julien/typewriter
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(firmware): bake and document git push env vars

Browse Source 
build.rs embeds TW_REMOTE_URL / TW_GH_USER / TW_PAT / TW_AUTHOR_* via env!()
so only the git_push binary carries them (the editor references none), and
.env.example documents them. NOTE: TW_PAT lands in the git_push flash image
-- a bench-only shortcut (ADR-005); a product must not embed the PAT.
This commit is contained in:
Julien Calixte
2026-07-06 00:18:22 +02:00
parent 8d80168bda
commit 63ffd7e37a
2 changed files with 25 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
firmware/.env.example
View File

@@ -13,5 +13,13 @@ TW_WIFI_PASS=your-password
# Note: the spike assumes WPA2-Personal. Open network → leave TW_WIFI_PASS empty.
# A WPA3-only AP needs AuthMethod::WPA3Personal in src/bin/wifi_tls.rs.
# Spike 7 (gitoxide push) will add: TW_REMOTE_URL, TW_GH_USER, TW_PAT,
# TW_AUTHOR_NAME, TW_AUTHOR_EMAIL.
# Spike 7 — on-device git push (`just flash-git-push`, src/bin/git_push.rs).
# HTTPS + PAT auth (ADR-005); baked into the git_push image at build time and
# never logged. Point TW_REMOTE_URL at a THROWAWAY test repo — the spike pushes
# a fresh `device/<unix>` branch on every boot.
TW_REMOTE_URL=https://github.com/you/typoena-test.git
TW_GH_USER=your-github-username
TW_PAT=ghp_xxxxxxxxxxxxxxxxxxxx
# Commit author (message is a timestamp).
TW_AUTHOR_NAME=Typoena
TW_AUTHOR_EMAIL=typoena@example.com

16
firmware/build.rs
View File

@@ -27,7 +27,21 @@ fn main() {
// them in with env!(). Empty when unset: the network spike checks at
// runtime and prints a clear message, so the *editor* build never has to
// carry Wi-Fi creds. Source them from firmware/.env (loaded by `just`).
for var in ["TW_WIFI_SSID", "TW_WIFI_PASS"] {
//
// The TW_REMOTE_URL / TW_GH_USER / TW_PAT / TW_AUTHOR_* vars back Spike 7's
// on-device push (src/bin/git_push.rs). env!() embeds a value only in a
// binary that references it, so the editor binary carries none of these.
// NOTE: TW_PAT ends up in the git_push image — fine for the bench spike, but
// a product must not bake the PAT into flash (ADR-005).
for var in [
"TW_WIFI_SSID",
"TW_WIFI_PASS",
"TW_REMOTE_URL",
"TW_GH_USER",
"TW_PAT",
"TW_AUTHOR_NAME",
"TW_AUTHOR_EMAIL",
] {
let val = std::env::var(var).unwrap_or_default();
println!("cargo:rustc-env={var}={val}");
println!("cargo:rerun-if-env-changed={var}");