18:07 <re_irc> <@ryan-summers:matrix.org> newam: Re: security risks for public self-hosted runners - you can host the runner in a separate, private repo, and then forward CI results from that repo into the public one. Then, all CI runs have to be requested via an admin (e.g. approved to run) or automated via bors

18:07 <re_irc> <@ryan-summers:matrix.org> We do this for nightly CI of an stm32h7 application as well as hardware-in-the-loop CI for new PRs

18:08 <re_irc> <@ryan-summers:matrix.org> Can check out https://github.com/quartiq/stabilizer/actions/workflows/hitl_trigger.yml for an example

18:08 <re_irc> <@newam:matrix.org> It does slow things down when it isn't automatic though

18:08 <re_irc> <@ryan-summers:matrix.org> Not that much - there's not a ton of PRs, and you just have to have a `bors try` to get CI to run

18:08 <re_irc> <@ryan-summers:matrix.org> Or have it trigger nightly

18:09 <re_irc> <@ryan-summers:matrix.org> cortex-m _has_ had people hijack the CI process to mine bitcoin in the past, so just keep that in mind from a security perspective

18:11 <re_irc> <@dirbaio:matrix.org> as an alternative

18:11 <re_irc> <@dirbaio:matrix.org> github actions can give signed openid-connect tokens (JWTs) to jobs

18:12 <re_irc> <@dirbaio:matrix.org> from the JWT you can get the repo and branch

18:12 <re_irc> <@dirbaio:matrix.org> and I think the PR creator too (?)

18:12 <re_irc> <@dirbaio:matrix.org> and they can be trusted because they're signed

18:12 <re_irc> <@dirbaio:matrix.org> I was thinking of writing some server where you post an ELF and the JWT, and it runs it for you

18:13 <re_irc> <@dirbaio:matrix.org> so you can selfhost just that, and hit it from the GHA-hosted runners

18:14 <re_irc> <@dirbaio:matrix.org> since it can see the branch name, it can only allow runs from staging/trying branches, so it can be gated by a `bors try` or `bors r+`

18:14 <re_irc> <@dirbaio:matrix.org> or maybe if it can see the author username the server could have a list of trusted users

18:15 <re_irc> <@ryan-summers:matrix.org> How would that approach program the binary and then e.g. run support python scripting?

18:16 <re_irc> <@ryan-summers:matrix.org> E.g. to verify that the device is pingable, or can respond to network requests

18:16 <re_irc> <@dirbaio:matrix.org> it'd be some rust using some http server lib and probe-rs

18:16 <re_irc> <@dirbaio:matrix.org> but yeah you can't script stuff

18:16 <re_irc> <@dirbaio:matrix.org> it's the test firmware itself who would have to exit with pass/fail

18:16 <re_irc> <@ryan-summers:matrix.org> So more geared towards on-target unit tests etc. ,which def have value though

18:19 <re_irc> <@dirbaio:matrix.org> yeah...

18:19 <re_irc> <@ryan-summers:matrix.org> Granted, hard to do integration testing on a remote CI server unless you set up said server with your hardware

19:44 <re_irc> <@gauteh:matrix.org> I'm concating tail -f /dev/ttyUSB0 | defmt-print.. but it sometimes fails on startup and im not sure if it has any buffering. is there some obvious other way? i don't have a debugger

19:44 <re_irc> <@gauteh:matrix.org> missing timestamps etc in defmt-print, i guess probe-run has more features

19:46 <re_irc> <@dirbaio:matrix.org> defmt requires every single byte to go through uncorrupted

19:47 <re_irc> <@dirbaio:matrix.org> if you're losing or corrupting bytes it'll fail and never recover

19:47 <re_irc> <@dirbaio:matrix.org> like

19:47 <re_irc> <@gauteh:matrix.org> it works decently over uart, I probably commited some crimes

19:47 <re_irc> <@dirbaio:matrix.org> the very first byte the target sends has to be the very first byte that defmt-print receives

19:47 <re_irc> <@dirbaio:matrix.org> if you restart the target without restating defmt-print, it may get stuck on a "half written" defmt frame

19:47 <re_irc> <@dirbaio:matrix.org> or maybe it's uart flow control issues

19:48 <re_irc> <@dirbaio:matrix.org> hard to know

19:48 <re_irc> <@dirbaio:matrix.org> defmt 0.3 adds COBS framing, so it'll be able to recover from corruption

19:48 <re_irc> <@gauteh:matrix.org> ok

19:49 <re_irc> <@gauteh:matrix.org> seems to help that my target always gets reset when i read from serial

19:49 <re_irc> <@gauteh:matrix.org> so that's a feature

19:50 <re_irc> <@dirbaio:matrix.org> I'd recommend using defmt-rtt if you can, using hardware uarts is going to be a bit painful

19:50 <re_irc> <@gauteh:matrix.org> ok

19:51 <re_irc> <@dirbaio:matrix.org> maybe you can add your own framing to avoid corruption, but it's probably not worth the work

19:52 <re_irc> <@gauteh:matrix.org> don't know anything about RTT, do I need a debugger for that? or is something I am likely to be able to hook up to without any extra HW

19:53 <re_irc> <@dirbaio:matrix.org> yeah you need a debug probe

19:54 <re_irc> <@dirbaio:matrix.org> well worth getting one, you can use it to flash, view logs, debug, single-step, view crash stacktraces with various tools

19:55 <re_irc> <@dirbaio:matrix.org> you can get them quite cheap, stlink V2 clones are quite cheap and work OK, or you can get the hs-probe for a bit more money

19:56 <re_irc> <@gauteh:matrix.org> Ok. thanks. I see lots of chips have j-tag pin holes, but no socket. do i usually need to solder on a socket or is it sufficent to just stuff it in?

19:57 <re_irc> <@dirbaio:matrix.org> hm, most boards (especially if they're dev boards) have the socket

19:57 <re_irc> <@dirbaio:matrix.org> which chip/board are you using?

19:57 <re_irc> <@gauteh:matrix.org> https://www.sparkfun.com/products/15444

19:59 <re_irc> <@dirbaio:matrix.org> ambiq Apollo3 Blue MCU? huh

19:59 <re_irc> <@gauteh:matrix.org> yes, cortex-m based, https://github.com/gauteh/ambiq-rs

20:00 <re_irc> <@gauteh:matrix.org> i'm fast-forwarding a rust hal by cherry-picking from their C hal

20:00 <re_irc> <@gauteh:matrix.org> (then I can swap it out with native rust later)

20:01 <re_irc> <@dirbaio:matrix.org> yeah seems it doesn't have a swd socket

20:01 <re_irc> <@dirbaio:matrix.org> thanks sparkfun

20:01 <re_irc> <@gauteh:matrix.org> :(

20:01 <re_irc> <@dirbaio:matrix.org> it's probably the 2x5 footprint next to the module

20:02 <re_irc> <@gauteh:matrix.org> yeah, that's what I thought. so need to solder, not the end of the world, but..

20:02 <re_irc> <@gauteh:matrix.org> anyway, thanks for you help, got to run

20:03 <re_irc> <@dirbaio:matrix.org> and it's not in probe-rs either, not sure how hard it'd be to get it to work

20:03 <re_irc> <@gauteh:matrix.org> yeah.. insisting on writing the firmware in rust, re-implementing a hal, + adding support to probe-rs.. i'm never going to get to the actual code

20:03 <re_irc> <@yatekii:matrix.org> jwho needs an SWD socket. debugging is for noobs

20:04 <re_irc> <@dirbaio:matrix.org> yeah just run your program blind

20:04 <re_irc> <@dirbaio:matrix.org> stick it in there, pray it works :D

20:17 <re_irc> <@jannic:matrix.org> Next level: only one try. If it doesn't work, delete source code and start from scratch.

20:19 <re_irc> <@dirbaio:matrix.org> put a panic handler that bricks your chip. Had a panic? buy another devboard

20:33 <re_irc> <@yatekii:matrix.org> dirbaio:matrix.org: why run. send to the factory and ship, np

20:33 <re_irc> <@dirbaio:matrix.org> in a mask ROM in an ASIC 👌

20:34 <re_irc> <@yatekii:matrix.org> dirbaio:matrix.org: XD hey, a guy at ABB in the production told me he buys a new phone after a year when it's clogged with viruses/random apps ... he was like "wtf you can do that" when I told him he can just reinstall the OS etc lol

20:36 <re_irc> <@ryan-summers:matrix.org> I recently wrote a python script to hand-code a binary because we're debugging an issue where the startup voltage causes the CPU to periodically skip some instructions

20:37 <re_irc> <@ryan-summers:matrix.org> Would not recommend

20:37 <re_irc> <@yatekii:matrix.org> xd

20:41 <re_irc> <@dirbaio:matrix.org> wowwwwww that must've sucked

20:41 <re_irc> <@ryan-summers:matrix.org> *is currently still sucking

20:41 <re_irc> <@dirbaio:matrix.org> oh no :O