openmv-ota 1.0.0__tar.gz

openmv_ota-1.0.0/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2015-2026 OpenMV
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

openmv_ota-1.0.0/PKG-INFO

@@ -0,0 +1,126 @@
+Metadata-Version: 2.4
+Name: openmv-ota
+Version: 1.0.0
+Summary: Secure over-the-air update tooling for OpenMV cameras (ROMFS OTA, with room for firmware/bootloader OTA).
+Author-email: OpenMV <openmv@openmv.io>
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/openmv/openmv-ota
+Project-URL: Source, https://github.com/openmv/openmv-ota
+Project-URL: Issues, https://github.com/openmv/openmv-ota/issues
+Keywords: openmv,ota,romfs,firmware,update,ecdsa,embedded
+Classifier: Development Status :: 4 - Beta
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Software Development :: Embedded Systems
+Classifier: Topic :: Security :: Cryptography
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: cryptography>=42
+Requires-Dist: pyserial>=3.5
+Requires-Dist: mpremote>=1.20
+Requires-Dist: httpx>=0.27
+Provides-Extra: dev
+Requires-Dist: pytest>=7; extra == "dev"
+Requires-Dist: pytest-cov>=4; extra == "dev"
+Requires-Dist: pytest-xdist>=3; extra == "dev"
+Requires-Dist: ruff; extra == "dev"
+Requires-Dist: hypothesis>=6; extra == "dev"
+Provides-Extra: server
+Requires-Dist: fastapi>=0.110; extra == "server"
+Requires-Dist: uvicorn[standard]>=0.29; extra == "server"
+Requires-Dist: pydantic-settings>=2; extra == "server"
+Requires-Dist: python-multipart>=0.0.9; extra == "server"
+Provides-Extra: server-s3
+Requires-Dist: boto3>=1.34; extra == "server-s3"
+Provides-Extra: server-postgres
+Requires-Dist: psycopg[binary,pool]>=3.1; extra == "server-postgres"
+Provides-Extra: hsm
+Requires-Dist: python-pkcs11>=0.7; extra == "hsm"
+Provides-Extra: aws-kms
+Requires-Dist: boto3[crt]>=1.34; extra == "aws-kms"
+Provides-Extra: gcp-kms
+Requires-Dist: google-cloud-kms>=2; extra == "gcp-kms"
+Provides-Extra: azure-kms
+Requires-Dist: azure-keyvault-keys>=4; extra == "azure-kms"
+Requires-Dist: azure-identity>=1; extra == "azure-kms"
+Dynamic: license-file
+
+<p align="center">
+  <img src="docs/under-construction.svg" width="100%" alt="Under Construction — this project is a work in progress">
+</p>
+
+[![CI](https://github.com/openmv/openmv-ota/actions/workflows/ci.yml/badge.svg)](https://github.com/openmv/openmv-ota/actions/workflows/ci.yml)
+[![codecov](https://codecov.io/gh/openmv/openmv-ota/graph/badge.svg?token=KNAA28U57K)](https://codecov.io/gh/openmv/openmv-ota)
+[![GitHub license](https://img.shields.io/github/license/openmv/openmv-ota?label=license%20%E2%9A%96)](https://github.com/openmv/openmv-ota/blob/main/LICENSE)
+![GitHub release (latest SemVer)](https://img.shields.io/github/v/release/openmv/openmv-ota?sort=semver)
+[![GitHub forks](https://img.shields.io/github/forks/openmv/openmv-ota?color=green)](https://github.com/openmv/openmv-ota/network)
+[![GitHub stars](https://img.shields.io/github/stars/openmv/openmv-ota?color=yellow)](https://github.com/openmv/openmv-ota/stargazers)
+[![GitHub issues](https://img.shields.io/github/issues/openmv/openmv-ota?color=orange)](https://github.com/openmv/openmv-ota/issues)
+
+<img  width="480" src="https://raw.githubusercontent.com/openmv/openmv-media/master/logos/openmv-logo/logo.png">
+
+# OpenMV OTA
+
+Secure over-the-air updates for OpenMV cameras: build your application into a
+signed ROMFS image, publish it, and a camera downloads, verifies, and installs
+it — falling back to the last release that worked if anything goes wrong.
+
+What a camera downloads is **encrypted**, under a key minted with the project and
+baked into your own firmware, so a published release is ciphertext to the update
+server, to the store it sits in, and to anyone who gets hold of it.
+
+**Start with the [tutorial](https://github.com/openmv/openmv-ota/blob/main/docs/tutorial/00-introduction.md)** — the complete,
+navigable reference for every command and the update server's HTTP API, in the
+order you use them: install → project → build → flash → device runtime → update
+server. The command documentation lives there and only there, so it has one
+place to be right.
+
+Shipping in the EU? [The compliance mapping](https://github.com/openmv/openmv-ota/blob/main/docs/compliance/cra-red-alignment.md)
+lays out how this stack lines up with the Cyber Resilience Act and RED 3.3 —
+what's covered, and the [residual threats](https://github.com/openmv/openmv-ota/blob/main/docs/compliance/residual-threats.md)
+that aren't — and `project new --ota` scaffolds the fill-in templates
+(conformity checklist, EU DoC, disclosure policy, security.txt) into your
+project's `compliance/`. Found a vulnerability in this stack itself? See
+[the security policy](https://github.com/openmv/openmv-ota/blob/main/SECURITY.md).
+
+## Installation
+
+> Not yet published. Once the package lands on PyPI, all tools install together:
+
+```bash
+pip install openmv-ota
+```
+
+For development, install from a checkout:
+
+```bash
+pip install -e .
+```
+
+## Contributing to the project
+
+Contributions are most welcome. If you are interested in contributing to the project, start by creating a fork of the repository:
+
+* https://github.com/openmv/openmv-ota.git
+
+Clone the forked repository, and add a remote to the main openmv-ota repository:
+```bash
+git clone https://github.com/<username>/openmv-ota.git
+git -C openmv-ota remote add upstream https://github.com/openmv/openmv-ota.git
+```
+
+Now the repository is ready for pull requests. To send a pull request, create a new feature branch and push it to origin, and use Github to create the pull request from the forked repository to the upstream openmv/openmv-ota repository. For example:
+```bash
+git checkout -b <some_branch_name>
+<commit changes>
+git push origin -u <some_branch_name>
+```
+
+### Contribution guidelines
+Please follow the [best practices](https://developers.google.com/blockly/guides/modify/contribute/write_a_good_pr) when sending pull requests upstream. In general, the pull request should:
+* Fix one problem. Don't try to tackle multiple issues at once.
+* Split the changes into logical groups using git commits.
+* Pull request title should be less than 78 characters, and match this pattern:
+  * `<scope>:<1 space><description><.>`
+* Commit subject line should be less than 78 characters, and match this pattern:
+  * `<scope>:<1 space><description><.>`

openmv_ota-1.0.0/README.md

@@ -0,0 +1,79 @@
+<p align="center">
+  <img src="docs/under-construction.svg" width="100%" alt="Under Construction — this project is a work in progress">
+</p>
+
+[![CI](https://github.com/openmv/openmv-ota/actions/workflows/ci.yml/badge.svg)](https://github.com/openmv/openmv-ota/actions/workflows/ci.yml)
+[![codecov](https://codecov.io/gh/openmv/openmv-ota/graph/badge.svg?token=KNAA28U57K)](https://codecov.io/gh/openmv/openmv-ota)
+[![GitHub license](https://img.shields.io/github/license/openmv/openmv-ota?label=license%20%E2%9A%96)](https://github.com/openmv/openmv-ota/blob/main/LICENSE)
+![GitHub release (latest SemVer)](https://img.shields.io/github/v/release/openmv/openmv-ota?sort=semver)
+[![GitHub forks](https://img.shields.io/github/forks/openmv/openmv-ota?color=green)](https://github.com/openmv/openmv-ota/network)
+[![GitHub stars](https://img.shields.io/github/stars/openmv/openmv-ota?color=yellow)](https://github.com/openmv/openmv-ota/stargazers)
+[![GitHub issues](https://img.shields.io/github/issues/openmv/openmv-ota?color=orange)](https://github.com/openmv/openmv-ota/issues)
+
+<img  width="480" src="https://raw.githubusercontent.com/openmv/openmv-media/master/logos/openmv-logo/logo.png">
+
+# OpenMV OTA
+
+Secure over-the-air updates for OpenMV cameras: build your application into a
+signed ROMFS image, publish it, and a camera downloads, verifies, and installs
+it — falling back to the last release that worked if anything goes wrong.
+
+What a camera downloads is **encrypted**, under a key minted with the project and
+baked into your own firmware, so a published release is ciphertext to the update
+server, to the store it sits in, and to anyone who gets hold of it.
+
+**Start with the [tutorial](https://github.com/openmv/openmv-ota/blob/main/docs/tutorial/00-introduction.md)** — the complete,
+navigable reference for every command and the update server's HTTP API, in the
+order you use them: install → project → build → flash → device runtime → update
+server. The command documentation lives there and only there, so it has one
+place to be right.
+
+Shipping in the EU? [The compliance mapping](https://github.com/openmv/openmv-ota/blob/main/docs/compliance/cra-red-alignment.md)
+lays out how this stack lines up with the Cyber Resilience Act and RED 3.3 —
+what's covered, and the [residual threats](https://github.com/openmv/openmv-ota/blob/main/docs/compliance/residual-threats.md)
+that aren't — and `project new --ota` scaffolds the fill-in templates
+(conformity checklist, EU DoC, disclosure policy, security.txt) into your
+project's `compliance/`. Found a vulnerability in this stack itself? See
+[the security policy](https://github.com/openmv/openmv-ota/blob/main/SECURITY.md).
+
+## Installation
+
+> Not yet published. Once the package lands on PyPI, all tools install together:
+
+```bash
+pip install openmv-ota
+```
+
+For development, install from a checkout:
+
+```bash
+pip install -e .
+```
+
+## Contributing to the project
+
+Contributions are most welcome. If you are interested in contributing to the project, start by creating a fork of the repository:
+
+* https://github.com/openmv/openmv-ota.git
+
+Clone the forked repository, and add a remote to the main openmv-ota repository:
+```bash
+git clone https://github.com/<username>/openmv-ota.git
+git -C openmv-ota remote add upstream https://github.com/openmv/openmv-ota.git
+```
+
+Now the repository is ready for pull requests. To send a pull request, create a new feature branch and push it to origin, and use Github to create the pull request from the forked repository to the upstream openmv/openmv-ota repository. For example:
+```bash
+git checkout -b <some_branch_name>
+<commit changes>
+git push origin -u <some_branch_name>
+```
+
+### Contribution guidelines
+Please follow the [best practices](https://developers.google.com/blockly/guides/modify/contribute/write_a_good_pr) when sending pull requests upstream. In general, the pull request should:
+* Fix one problem. Don't try to tackle multiple issues at once.
+* Split the changes into logical groups using git commits.
+* Pull request title should be less than 78 characters, and match this pattern:
+  * `<scope>:<1 space><description><.>`
+* Commit subject line should be less than 78 characters, and match this pattern:
+  * `<scope>:<1 space><description><.>`

openmv_ota-1.0.0/pyproject.toml

@@ -0,0 +1,125 @@
+[build-system]
+requires = ["setuptools>=77", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "openmv-ota"
+version = "1.0.0"
+description = "Secure over-the-air update tooling for OpenMV cameras (ROMFS OTA, with room for firmware/bootloader OTA)."
+readme = "README.md"
+requires-python = ">=3.11"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [{ name = "OpenMV", email = "openmv@openmv.io" }]
+keywords = ["openmv", "ota", "romfs", "firmware", "update", "ecdsa", "embedded"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Programming Language :: Python :: 3",
+    "Topic :: Software Development :: Embedded Systems",
+    "Topic :: Security :: Cryptography",
+]
+
+# Runtime dependencies are added as each tool is built out (see the plan):
+#   server:   a web framework + object-storage adapters
+#   sbom/cve: cyclonedx, osv/nvd scanners
+dependencies = [
+    "cryptography>=42",  # ECDSA keygen + signing for OTA trailers
+    "pyserial>=3.5",     # serial-port discovery + 1200-baud touch-to-reset (Arduino)
+    "mpremote>=1.20",    # reset OpenMV-protocol cameras into the bootloader (machine.bootloader)
+    "httpx>=0.27",       # the `client` verbs (release publish, rollouts, ...) talk to the server
+]
+
+[project.optional-dependencies]
+dev = ["pytest>=7", "pytest-cov>=4", "pytest-xdist>=3", "ruff", "hypothesis>=6"]
+# The update server. (`httpx`, which the client verbs and FastAPI's test client both use, is a
+# base dependency: Getting started publishes with a plain `pip install openmv-ota`.)
+# Heavy/optional backends are separate extras, lazily imported only when that backend is
+# selected, so the base `server` install stays lean (local-disk + stdlib sqlite work out of it).
+server = ["fastapi>=0.110", "uvicorn[standard]>=0.29", "pydantic-settings>=2",
+          "python-multipart>=0.0.9"]
+server-s3 = ["boto3>=1.34"]
+server-postgres = ["psycopg[binary,pool]>=3.1"]
+# Signer backends: the key never lands on disk as a file. One PKCS#11 backend covers all hardware
+# tokens/HSMs; the three cloud KMS providers are separate extras.
+hsm = ["python-pkcs11>=0.7"]
+aws-kms = ["boto3[crt]>=1.34"]
+gcp-kms = ["google-cloud-kms>=2"]
+azure-kms = ["azure-keyvault-keys>=4", "azure-identity>=1"]
+
+[project.urls]
+Homepage = "https://github.com/openmv/openmv-ota"
+Source = "https://github.com/openmv/openmv-ota"
+Issues = "https://github.com/openmv/openmv-ota/issues"
+
+[project.scripts]
+openmv-ota = "openmv_ota.cli:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+# The on-device SDK ships as package data, bundled into the ROMFS at build time.
+"openmv_ota" = [
+    "data/*.json",
+    "data/*.pem",                # the hosted OpenMV Cloud trust anchors (certs/root.pem)
+    "data/firmware/**/*",
+    "data/flashloaders/**/*",    # prebuilt i.MX RT sdphost/blhost flashloaders
+    "data/n6_bootloader/*",      # static N6 CubeProgrammer FSBL/loader + FlashLayout.tsv
+    "build/device/*.c",          # the ECDSA verify C module dropped into modules/
+    "build/device/openmv_ota/data/*",  # the installer source, scaffolded into projects
+    "server/deploy/*",           # Dockerfile + compose stack for self-hosters
+    "server/docs_static/*",      # self-hosted /docs API reference (ReDoc bundle + logo)
+    "project/compliance_templates/*",  # CRA/RED templates, scaffolded into OTA projects
+]
+
+[tool.pytest.ini_options]
+pythonpath = ["src"]
+testpaths = ["tests"]
+addopts = "-n auto --dist worksteal --cov=openmv_ota --cov-report=term-missing --cov-fail-under=100 --import-mode=importlib"
+# Default norecursedirs excludes "build"; we have a tests/build/ dir to collect.
+norecursedirs = ["*.egg", ".*", "_darcs", "CVS", "dist", "node_modules", "venv", "{arch}"]
+
+[tool.coverage.run]
+source = ["openmv_ota"]
+
+[tool.coverage.report]
+show_missing = true
+exclude_also = [
+    "if __name__ == .__main__.:",
+    "raise NotImplementedError",
+]
+
+[tool.ruff]
+line-length = 100
+
+[tool.ruff.lint]
+# The rule set `ruff check .` is required to pass (CLAUDE.md; enforced in CI).
+# Pinned explicitly so a newer ruff's expanded defaults can't repaint the repo red.
+# S (bandit) and B (bugbear) are the security/bug-risk pass: a finding is fixed, or suppressed
+# on its line with the reason. Only the rules below are waived wholesale, each for its reason.
+select = ["E4", "E7", "E9", "F", "S", "B"]
+ignore = [
+    # every subprocess call passes an argv list; shell=True (S602/S604/S605) stays an error
+    "S603",
+]
+
+[tool.ruff.lint.flake8-bugbear]
+# FastAPI's dependency-injection idiom is a call in the default, evaluated once by design
+extend-immutable-calls = [
+    "fastapi.Depends", "fastapi.File", "fastapi.Query", "fastapi.Header",
+    "openmv_ota.server.auth.require_scope",
+]
+
+[tool.ruff.lint.per-file-ignores]
+# tests assert, use fixed fake secrets and throwaway paths by design
+"tests/**" = ["S"]
+# MicroPython has no zip(strict=) and no exception chaining (B904/B905); the survival
+# paths (logging, watchdog, RTC, spool replay) must never raise and cannot afford to log
+# the failure they are already handling (S110/S112)
+"src/openmv_ota/build/device/**" = ["B904", "B905", "S110", "S112"]
+# the bench harness drives tools found on the runner's PATH (mpremote, dfu-util, JLinkExe),
+# and tears it down best-effort; its only URL reads are its own localhost bench server
+"ci/**" = ["S607", "S110", "S310"]
+# every value is a bound parameter; the only interpolated text is a column or table name
+# from a code-side whitelist (_order, the constant table tuples, _updatable's allow-lists)
+"src/openmv_ota/server/metastore.py" = ["S608"]

openmv_ota-1.0.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

openmv_ota-1.0.0/src/openmv_ota/__init__.py

@@ -0,0 +1,10 @@
+"""openmv-ota — secure OTA update tooling for OpenMV cameras.
+
+Subsystems live under this package. The first is :mod:`openmv_ota.romfs`
+(ROMFS OTA). Whole-firmware and bootloader OTA are intended as future siblings.
+
+The authoritative design walkthrough is ``docs/tutorial/`` (the slot model lives
+on its boot-and-rollback and device-library pages).
+"""
+
+__version__ = "1.0.0"

openmv_ota-1.0.0/src/openmv_ota/build/__init__.py

@@ -0,0 +1,13 @@
+"""Firmware-aware artifact builders.
+
+`openmv-ota build romfs` compiles a project's app the way the pegged firmware
+expects (``.py`` -> ``.mpy`` with the pegged mpy-cross, NPU models via the pegged
+Vela / ST Edge AI) and packs a ROMFS image per target. It is OTA-agnostic: peg a
+project, build a romfs, flash it.
+"""
+
+from __future__ import annotations
+
+from .romfs import build_romfs
+
+__all__ = ["build_romfs"]