192 (the GitHub update-check/OTA handshake needs it regardless).
- example per-mode sdkconfig fragments (sdkconfig/profiles/bb_tls_{plain,server,
  mutual}.conf) for the upstream esp-idf TLS/mqtt buffers, overridable.
- docs (B1-279): CLAUDE.md documents the gates, OTA-TLS independence, the
  MBEDTLS_HARDWARE_SHA=n miner requirement, and the buffer profiles.
- host build enables all three gates so the TLS paths stay compiled+tested;
  espidf production default is off. host: make check + make test green (2100).
- consumer opt-in (which boards enable which gate) + gated hardware behavior
  validate at the final TM revalidation gate.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

1665 of 1665 branches covered (100.0%)

Branch coverage included in aggregate %.

2775 of 2775 relevant lines covered (100.0%)

1111.84 hits per line