secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-30 00:19:30 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
3,235 Commits 380 Branches 117 Tags 280 MiB
master
Commit Graph

3 Commits

Author SHA1 Message Date
CyberMind-FR
d58460ebaf fix(round): modprobe dwc2 in secubox-otg-gadget chain (rpiz UDC was implicit on eye-gadget) 
The previous build had two gadget services enabled at boot:
  - secubox-eye-gadget.service: ExecStartPre=modprobe dwc2 + libcomposite
  - secubox-otg-gadget.service: ExecStartPre=modprobe libcomposite + usb_f_*
                                (NO dwc2 — relied on eye-gadget loading it first)

When PR #175 disabled secubox-eye-gadget at boot (to stop the UDC conflict),
nobody loaded dwc2 anymore. systemd-modules-load reads /etc/modules but the
order of dwc2 load vs the otg-gadget service start window was tight — and
on the rpiz the journal showed no successful gadget enumeration after the
PR #175 image deployed.

Defensive fix in two places:

1. secubox-otg-gadget.service: prepend ExecStartPre=/sbin/modprobe dwc2.
   Drop the ConditionPathIsDirectory=/sys/class/udc gate so the service
   actually runs and can load dwc2 if it isn't loaded yet (the path is a
   sysfs dir that exists when its parent /sys/class is mounted — it was
   harmless, but removing it makes the chain self-bootstrapping).

2. secubox-otg-gadget.sh check_prerequisites(): also modprobe dwc2 (in
   case the service is invoked manually by an operator), then poll
   /sys/class/udc for up to 5s waiting for the BCM USB controller to
   bind asynchronously. Diagnostic message updated to point at the two
   places to check (dtoverlay + /etc/modules) if no UDC ever shows up.
 2026-05-17 12:00:03 +02:00
CyberMind
355767935c
Round image: drop dead ifupdown config, give secubox sudo, fix misleading OTG comment (closes #139) (#143) 
* fix(round): remove dead ifupdown config + secubox sudo + clarify gadget IP comment (closes #139)

Three small cleanups against the round image, all triggered by the
follow-up to PR #137's OTG bench:

1. Drop `remote-ui/round/files/etc/network/interfaces.d/usb0` — the
   stanza configured `usb0` via `ifupdown`, but `ifupdown` is not in
   the apt list, `networking.service` is inactive, and the actual IP
   binding happens in `secubox-otg-gadget.sh` (which configures `usb1`
   programmatically with `ip addr add`). Keeping the file on disk
   misleads diagnostics — it cost a round trip during the 2026-05-15
   bench when I assumed `usb0`/10.55.0.2 must be where the IP would
   land. Deleting it.

2. Add `sudo` to the `secubox` user's group list in
   `build-eye-remote-image.sh`. Without it, ACM serial console
   recovery is impossible — the user can log in but can't fix
   anything. The round previously needed `pi/raspberry` (which the
   build script does not provision) as a fallback; now `secubox` can
   recover networking from the only path that survives a broken IP
   link.

3. Rewrite the misleading comment block in `secubox-otg-gadget.sh`
   about which kernel interface name belongs to which gadget function.
   The legacy comment claimed `usb1 = ECM` and tied the binding choice
   to "Linux uses cdc_ether"; in reality both RNDIS and ECM share the
   same host_addr so the host can reach 10.55.0.2 via either function
   (verified on Pop!_OS 22.04 host: ping succeeded with 10.55.0.1
   bound on the host's RNDIS leg). Comment now states the actual
   contract: bind on `usb1` (the second-registered network function),
   independent of which transport carries the packets.

Test plan
---------

- [ ] Rebuild the round image and flash to Pi Zero W 1st gen.
- [ ] Verify boot still reaches OFFLINE-mode radar on the HyperPixel.
- [ ] `id secubox` on the booted device shows `sudo` in groups.
- [ ] `ls /etc/network/interfaces.d/usb0` returns "no such file".
- [ ] `systemctl is-active secubox-otg-gadget` returns `active`.
- [ ] Host ping 10.55.0.2 succeeds (regression check — the comment
      rewrite is documentation-only, must not change behaviour).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(round): also drop inline heredoc that recreates dead ifupdown stanza (ref #139)

The previous commit deleted remote-ui/round/files/etc/network/interfaces.d/usb0
but missed that build-eye-remote-image.sh writes the same file inline at
build time via heredoc. Without removing that block too, the dead config
keeps shipping to the rootfs.

Verified on the just-rebuilt image: file still present after first
attempt at the fix. With both source-tree deletion AND the heredoc gone,
the config never lands.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: CyberMind-FR <gandalf@Gk2.net>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-15 13:26:32 +02:00
CyberMind
7c37415f88
feat(remote-ui): Phase 1 — extract common/ shared core (ref #127) 
* feat(remote-ui/common): scaffold shared-core directory (ref #127)

* feat(remote-ui/common): extract palette.css from round/ (ref #127)

* fix(remote-ui/common): trim palette.css to spec (6 module + 8 C3BOX tokens) (ref #127)

* feat(remote-ui/common): extract base.css verbatim from round/ (ref #127)

* feat(remote-ui/common): extract ICONS to icons.js (ref #127)

* docs(remote-ui/common): correct icons.js header comment — sizes are {22,48,96} not 128 (ref #127)

* feat(remote-ui/common): extract RINGS + CX/CY/SA to modules-table.js (ref #127)

* feat(remote-ui/common): extract CFG to config.js (replaces jwt-helper.js per #127 plan revision)

* feat(remote-ui/common): extract TransportManager with onModuleTap/onTransportChange hooks (ref #127)

* feat(remote-ui/common): extract SIM + simStep to sim.js (ref #127)

* feat(remote-ui/common): move 24 SecuBox module PNG icons to common/assets/icons/ (ref #127)

* feat(remote-ui/common): move secubox-otg-gadget.sh, add GADGET_NAME env override + arm64 serial fallback (ref #127)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(remote-ui/common): trim whitespace from device-tree serial-number read (ref #127)

* feat(remote-ui/common): move secubox-otg-host-up.sh + variant-aware comment (ref #127)

* refactor(remote-ui/round): consume common/ via <link>/<script> tags (ref #127)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat(secubox-system): add form_factor to RemoteUIConnectedRequest with TDD (ref #127)

* feat(remote-ui/round): deploy.sh bundles common/ alongside round/ (ref #127)

* fix(remote-ui/round): deploy.sh COMMON_SRC path resolution + rsync --delete (ref #127)

* feat(remote-ui/round): build-eye-remote-image.sh embeds common/ + nginx /common/ alias (ref #127)

* docs(remote-ui): document common/ dependency in round/ docs (ref #127)

* docs(remote-ui/round): clarify palette.css is forward-looking (ref #127)

* docs(remote-ui): Task 18 regression-gate report — structural verification (ref #127)

Full diffoscope gate blocked by missing hyperpixel2r.dtbo prerequisite.
Structural equivalence verified instead: Phase 1 changes are purely
additive (common/ embed + nginx /common/ alias + extracted JS/CSS/icons),
no behavioural change to round/'s existing logic.

User must run the full image diffoscope manually after sourcing the
hyperpixel2r.dtbo blob, before final merge.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* ci(eye-remote): bump workflow VERSION env 2.2.0 → 2.2.1 (ref #127)

Pre-existing drift: build-eye-remote-image.sh writes
secubox-eye-remote-2.2.1.img but the workflow's Compress/Checksum/
Upload steps reference ${{ env.VERSION }} = 2.2.0, so the compress
step fails with "No such file or directory" after a successful build.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: CyberMind-FR <gandalf@Gk2.net>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-14 05:59:40 +02:00