matter-netman: update the SDK pin, declare PROVIDES and the mbedTLS requirement - #58
Merged
ksperling-apple merged 4 commits intoAug 18, 2026
Conversation
ksperling-apple
added
the
sdk-maintainer-approved
ksperling-apple
approved these changes
Aug 17, 2026
|
Tick the box to add this pull request to the merge queue (same as
|
Contributor
|
@LorbusChris can you please rebase with commit signing enabled? |
The daemon reports a real manufacturer and product name, read from the firmware, beside the Connectivity Standards Alliance test vendor id 0xFFF1. That pairing is the right one — the names are accurate and useful, and a community build cannot claim a vendor id it does not hold — but it leaves the package silent about what the device attestation actually establishes. Not much. The build attests with the SDK's development certificate for 0xFFF1/0x8013. The same certificate ships in every build of that example and its private key is published in the SDK source, so attestation cannot distinguish this router from anything else presenting the same credential, and succeeding at it says nothing about who built the device or what is running on it. Whether a controller notices depends on which roots it trusts: the chain ends at a development root that some trust stores carry and some do not. So the package says so itself, in terms of what is true of this device rather than what some other implementation might be expected to do about it. Assisted-By: Claude Opus 5 Signed-off-by: Christian Glombek <c.glombek@cosa.systems>
Two things the package knew but did not say. CHIP's mbedTLS crypto backend calls AES-CCM, so the mbedtls variant does not link unless mbedtls is built with MBEDTLS_CCM_C. That option is `default n` in OpenWrt, and the requirement was recorded only as an English sentence in the package description, where the build system cannot act on it. .config.ci sets the option, so this repository's own builds were fine — but anyone building without that seed got an undefined reference to mbedtls_ccm_init rather than an unmet dependency they could see in menuconfig. Say it in DEPENDS instead. Neither variant declared PROVIDES, so the name matter-netman existed for nobody to depend on or install; the variants had to be named explicitly. Declare it in the shared block, the way miniupnpd, geoip-shell and mtr do. Assisted-By: Claude Opus 5 Signed-off-by: Christian Glombek <c.glombek@cosa.systems>
Moves the pin from the 13 June revision to 72ecdc2b of 30 July. PKG_RELEASE goes back to 1 with the new version. Both patches still apply at fuzz zero against the new revision, so neither needed refreshing. The mirror hash is the one this same revision already produces in CI on project-chip#53, where the source is fetched with the same URL, proto and submodule list, so the archive -- and therefore the hash -- is byte for byte the same. Assisted-By: Claude Opus 5 Signed-off-by: Christian Glombek <c.glombek@cosa.systems>
LorbusChris
force-pushed
the
matter-netman-package-metadata
branch
from
August 17, 2026 18:46
12c2b40 to
263c095
Compare
Contributor
Author
|
Rebased and with GPG signatures |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Split out of #53 as suggested — self-contained.
PROVIDES:=matter-netman. Neither variant declared it, so the name existed for nothing to depend on or install. Declared in the shared block, the wayminiupnpd,geoip-shellandmtrdo in openwrt/packages.+@MBEDTLS_CCM_Cin the mbedtls variant's DEPENDS. CHIP's mbedTLS backend needs AES-CCM, which isdefault nin OpenWrt; the requirement lived only as a sentence in the package description..config.cisets the option, so this repo's own builds were fine, but a build without that seed got an undefined reference tombedtls_ccm_init.+@selects the symbol; a plain@would hide the variant from menuconfig instead.The description now says what the device attestation is worth: the SDK's development certificate for the CSA test ids 0xFFF1/0x8013, whose private key is published in the SDK source — so attestation cannot distinguish this router from anything else presenting it.
SDK pin moved to 72ecdc2b (30 July),
PKG_RELEASEback to 1. Both existing patches apply at fuzz zero, so neither needed refreshing; this is the version block #53 already carries, so it sheds the hunk when this lands. Both variants build from a clean tree in the repo's CI image.