From 0c6d95eb3db10fa650b3443fbf22b545d12b7183 Mon Sep 17 00:00:00 2001 From: Christian Glombek Date: Sat, 1 Aug 2026 05:39:20 +0200 Subject: [PATCH 1/4] matter-netman: say in the package what the attestation is worth MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The daemon reports a real manufacturer and product name, read from the firmware, beside the Connectivity Standards Alliance test vendor id 0xFFF1. That pairing is the right one — the names are accurate and useful, and a community build cannot claim a vendor id it does not hold — but it leaves the package silent about what the device attestation actually establishes. Not much. The build attests with the SDK's development certificate for 0xFFF1/0x8013. The same certificate ships in every build of that example and its private key is published in the SDK source, so attestation cannot distinguish this router from anything else presenting the same credential, and succeeding at it says nothing about who built the device or what is running on it. Whether a controller notices depends on which roots it trusts: the chain ends at a development root that some trust stores carry and some do not. So the package says so itself, in terms of what is true of this device rather than what some other implementation might be expected to do about it. Assisted-By: Claude Opus 5 Signed-off-by: Christian Glombek --- service/matter-netman/Makefile | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/service/matter-netman/Makefile b/service/matter-netman/Makefile index e8af89c..45e99ea 100644 --- a/service/matter-netman/Makefile +++ b/service/matter-netman/Makefile @@ -56,6 +56,24 @@ endef define Package/matter-netman/default/description Matter Network Infrastructure Manager Daemon Integrates a router / access point with the Matter IoT ecosystem. + + This is an uncertified build. It identifies itself with the Connectivity + Standards Alliance test vendor id 0xFFF1 and product id 0x8013, and it + attests with the Matter SDK's development attestation certificate for that + pair. + + That certificate is shared, not unique to this device: the same one ships + in every build of the example, and its private key is published in the SDK + source. Device attestation therefore cannot distinguish this router from + any other node presenting the same credential, and successful attestation + says nothing about who built the device or what software is running on it. + The certificate also chains to a development root rather than a production + one, so whether a controller accepts it silently, warns, or refuses depends + on which roots that controller trusts. + + The manufacturer and product names reported in Basic Information are read + from the firmware and describe who built it. They are accurate, and they + are not backed by any Matter certification. endef define Package/matter-netman-mbedtls From ffc5622c1e728e9d4a301d1001faab4db4cdf27a Mon Sep 17 00:00:00 2001 From: Christian Glombek Date: Sat, 1 Aug 2026 17:43:15 +0200 Subject: [PATCH 2/4] matter-netman: state the mbedTLS and base-name facts in the package MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two things the package knew but did not say. CHIP's mbedTLS crypto backend calls AES-CCM, so the mbedtls variant does not link unless mbedtls is built with MBEDTLS_CCM_C. That option is `default n` in OpenWrt, and the requirement was recorded only as an English sentence in the package description, where the build system cannot act on it. .config.ci sets the option, so this repository's own builds were fine — but anyone building without that seed got an undefined reference to mbedtls_ccm_init rather than an unmet dependency they could see in menuconfig. Say it in DEPENDS instead. Neither variant declared PROVIDES, so the name matter-netman existed for nobody to depend on or install; the variants had to be named explicitly. Declare it in the shared block, the way miniupnpd, geoip-shell and mtr do. Assisted-By: Claude Opus 5 Signed-off-by: Christian Glombek --- service/matter-netman/Makefile | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/service/matter-netman/Makefile b/service/matter-netman/Makefile index 45e99ea..c17f7ea 100644 --- a/service/matter-netman/Makefile +++ b/service/matter-netman/Makefile @@ -50,6 +50,7 @@ define Package/matter-netman/default TITLE:=Matter Network Infrastructure Manager Daemon URL:=https://github.com/project-chip/connectedhomeip DEPENDS:=+libstdcpp +libatomic +libubus +libubox +jsonfilter + PROVIDES:=matter-netman USERID:=matter:matter endef @@ -79,7 +80,7 @@ endef define Package/matter-netman-mbedtls $(Package/matter-netman/default) TITLE+= (mbedtls) - DEPENDS+= +PACKAGE_matter-netman-mbedtls:libmbedtls + DEPENDS+= +PACKAGE_matter-netman-mbedtls:libmbedtls +@MBEDTLS_CCM_C VARIANT:=mbedtls DEFAULT_VARIANT:=1 endef @@ -87,8 +88,9 @@ endef define Package/matter-netman-mbedtls/description $(Package/matter-netman/default/description) -This variant of the package uses the mbedTLS crypto library, -which must have the MBEDTLS_CCM_C option enabled. +This variant of the package uses the mbedTLS crypto library. It turns on +that library's MBEDTLS_CCM_C option, which OpenWrt leaves off by default +and which the AES-CCM cipher of the Matter message layer requires. endef define Package/matter-netman-openssl From e9f6828829ef56fa47caa216a62034b9c31a67d6 Mon Sep 17 00:00:00 2001 From: Christian Glombek Date: Sun, 9 Aug 2026 08:24:45 +0200 Subject: [PATCH 3/4] matter-netman: update to the 2026-07-30 Matter SDK Moves the pin from the 13 June revision to 72ecdc2b of 30 July. PKG_RELEASE goes back to 1 with the new version. Both patches still apply at fuzz zero against the new revision, so neither needed refreshing. The mirror hash is the one this same revision already produces in CI on #53, where the source is fetched with the same URL, proto and submodule list, so the archive -- and therefore the hash -- is byte for byte the same. Assisted-By: Claude Opus 5 Signed-off-by: Christian Glombek --- service/matter-netman/Makefile | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/service/matter-netman/Makefile b/service/matter-netman/Makefile index c17f7ea..09239f2 100644 --- a/service/matter-netman/Makefile +++ b/service/matter-netman/Makefile @@ -15,7 +15,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=matter-netman -PKG_RELEASE:=2 +PKG_RELEASE:=1 PKG_SOURCE_URL:=https://github.com/project-chip/connectedhomeip.git PKG_SOURCE_PROTO:=git PKG_SOURCE_SUBMODULES:=\ @@ -25,9 +25,9 @@ PKG_SOURCE_SUBMODULES:=\ third_party/nlio/repo # Hash can be regenerated with make package/matter-netman/check FIXUP=1 -PKG_SOURCE_DATE:=2026-06-13 -PKG_SOURCE_VERSION:=b39eff6ed09e92344c3c6cc9a5a1b495a469bbfd -PKG_MIRROR_HASH:=cc87d6df5cc945309bea4c810ba90081fa59dfaaa1daedf9fa199d17e3f313f8 +PKG_SOURCE_DATE:=2026-07-30 +PKG_SOURCE_VERSION:=72ecdc2bca57e99b3defea68eb3bcc5bd8bebdbd +PKG_MIRROR_HASH:=6812910e012294a9b812bc7550e352e981627e8bec932d3634e098be68ebe7fb # Use local source dir for development # USE_SOURCE_DIR:=$(HOME)/workspace/connectedhomeip From 263c095bdda8234ea4fed3ab09bf9c3d1c089622 Mon Sep 17 00:00:00 2001 From: Karsten Sperling Date: Mon, 17 Aug 2026 11:20:15 +1200 Subject: [PATCH 4/4] Remove CONFIG_MBEDTLS_CCM_C from CI config now that it's set via DEPENDS --- .config.ci | 1 - 1 file changed, 1 deletion(-) diff --git a/.config.ci b/.config.ci index 346a7e9..e9593c0 100644 --- a/.config.ci +++ b/.config.ci @@ -2,7 +2,6 @@ CONFIG_ALL=n CONFIG_AUTOREMOVE=n CONFIG_AUTOREBUILD=n CONFIG_BUILD_LOG=y -CONFIG_MBEDTLS_CCM_C=y CONFIG_MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED=y CONFIG_OPENTHREADBR_SHARED_MBEDTLS=y CONFIG_PACKAGE_matter-netman-mbedtls=m