From 25044bd26915dfade03ddf2a043c4665724d038e Mon Sep 17 00:00:00 2001 From: JC-000 <3798556+JC-000@users.noreply.github.com> Date: Wed, 14 Oct 2026 20:31:05 -0500 Subject: [PATCH 01/11] m3 demo README: name the PRG the figures were measured with; upstream #952 The "Measured with THIS image" sentence was carried over to PRG 916d4162 (#294 moved the image 20 B) although the 2026-10-13 run used 24a81766. It is now said only when the built PRG's sha256 equals MEASURED_PRG_SHA; otherwise the README names the measured PRG and commit, and says from git whether src/net/uci-m3/ changed since. Also: the upstream reference defaults to GideonZ/1541ultimate#952 (a plain make package-m3-demo is reproducible without UPSTREAM_PRS), the README says no demo image has run on that PR's firmware yet, and "same client source" becomes "same M3 adapter". Co-Authored-By: Claude Opus 5.5 (1M context) --- tools/package/build_m3_demo.sh | 43 +++++++++++++++++++++++++++++----- 1 file changed, 37 insertions(+), 6 deletions(-) diff --git a/tools/package/build_m3_demo.sh b/tools/package/build_m3_demo.sh index 1ad22d1..d0d61a9 100755 --- a/tools/package/build_m3_demo.sh +++ b/tools/package/build_m3_demo.sh @@ -50,10 +50,20 @@ MAKE_ARGS=(BACKEND=uci-m3 "HTTPS_HOST=$DEMO_HOST" "HTTPS_PATH=$DEMO_PATH") # What the firmware side published; quoted in the README, checked nowhere # here (the device is not involved in a build). # The requirement is the interface; the build named is only where it was -# validated. The upstream PR numbers are not known yet; the README carries a -# marked slot for them (UPSTREAM_PRS overrides it once they exist). +# validated. UPSTREAM_PRS overrides the upstream reference. FIRMWARE="M3-SPEC v1 + errata v1.1/v1.2 firmware (validated on esp-tls/m3-master 3a1ff9ff: fw 3.15, FPGA 126, ESP 1.309)" -UPSTREAM_PRS="${UPSTREAM_PRS:-[TO BE FILLED IN: 1541ultimate upstream PR number(s)]}" +UPSTREAM_PRS="${UPSTREAM_PRS:-TLS client sockets for the U64: GideonZ/1541ultimate#952, which links the issue and draft PR}" +# Not yet true of any image: change it once a demo PRG has run on that PR's +# firmware build. +UPSTREAM_RUN="No demo image has been run on the upstream PR's firmware build yet." + +# The image the "Measured" figures below were taken with, and its commit. +# The README says THIS image only when the PRG just built is that one; +# otherwise it names the measured PRG and says this one was not run, so a +# rebuild after an unrelated change cannot inherit the claim. Update both, +# with the figures, after each demo-rig run. +MEASURED_PRG_SHA="24a81766e05a9e333d14ba7c4d87e9309b90079799f9192a05d47f5c149e4e93" +MEASURED_COMMIT="71b047e6449c42eb80f3a2bb7d1b2477d1666ac2" SPEC="M3-SPEC v1 (= r7.7), sha256 c265fdfcfdd08dee989a96eee25fae66fb6650ee4be8bb24f8dd791d9ee3db9f, with errata v1.1 (f9a39ff334b34cb0e1a63d5d508675de552ac8eacb23ccd6095a7f4c72788f9a) and v1.2 (a6802f40db3229d53591ef6e0773641d723186e779dd8726abff5915cbe551a4)" die() { echo "[m3-demo] ERROR: $*" >&2; exit 1; } @@ -125,6 +135,25 @@ prg_sha="$(sha "$OUT/$NAME.prg")" d64_sha="$(sha "$OUT/$NAME.d64")" prg_bytes="$(wc -c < "$OUT/$NAME.prg" | tr -d ' ')" +if [ "$prg_sha" = "$MEASURED_PRG_SHA" ]; then + measured_with="Measured with THIS image (PRG sha256 above)" +else + # Whether the M3 adapter itself moved since the measured commit, from + # git rather than from prose; "unknown" if that commit is not here. + if ! git cat-file -e "$MEASURED_COMMIT^{commit}" 2>/dev/null; then + adapter="whether src/net/uci-m3/ changed since is unknown here" + elif git diff --quiet "$MEASURED_COMMIT" HEAD -- src/net/uci-m3; then + adapter="src/net/uci-m3/ is unchanged since" + else + adapter="src/net/uci-m3/ HAS changed since" + fi + measured_with="NOT measured with this image. Measured with PRG sha256 + $MEASURED_PRG_SHA +built from commit $MEASURED_COMMIT +($adapter)" + echo "[m3-demo] NOTE: this PRG is not the measured one; the README says so" +fi + cat > "$OUT/README.txt" <.nip.io name for a site whose certificate does not name it.) -Measured with THIS image (PRG sha256 above), validated on an Ultimate 64 +$measured_with, validated on an Ultimate 64 Elite (U64E), firmware 3.15 git 3a1ff9ff, 48 MHz, REU disabled, the .d64 mounted on drive 8 and loaded with LOAD"*",8,1 (tools/uci/rig_https_m3_demo.py), 2026-10-13: From 902ce8dcb051f2a958820ec1e3de2c04306b1e73 Mon Sep 17 00:00:00 2001 From: JC-000 <3798556+JC-000@users.noreply.github.com> Date: Wed, 14 Oct 2026 20:37:40 -0500 Subject: [PATCH 02/11] m3 demo README: upstream status as it is (#952 is the issue, no PR yet); measured-image provenance adv-296 on #300: #952 is the proposal issue and links no draft PR, no upstream PR implements $21/$23/$25 yet (#953 is GET_RANDOM only), and esp-tls/m3-master is not public. The default upstream status now says so, UPSTREAM_PRS still overrides it, and UPSTREAM_RUN no longer presupposes an upstream build. The NOT-measured branch says the measured PRG is reproducible from 71b047e (the merge of #296) and was built from 9eabd50 on 2026-10-13, and that with the adapter unchanged the PRG differs only by changes outside it. Co-Authored-By: Claude Opus 5.5 (1M context) --- tools/package/build_m3_demo.sh | 29 ++++++++++++++++++++--------- 1 file changed, 20 insertions(+), 9 deletions(-) diff --git a/tools/package/build_m3_demo.sh b/tools/package/build_m3_demo.sh index d0d61a9..7fbb09b 100755 --- a/tools/package/build_m3_demo.sh +++ b/tools/package/build_m3_demo.sh @@ -50,20 +50,29 @@ MAKE_ARGS=(BACKEND=uci-m3 "HTTPS_HOST=$DEMO_HOST" "HTTPS_PATH=$DEMO_PATH") # What the firmware side published; quoted in the README, checked nowhere # here (the device is not involved in a build). # The requirement is the interface; the build named is only where it was -# validated. UPSTREAM_PRS overrides the upstream reference. -FIRMWARE="M3-SPEC v1 + errata v1.1/v1.2 firmware (validated on esp-tls/m3-master 3a1ff9ff: fw 3.15, FPGA 126, ESP 1.309)" -UPSTREAM_PRS="${UPSTREAM_PRS:-TLS client sockets for the U64: GideonZ/1541ultimate#952, which links the issue and draft PR}" -# Not yet true of any image: change it once a demo PRG has run on that PR's -# firmware build. -UPSTREAM_RUN="No demo image has been run on the upstream PR's firmware build yet." +# validated. UPSTREAM_PRS overrides the upstream status (one line is fine); +# set it, or change the default, once an upstream PR implements $21-$25. +FIRMWARE="M3-SPEC v1 + errata v1.1/v1.2 firmware (validated on esp-tls/m3-master 3a1ff9ff, a development branch that is not public: fw 3.15, FPGA 126, ESP 1.309)" +UPSTREAM_PRS="${UPSTREAM_PRS:-The firmware this demo needs is not yet public or upstream. + GideonZ/1541ultimate#952 is the proposal issue; this demo follows its + proposed command numbering (\$21 OPEN_TLS, \$23 TLS_INFO, \$25 + TLS_RELEASE). No upstream PR implements these commands yet (#953 is + GET_RANDOM only).}" +# Change it once a demo PRG has run on another firmware build. +UPSTREAM_RUN="No demo image has been run on any firmware but the build named above." # The image the "Measured" figures below were taken with, and its commit. # The README says THIS image only when the PRG just built is that one; # otherwise it names the measured PRG and says this one was not run, so a # rebuild after an unrelated change cannot inherit the claim. Update both, # with the figures, after each demo-rig run. +# MEASURED_COMMIT is a commit on master that reproduces that PRG (the +# adapter diff below runs from it); MEASURED_BUILT is where the measured +# image itself was built. MEASURED_PRG_SHA="24a81766e05a9e333d14ba7c4d87e9309b90079799f9192a05d47f5c149e4e93" MEASURED_COMMIT="71b047e6449c42eb80f3a2bb7d1b2477d1666ac2" +MEASURED_COMMIT_NOTE="the merge of #296" +MEASURED_BUILT="9eabd50 on 2026-10-13" SPEC="M3-SPEC v1 (= r7.7), sha256 c265fdfcfdd08dee989a96eee25fae66fb6650ee4be8bb24f8dd791d9ee3db9f, with errata v1.1 (f9a39ff334b34cb0e1a63d5d508675de552ac8eacb23ccd6095a7f4c72788f9a) and v1.2 (a6802f40db3229d53591ef6e0773641d723186e779dd8726abff5915cbe551a4)" die() { echo "[m3-demo] ERROR: $*" >&2; exit 1; } @@ -143,13 +152,15 @@ else if ! git cat-file -e "$MEASURED_COMMIT^{commit}" 2>/dev/null; then adapter="whether src/net/uci-m3/ changed since is unknown here" elif git diff --quiet "$MEASURED_COMMIT" HEAD -- src/net/uci-m3; then - adapter="src/net/uci-m3/ is unchanged since" + adapter="src/net/uci-m3/ is unchanged since; this PRG differs only by +changes outside the adapter" else adapter="src/net/uci-m3/ HAS changed since" fi measured_with="NOT measured with this image. Measured with PRG sha256 $MEASURED_PRG_SHA -built from commit $MEASURED_COMMIT +reproducible from commit $MEASURED_COMMIT +($MEASURED_COMMIT_NOTE); the measured image was built from $MEASURED_BUILT ($adapter)" echo "[m3-demo] NOTE: this PRG is not the measured one; the README says so" fi @@ -188,7 +199,7 @@ What it needs ------------- - An Ultimate 64 (Elite) running firmware with the M3 TLS sockets: $FIRMWARE. - 1541ultimate upstream: + Upstream status: $UPSTREAM_PRS $UPSTREAM_RUN - Its WiFi module up (the ESP32 does the TLS), the network connected, and From 19094e67859e0c6d2ccf9ae80eb502633fdf38d4 Mon Sep 17 00:00:00 2001 From: JC-000 <3798556+JC-000@users.noreply.github.com> Date: Wed, 14 Oct 2026 20:39:11 -0500 Subject: [PATCH 03/11] m3 demo README: firmware source and image sha as their own constants The window image is built from pr/3-tls-r1 f3df8261, which may later be pushed to a public branch with the image attached. FIRMWARE_SOURCE ("not yet public, and not upstream" for now) and FIRMWARE_IMAGE_SHA (its line printed only when set) let one later commit swap in the URL and sha without touching the upstream-status text. Co-Authored-By: Claude Opus 5.5 (1M context) --- tools/package/build_m3_demo.sh | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/tools/package/build_m3_demo.sh b/tools/package/build_m3_demo.sh index 7fbb09b..c188975 100755 --- a/tools/package/build_m3_demo.sh +++ b/tools/package/build_m3_demo.sh @@ -50,11 +50,18 @@ MAKE_ARGS=(BACKEND=uci-m3 "HTTPS_HOST=$DEMO_HOST" "HTTPS_PATH=$DEMO_PATH") # What the firmware side published; quoted in the README, checked nowhere # here (the device is not involved in a build). # The requirement is the interface; the build named is only where it was -# validated. UPSTREAM_PRS overrides the upstream status (one line is fine); -# set it, or change the default, once an upstream PR implements $21-$25. +# validated. FIRMWARE="M3-SPEC v1 + errata v1.1/v1.2 firmware (validated on esp-tls/m3-master 3a1ff9ff, a development branch that is not public: fw 3.15, FPGA 126, ESP 1.309)" -UPSTREAM_PRS="${UPSTREAM_PRS:-The firmware this demo needs is not yet public or upstream. - GideonZ/1541ultimate#952 is the proposal issue; this demo follows its +# Where the firmware this demo needs can be had. Replace both once it is +# published: FIRMWARE_SOURCE with the public branch URL and commit, +# FIRMWARE_IMAGE_SHA with the sha256 of the attached image (its line is +# printed only when set). Plain constants, not env knobs, so the README +# stays a function of the commit. +FIRMWARE_SOURCE="not yet public, and not upstream" +FIRMWARE_IMAGE_SHA="" +# UPSTREAM_PRS overrides the upstream status (one line is fine); set it, or +# change the default, once an upstream PR implements $21-$25. +UPSTREAM_PRS="${UPSTREAM_PRS:-GideonZ/1541ultimate#952 is the proposal issue; this demo follows its proposed command numbering (\$21 OPEN_TLS, \$23 TLS_INFO, \$25 TLS_RELEASE). No upstream PR implements these commands yet (#953 is GET_RANDOM only).}" @@ -199,7 +206,9 @@ What it needs ------------- - An Ultimate 64 (Elite) running firmware with the M3 TLS sockets: $FIRMWARE. - Upstream status: + Firmware source: $FIRMWARE_SOURCE +${FIRMWARE_IMAGE_SHA:+ Firmware image sha256: $FIRMWARE_IMAGE_SHA +} Upstream status: $UPSTREAM_PRS $UPSTREAM_RUN - Its WiFi module up (the ESP32 does the TLS), the network connected, and From 13ded5f82239f550f8e13400f333282e71a7096a Mon Sep 17 00:00:00 2001 From: JC-000 <3798556+JC-000@users.noreply.github.com> Date: Wed, 14 Oct 2026 20:44:33 -0500 Subject: [PATCH 04/11] m3 demo README: public source branch, earlier runs scoped, adapter gate over its include closure adv-296 round 2 on #300: - The source for $20-$25 IS public: JC-000/1541ultimate esp32-tls-offload (tip 72f33796, network_target.h defines $20-$25, the 90-94 lines are in network_target.cc), linked from GideonZ/1541ultimate#952. FIRMWARE_SOURCE says so, that the demo has not run on a build of it, and the upstream status says not upstream (GideonZ/1541ultimate#953 is GET_RANDOM only). - 'No demo image has been run on any firmware but the build named above' was false: the script's own history validated earlier images on esp-tls/m3 f2e46946. The line is now per-image (none recorded for a non-measured PRG) plus EARLIER_RUNS. - The adapter gate diffed src/net/uci-m3 only, so a change to src/net/uci/uci_regs.inc (uci_fence) moved the PRG and the README still said 'unchanged'. It now diffs every file in build/net/uci-m3/*.d plus cfg/c64-https-uci-m3.cfg, and names the files that changed. - JC-000/c64-https#296, not #296. Co-Authored-By: Claude Opus 5.5 (1M context) --- tools/package/build_m3_demo.sh | 62 +++++++++++++++++++++++----------- 1 file changed, 42 insertions(+), 20 deletions(-) diff --git a/tools/package/build_m3_demo.sh b/tools/package/build_m3_demo.sh index c188975..b517af8 100755 --- a/tools/package/build_m3_demo.sh +++ b/tools/package/build_m3_demo.sh @@ -52,21 +52,24 @@ MAKE_ARGS=(BACKEND=uci-m3 "HTTPS_HOST=$DEMO_HOST" "HTTPS_PATH=$DEMO_PATH") # The requirement is the interface; the build named is only where it was # validated. FIRMWARE="M3-SPEC v1 + errata v1.1/v1.2 firmware (validated on esp-tls/m3-master 3a1ff9ff, a development branch that is not public: fw 3.15, FPGA 126, ESP 1.309)" -# Where the firmware this demo needs can be had. Replace both once it is -# published: FIRMWARE_SOURCE with the public branch URL and commit, -# FIRMWARE_IMAGE_SHA with the sha256 of the attached image (its line is -# printed only when set). Plain constants, not env knobs, so the README -# stays a function of the commit. -FIRMWARE_SOURCE="not yet public, and not upstream" +# Where source for the firmware this demo needs is public, and (once a +# built image is published) that image's sha256; its line is printed only +# when set. Plain constants, not env knobs, so the README stays a function +# of the commit: a later commit swaps in a newer branch or image. +FIRMWARE_SOURCE="public, not upstream: JC-000/1541ultimate branch + esp32-tls-offload (tip 72f33796 on 2026-10-14), linked from + GideonZ/1541ultimate#952. This demo has NOT been run on a build of + that branch." FIRMWARE_IMAGE_SHA="" # UPSTREAM_PRS overrides the upstream status (one line is fine); set it, or # change the default, once an upstream PR implements $21-$25. -UPSTREAM_PRS="${UPSTREAM_PRS:-GideonZ/1541ultimate#952 is the proposal issue; this demo follows its - proposed command numbering (\$21 OPEN_TLS, \$23 TLS_INFO, \$25 - TLS_RELEASE). No upstream PR implements these commands yet (#953 is - GET_RANDOM only).}" -# Change it once a demo PRG has run on another firmware build. -UPSTREAM_RUN="No demo image has been run on any firmware but the build named above." +UPSTREAM_PRS="${UPSTREAM_PRS:-not upstream yet. GideonZ/1541ultimate#952 is the proposal issue; + this demo follows its proposed command numbering (\$21 OPEN_TLS, + \$23 TLS_INFO, \$25 TLS_RELEASE). No upstream PR implements these + commands yet (GideonZ/1541ultimate#953 adds GET_RANDOM only).}" +# Earlier demo images (this script's history, JC-000/c64-https 82a549a to +# b54fcb6) were validated on these builds; neither is public. +EARLIER_RUNS="esp-tls/m3 f2e46946 and esp-tls/m3-master 3a1ff9ff" # The image the "Measured" figures below were taken with, and its commit. # The README says THIS image only when the PRG just built is that one; @@ -78,7 +81,7 @@ UPSTREAM_RUN="No demo image has been run on any firmware but the build named abo # image itself was built. MEASURED_PRG_SHA="24a81766e05a9e333d14ba7c4d87e9309b90079799f9192a05d47f5c149e4e93" MEASURED_COMMIT="71b047e6449c42eb80f3a2bb7d1b2477d1666ac2" -MEASURED_COMMIT_NOTE="the merge of #296" +MEASURED_COMMIT_NOTE="the merge of JC-000/c64-https#296" MEASURED_BUILT="9eabd50 on 2026-10-13" SPEC="M3-SPEC v1 (= r7.7), sha256 c265fdfcfdd08dee989a96eee25fae66fb6650ee4be8bb24f8dd791d9ee3db9f, with errata v1.1 (f9a39ff334b34cb0e1a63d5d508675de552ac8eacb23ccd6095a7f4c72788f9a) and v1.2 (a6802f40db3229d53591ef6e0773641d723186e779dd8726abff5915cbe551a4)" @@ -151,24 +154,42 @@ prg_sha="$(sha "$OUT/$NAME.prg")" d64_sha="$(sha "$OUT/$NAME.d64")" prg_bytes="$(wc -c < "$OUT/$NAME.prg" | tr -d ' ')" +# The M3 adapter's sources: every file ca65 read for the objects in +# build/net/uci-m3/ (their .d files: the .s files and every .include, such +# as src/net/uci/uci_regs.inc), plus the backend's cfg. Derived from this +# build, not listed by hand. +shopt -s nullglob +adapter_deps=(build/net/uci-m3/*.d) +shopt -u nullglob +[ "${#adapter_deps[@]}" -gt 0 ] || die "no build/net/uci-m3/*.d: cannot list the adapter's sources" +adapter_files=() +while IFS= read -r f; do adapter_files+=("$f"); done < <( + { sed -n 's/^build\/[^:]*:[[:space:]]*//p' "${adapter_deps[@]}" | tr ' \t' '\n\n' + echo cfg/c64-https-uci-m3.cfg; } | grep -v -e '^$' -e '^build/' | sort -u) + if [ "$prg_sha" = "$MEASURED_PRG_SHA" ]; then measured_with="Measured with THIS image (PRG sha256 above)" + this_run="The run recorded for this image is the one under \"Measured\" below." else - # Whether the M3 adapter itself moved since the measured commit, from + # Whether the adapter's sources moved since the measured commit, from # git rather than from prose; "unknown" if that commit is not here. if ! git cat-file -e "$MEASURED_COMMIT^{commit}" 2>/dev/null; then - adapter="whether src/net/uci-m3/ changed since is unknown here" - elif git diff --quiet "$MEASURED_COMMIT" HEAD -- src/net/uci-m3; then - adapter="src/net/uci-m3/ is unchanged since; this PRG differs only by -changes outside the adapter" + adapter="whether the M3 adapter's sources changed since is unknown here" else - adapter="src/net/uci-m3/ HAS changed since" + changed="$(git diff --name-only "$MEASURED_COMMIT" HEAD -- "${adapter_files[@]}" | tr '\n' ' ')" + if [ -z "$changed" ]; then + adapter="the M3 adapter's ${#adapter_files[@]} source files (src/net/uci-m3/, what its +objects include, and its cfg) are unchanged since" + else + adapter="changed since in the M3 adapter's sources: ${changed% }" + fi fi measured_with="NOT measured with this image. Measured with PRG sha256 $MEASURED_PRG_SHA reproducible from commit $MEASURED_COMMIT ($MEASURED_COMMIT_NOTE); the measured image was built from $MEASURED_BUILT ($adapter)" + this_run="This image has no recorded run on any firmware." echo "[m3-demo] NOTE: this PRG is not the measured one; the README says so" fi @@ -210,7 +231,8 @@ What it needs ${FIRMWARE_IMAGE_SHA:+ Firmware image sha256: $FIRMWARE_IMAGE_SHA } Upstream status: $UPSTREAM_PRS - $UPSTREAM_RUN + $this_run Earlier demo images were + validated on the non-public builds $EARLIER_RUNS. - Its WiFi module up (the ESP32 does the TLS), the network connected, and the clock set by SNTP (certificate dates are checked). - The Ultimate's Command Interface enabled. From dbc872b5ab1813b9fabf3ecff89ee37b94660e10 Mon Sep 17 00:00:00 2001 From: JC-000 <3798556+JC-000@users.noreply.github.com> Date: Wed, 14 Oct 2026 20:45:04 -0500 Subject: [PATCH 05/11] m3 demo README: wrap the two new long lines Co-Authored-By: Claude Opus 5.5 (1M context) --- tools/package/build_m3_demo.sh | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/tools/package/build_m3_demo.sh b/tools/package/build_m3_demo.sh index b517af8..db9170a 100755 --- a/tools/package/build_m3_demo.sh +++ b/tools/package/build_m3_demo.sh @@ -187,7 +187,8 @@ objects include, and its cfg) are unchanged since" measured_with="NOT measured with this image. Measured with PRG sha256 $MEASURED_PRG_SHA reproducible from commit $MEASURED_COMMIT -($MEASURED_COMMIT_NOTE); the measured image was built from $MEASURED_BUILT +($MEASURED_COMMIT_NOTE); +the measured image was built from $MEASURED_BUILT ($adapter)" this_run="This image has no recorded run on any firmware." echo "[m3-demo] NOTE: this PRG is not the measured one; the README says so" @@ -231,8 +232,9 @@ What it needs ${FIRMWARE_IMAGE_SHA:+ Firmware image sha256: $FIRMWARE_IMAGE_SHA } Upstream status: $UPSTREAM_PRS - $this_run Earlier demo images were - validated on the non-public builds $EARLIER_RUNS. + $this_run + Earlier demo images were validated on the non-public builds + $EARLIER_RUNS. - Its WiFi module up (the ESP32 does the TLS), the network connected, and the clock set by SNTP (certificate dates are checked). - The Ultimate's Command Interface enabled. From 955b726451ad92e1ad26b8db63a13e0cc19b1e6f Mon Sep 17 00:00:00 2001 From: JC-000 <3798556+JC-000@users.noreply.github.com> Date: Wed, 14 Oct 2026 20:46:58 -0500 Subject: [PATCH 06/11] m3 demo README: firmware source is the public pr/3-tls-r1 branch; UPSTREAM_PRS a constant - FIRMWARE_SOURCE points at JC-000/1541ultimate pr/3-tls-r1 (f3df8261), the branch that will be proposed (not the older esp32-tls-offload): not upstream, proposed on GideonZ/1541ultimate#952, and this demo image has not been run on a build of it. The prerelease link and image sha are for the post-window commit. - UPSTREAM_PRS loses its env override (adv-296 finding 5): it replaced the whole upstream paragraph without a trace, so the README was not a function of the commit. Co-Authored-By: Claude Opus 5.5 (1M context) --- tools/package/build_m3_demo.sh | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/tools/package/build_m3_demo.sh b/tools/package/build_m3_demo.sh index db9170a..1d43957 100755 --- a/tools/package/build_m3_demo.sh +++ b/tools/package/build_m3_demo.sh @@ -52,21 +52,22 @@ MAKE_ARGS=(BACKEND=uci-m3 "HTTPS_HOST=$DEMO_HOST" "HTTPS_PATH=$DEMO_PATH") # The requirement is the interface; the build named is only where it was # validated. FIRMWARE="M3-SPEC v1 + errata v1.1/v1.2 firmware (validated on esp-tls/m3-master 3a1ff9ff, a development branch that is not public: fw 3.15, FPGA 126, ESP 1.309)" -# Where source for the firmware this demo needs is public, and (once a -# built image is published) that image's sha256; its line is printed only -# when set. Plain constants, not env knobs, so the README stays a function -# of the commit: a later commit swaps in a newer branch or image. -FIRMWARE_SOURCE="public, not upstream: JC-000/1541ultimate branch - esp32-tls-offload (tip 72f33796 on 2026-10-14), linked from - GideonZ/1541ultimate#952. This demo has NOT been run on a build of - that branch." +# Where the firmware this demo needs comes from, and (once a prebuilt +# image is published) that image's sha256; its line is printed only when +# set. These and UPSTREAM_PRS are plain constants, not env knobs, so the +# README is a function of the commit: a later commit swaps them. After a +# demo-rig run on a build of this branch, that commit also sets +# FIRMWARE_IMAGE_SHA and links the fork prerelease tls-preview-f3df8261, +# with the new figures. +FIRMWARE_SOURCE="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/JC-000/1541ultimate/tree/pr/3-tls-r1 + (f3df8261). Not upstream; proposed on GideonZ/1541ultimate#952. + This demo image has NOT been run on a build of it." FIRMWARE_IMAGE_SHA="" -# UPSTREAM_PRS overrides the upstream status (one line is fine); set it, or -# change the default, once an upstream PR implements $21-$25. -UPSTREAM_PRS="${UPSTREAM_PRS:-not upstream yet. GideonZ/1541ultimate#952 is the proposal issue; +# Change it once an upstream PR implements $21-$25. +UPSTREAM_PRS="not upstream yet. GideonZ/1541ultimate#952 is the proposal issue; this demo follows its proposed command numbering (\$21 OPEN_TLS, \$23 TLS_INFO, \$25 TLS_RELEASE). No upstream PR implements these - commands yet (GideonZ/1541ultimate#953 adds GET_RANDOM only).}" + commands yet (GideonZ/1541ultimate#953 adds GET_RANDOM only)." # Earlier demo images (this script's history, JC-000/c64-https 82a549a to # b54fcb6) were validated on these builds; neither is public. EARLIER_RUNS="esp-tls/m3 f2e46946 and esp-tls/m3-master 3a1ff9ff" From c79aac5906888c4c9f4dcdb4f7fd38b2e9213f00 Mon Sep 17 00:00:00 2001 From: JC-000 <3798556+JC-000@users.noreply.github.com> Date: Wed, 14 Oct 2026 20:52:21 -0500 Subject: [PATCH 07/11] m3 demo README: adapter gate covers all of src/net/uci-m3/; one changed file per line adv-296 on #300 at 955b726: - src/net/uci-m3/m3_https_get.inc and net_tuning.inc are included from boot.s/exports.s, not from the adapter's objects, so the .d closure missed them: an edit there left the README saying 'unchanged'. The pathspec is now src/net/uci-m3/ (git ls-files, and the directory as a pathspec for deletions) + the .d closure + the cfg. - The changed-files list is one file per line (it ran past 80 columns). - FIRMWARE_SOURCE: 'the series it implements is proposed on GideonZ/1541ultimate#952' (#952 does not name pr/3-tls-r1). Co-Authored-By: Claude Opus 5.5 (1M context) --- tools/package/build_m3_demo.sh | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/tools/package/build_m3_demo.sh b/tools/package/build_m3_demo.sh index 1d43957..3725336 100755 --- a/tools/package/build_m3_demo.sh +++ b/tools/package/build_m3_demo.sh @@ -60,7 +60,8 @@ FIRMWARE="M3-SPEC v1 + errata v1.1/v1.2 firmware (validated on esp-tls/m3-master # FIRMWARE_IMAGE_SHA and links the fork prerelease tls-preview-f3df8261, # with the new figures. FIRMWARE_SOURCE="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/JC-000/1541ultimate/tree/pr/3-tls-r1 - (f3df8261). Not upstream; proposed on GideonZ/1541ultimate#952. + (f3df8261). Not upstream; the series it implements is proposed on + GideonZ/1541ultimate#952. This demo image has NOT been run on a build of it." FIRMWARE_IMAGE_SHA="" # Change it once an upstream PR implements $21-$25. @@ -155,18 +156,23 @@ prg_sha="$(sha "$OUT/$NAME.prg")" d64_sha="$(sha "$OUT/$NAME.d64")" prg_bytes="$(wc -c < "$OUT/$NAME.prg" | tr -d ' ')" -# The M3 adapter's sources: every file ca65 read for the objects in +# The M3 adapter's sources: everything under src/net/uci-m3/ (some of it, +# m3_https_get.inc and net_tuning.inc, is included from boot.s/exports.s, +# not from the adapter's objects), every file ca65 read for the objects in # build/net/uci-m3/ (their .d files: the .s files and every .include, such -# as src/net/uci/uci_regs.inc), plus the backend's cfg. Derived from this -# build, not listed by hand. +# as src/net/uci/uci_regs.inc), and the backend's cfg. Derived from git and +# this build, not listed by hand. The directory itself is also a pathspec, +# so a file deleted from it since the measured commit counts too. shopt -s nullglob adapter_deps=(build/net/uci-m3/*.d) shopt -u nullglob [ "${#adapter_deps[@]}" -gt 0 ] || die "no build/net/uci-m3/*.d: cannot list the adapter's sources" adapter_files=() while IFS= read -r f; do adapter_files+=("$f"); done < <( - { sed -n 's/^build\/[^:]*:[[:space:]]*//p' "${adapter_deps[@]}" | tr ' \t' '\n\n' + { git ls-files -- src/net/uci-m3 + sed -n 's/^build\/[^:]*:[[:space:]]*//p' "${adapter_deps[@]}" | tr ' \t' '\n\n' echo cfg/c64-https-uci-m3.cfg; } | grep -v -e '^$' -e '^build/' | sort -u) +[ "${#adapter_files[@]}" -gt 1 ] || die "cannot list the adapter's sources" if [ "$prg_sha" = "$MEASURED_PRG_SHA" ]; then measured_with="Measured with THIS image (PRG sha256 above)" @@ -177,12 +183,14 @@ else if ! git cat-file -e "$MEASURED_COMMIT^{commit}" 2>/dev/null; then adapter="whether the M3 adapter's sources changed since is unknown here" else - changed="$(git diff --name-only "$MEASURED_COMMIT" HEAD -- "${adapter_files[@]}" | tr '\n' ' ')" + changed="$(git diff --name-only "$MEASURED_COMMIT" HEAD -- src/net/uci-m3 "${adapter_files[@]}" \ + | sort -u | sed 's/^/ /')" if [ -z "$changed" ]; then adapter="the M3 adapter's ${#adapter_files[@]} source files (src/net/uci-m3/, what its objects include, and its cfg) are unchanged since" else - adapter="changed since in the M3 adapter's sources: ${changed% }" + adapter="changed since in the M3 adapter's sources: +$changed" fi fi measured_with="NOT measured with this image. Measured with PRG sha256 From 2cb2d51d1f856d70e81ec667b0604d6342cc0821 Mon Sep 17 00:00:00 2001 From: JC-000 <3798556+JC-000@users.noreply.github.com> Date: Thu, 15 Oct 2026 06:41:47 -0500 Subject: [PATCH 08/11] m3 demo README: post-window figures on pr/3-tls-r1 f3df8261 (ESP 1.8) The 2026-10-15 window ran this demo image, PRG 916d4162 (built from daaef33), on the U64E with firmware image update_tls_f3df8261.u64 (sha256 15e9ff7c..., git f3df8261, ESP module 1.8), REU disabled, 48 MHz: wiki 759,171 B == Content-Length in 20 s, github robots.txt 16,739 B in 5 s, the nip.io name mismatch refused with 94, badssl.com (TLS 1.2 only) refused with 14/40 and the no-TLS-1.3 hint. - MEASURED_* now name that PRG and daaef33, so a build of this commit says 'Measured with THIS image'. - FIRMWARE is the firmware side's agreed one-liner; the source branch, the prerelease and the image sha256 follow it. - badssl.com joins the URLs to try, as the TLS 1.2 negative. The prerelease tls-preview-f3df8261 is not published yet. Co-Authored-By: Claude Opus 5.5 (1M context) --- tools/package/build_m3_demo.sh | 73 +++++++++++++++++++--------------- 1 file changed, 41 insertions(+), 32 deletions(-) diff --git a/tools/package/build_m3_demo.sh b/tools/package/build_m3_demo.sh index 3725336..a7bf66e 100755 --- a/tools/package/build_m3_demo.sh +++ b/tools/package/build_m3_demo.sh @@ -49,28 +49,27 @@ MAKE_ARGS=(BACKEND=uci-m3 "HTTPS_HOST=$DEMO_HOST" "HTTPS_PATH=$DEMO_PATH") # What the firmware side published; quoted in the README, checked nowhere # here (the device is not involved in a build). -# The requirement is the interface; the build named is only where it was -# validated. -FIRMWARE="M3-SPEC v1 + errata v1.1/v1.2 firmware (validated on esp-tls/m3-master 3a1ff9ff, a development branch that is not public: fw 3.15, FPGA 126, ESP 1.309)" -# Where the firmware this demo needs comes from, and (once a prebuilt -# image is published) that image's sha256; its line is printed only when -# set. These and UPSTREAM_PRS are plain constants, not env knobs, so the -# README is a function of the commit: a later commit swaps them. After a -# demo-rig run on a build of this branch, that commit also sets -# FIRMWARE_IMAGE_SHA and links the fork prerelease tls-preview-f3df8261, -# with the new figures. -FIRMWARE_SOURCE="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/JC-000/1541ultimate/tree/pr/3-tls-r1 - (f3df8261). Not upstream; the series it implements is proposed on - GideonZ/1541ultimate#952. - This demo image has NOT been run on a build of it." -FIRMWARE_IMAGE_SHA="" +# FIRMWARE is the firmware side's own one-line description (agreed with +# them); the source branch, the prebuilt image and its sha256 follow. The +# image line is printed only when FIRMWARE_IMAGE_SHA is set. These and +# UPSTREAM_PRS are plain constants, not env knobs, so the README is a +# function of the commit: a later commit swaps them. +FIRMWARE="TLS client sockets for the Ultimate 64 / U64 Elite, from + JC-000/1541ultimate branch pr/3-tls-r1 (f3df8261), prebuilt image in + prerelease tls-preview-f3df8261. Not upstream; proposed on + GideonZ/1541ultimate#952." +FIRMWARE_SOURCE="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/JC-000/1541ultimate/tree/pr/3-tls-r1" +FIRMWARE_PRERELEASE="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/JC-000/1541ultimate/releases/tag/tls-preview-f3df8261" +FIRMWARE_IMAGE_SHA="15e9ff7cd8a11daf1f4698d574480381d475db7754e1d276d9aa95e8013ded3c" +# The build the "Measured" figures were taken on (the image above). +MEASURED_FW="firmware 3.15 git f3df8261 (the image above, ESP module 1.8)" # Change it once an upstream PR implements $21-$25. UPSTREAM_PRS="not upstream yet. GideonZ/1541ultimate#952 is the proposal issue; this demo follows its proposed command numbering (\$21 OPEN_TLS, \$23 TLS_INFO, \$25 TLS_RELEASE). No upstream PR implements these commands yet (GideonZ/1541ultimate#953 adds GET_RANDOM only)." # Earlier demo images (this script's history, JC-000/c64-https 82a549a to -# b54fcb6) were validated on these builds; neither is public. +# 9eabd50) were validated on these builds; neither is public. EARLIER_RUNS="esp-tls/m3 f2e46946 and esp-tls/m3-master 3a1ff9ff" # The image the "Measured" figures below were taken with, and its commit. @@ -81,10 +80,10 @@ EARLIER_RUNS="esp-tls/m3 f2e46946 and esp-tls/m3-master 3a1ff9ff" # MEASURED_COMMIT is a commit on master that reproduces that PRG (the # adapter diff below runs from it); MEASURED_BUILT is where the measured # image itself was built. -MEASURED_PRG_SHA="24a81766e05a9e333d14ba7c4d87e9309b90079799f9192a05d47f5c149e4e93" -MEASURED_COMMIT="71b047e6449c42eb80f3a2bb7d1b2477d1666ac2" -MEASURED_COMMIT_NOTE="the merge of JC-000/c64-https#296" -MEASURED_BUILT="9eabd50 on 2026-10-13" +MEASURED_PRG_SHA="916d41628a17b9436bbf58a71f7350c721a06e459cf5c33e5baeb1ad61af9a24" +MEASURED_COMMIT="daaef3354ec443b0feb09dfa2900795f9fa265ce" +MEASURED_COMMIT_NOTE="the merge of JC-000/c64-https#299" +MEASURED_BUILT="daaef33 on 2026-10-14" SPEC="M3-SPEC v1 (= r7.7), sha256 c265fdfcfdd08dee989a96eee25fae66fb6650ee4be8bb24f8dd791d9ee3db9f, with errata v1.1 (f9a39ff334b34cb0e1a63d5d508675de552ac8eacb23ccd6095a7f4c72788f9a) and v1.2 (a6802f40db3229d53591ef6e0773641d723186e779dd8726abff5915cbe551a4)" die() { echo "[m3-demo] ERROR: $*" >&2; exit 1; } @@ -235,10 +234,11 @@ $toolchain What it needs ------------- - - An Ultimate 64 (Elite) running firmware with the M3 TLS sockets: - $FIRMWARE. - Firmware source: $FIRMWARE_SOURCE -${FIRMWARE_IMAGE_SHA:+ Firmware image sha256: $FIRMWARE_IMAGE_SHA + - An Ultimate 64 (Elite) running firmware with the M3 TLS sockets. + Firmware: $FIRMWARE + Source: $FIRMWARE_SOURCE + Prebuilt: $FIRMWARE_PRERELEASE +${FIRMWARE_IMAGE_SHA:+ Image sha256: $FIRMWARE_IMAGE_SHA } Upstream status: $UPSTREAM_PRS $this_run @@ -267,8 +267,8 @@ How to run it A body cut short of its own framing prints BODY INCOMPLETE and the firmware's status line before CONNECTION CLOSED. -Three URLs to try ------------------ +Four URLs to try +---------------- 1. $DEMO_HOST $DEMO_PATH (the default) 2. github.com /robots.txt 3. 208-80-153-224.nip.io / (a NEGATIVE: a Wikipedia address @@ -278,16 +278,25 @@ Three URLs to try and 208.80.153.224 still serving Wikipedia. If either changes, pick another .nip.io name for a site whose certificate does not name it.) + 4. badssl.com / (a NEGATIVE: a server without + TLS 1.3. Expected: TLS HANDSHAKE FAILED / 14,TLS ALERT RECEIVED: 40 / + THE SERVER DOES NOT DO TLS 1.3. It depends on badssl.com staying + TLS 1.2 only.) $measured_with, validated on an Ultimate 64 -Elite (U64E), firmware 3.15 git 3a1ff9ff, 48 MHz, REU disabled, the .d64 -mounted on drive 8 and loaded with LOAD"*",8,1 -(tools/uci/rig_https_m3_demo.py), 2026-10-13: - 1. HTTP 200, 751,823 B consumed == Content-Length, 18 s from G to +Elite (U64E), $MEASURED_FW, +48 MHz, REU disabled, 2026-10-15. URLs 1-3: the .d64 mounted on drive 8 +and loaded with LOAD"*",8,1 (tools/uci/rig_https_m3_demo.py): + 1. HTTP 200, 759,171 B consumed == Content-Length, 20 s from G to CONNECTION CLOSED (the page size changes as the article is edited). - 2. HTTP 200, 16,739 B consumed == Content-Length, 4 s. + 2. HTTP 200, 16,739 B consumed == Content-Length, 5 s. 3. Refused: 94,CERTIFICATE NAME MISMATCH: 0x00000004. - Other Ultimate models, and other clock speeds, have not been tested. +URL 4: the same PRG written into memory over the Ultimate's REST interface +instead of loaded from the disk (tools/uci/rig_https_m3.py refuse): + 4. Refused: 14,TLS ALERT RECEIVED: 40, then THE SERVER DOES NOT DO + TLS 1.3. + Other Ultimate models, and other clock speeds, have not been tested + with this image. What an unsupported device shows -------------------------------- From 566c4bc1db3c1fddf61a3a05f8575a119982feef Mon Sep 17 00:00:00 2001 From: JC-000 <3798556+JC-000@users.noreply.github.com> Date: Thu, 15 Oct 2026 06:45:29 -0500 Subject: [PATCH 09/11] m3 demo README: 1 MHz figure from the 2026-10-15 window, 48 MHz figure attributed adv-296 at 2cb2d51: the 16 s at 1 MHz came from the 2026-10-13 run on 3a1ff9ff. It is now the window's figure, body 17.5 s after a 5.8 s handshake (sink build 146647e4, firmware f3df8261), and the 6 s at 48 MHz names the build it was measured on (3a1ff9ff, 2026-10-13). The trace build's 6.55 s is not used. Co-Authored-By: Claude Opus 5.5 (1M context) --- tools/package/build_m3_demo.sh | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/tools/package/build_m3_demo.sh b/tools/package/build_m3_demo.sh index a7bf66e..b7e7cfd 100755 --- a/tools/package/build_m3_demo.sh +++ b/tools/package/build_m3_demo.sh @@ -248,9 +248,11 @@ ${FIRMWARE_IMAGE_SHA:+ Image sha256: $FIRMWARE_IMAGE_SHA the clock set by SNTP (certificate dates are checked). - The Ultimate's Command Interface enabled. - No REU. Turbo is optional. The same M3 adapter, in its REU-sink - build, fetched en.wikipedia.org /robots.txt (28,275 B) in 16 s from G - at 1 MHz (turbo off) and in 6 s at 48 MHz (U64E, 2026-10-13); large - pages were not timed at 1 MHz. + build, fetched en.wikipedia.org /robots.txt (28,275 B) on the U64E: + body in 17.5 s at 1 MHz (turbo off), after a 5.8 s handshake (sink + build 146647e4, firmware f3df8261, 2026-10-15); and in 6 s at 48 MHz + (esp-tls/m3-master 3a1ff9ff, 2026-10-13). Large pages were not timed + at 1 MHz. Interface implemented: $SPEC. How to run it From 937718b8feab2e606ca0de00143d4c9f6d9f0343 Mon Sep 17 00:00:00 2001 From: JC-000 <3798556+JC-000@users.noreply.github.com> Date: Thu, 15 Oct 2026 06:45:42 -0500 Subject: [PATCH 10/11] m3 demo README: firmware URLs and image sha256 on their own lines (<= 80 columns) Co-Authored-By: Claude Opus 5.5 (1M context) --- tools/package/build_m3_demo.sh | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/tools/package/build_m3_demo.sh b/tools/package/build_m3_demo.sh index b7e7cfd..998fcdf 100755 --- a/tools/package/build_m3_demo.sh +++ b/tools/package/build_m3_demo.sh @@ -236,9 +236,12 @@ What it needs ------------- - An Ultimate 64 (Elite) running firmware with the M3 TLS sockets. Firmware: $FIRMWARE - Source: $FIRMWARE_SOURCE - Prebuilt: $FIRMWARE_PRERELEASE -${FIRMWARE_IMAGE_SHA:+ Image sha256: $FIRMWARE_IMAGE_SHA + Source: + $FIRMWARE_SOURCE + Prebuilt image: + $FIRMWARE_PRERELEASE +${FIRMWARE_IMAGE_SHA:+ Image sha256: + $FIRMWARE_IMAGE_SHA } Upstream status: $UPSTREAM_PRS $this_run From 6d6e75004346933bc9c7f8824aaccfa8f540b44b Mon Sep 17 00:00:00 2001 From: JC-000 <3798556+JC-000@users.noreply.github.com> Date: Thu, 15 Oct 2026 06:47:23 -0500 Subject: [PATCH 11/11] m3 demo README: the 1 MHz figure is from G (the handshake is inside it) adv-296 at 937718b: rig_https_m3.py times t_body and t_handshake from the same t0 at G, so 17.5 s is G to the whole body with the handshake done at 5.8 s, not body after handshake. Co-Authored-By: Claude Opus 5.5 (1M context) --- tools/package/build_m3_demo.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tools/package/build_m3_demo.sh b/tools/package/build_m3_demo.sh index 998fcdf..8889767 100755 --- a/tools/package/build_m3_demo.sh +++ b/tools/package/build_m3_demo.sh @@ -252,10 +252,10 @@ ${FIRMWARE_IMAGE_SHA:+ Image sha256: - The Ultimate's Command Interface enabled. - No REU. Turbo is optional. The same M3 adapter, in its REU-sink build, fetched en.wikipedia.org /robots.txt (28,275 B) on the U64E: - body in 17.5 s at 1 MHz (turbo off), after a 5.8 s handshake (sink - build 146647e4, firmware f3df8261, 2026-10-15); and in 6 s at 48 MHz - (esp-tls/m3-master 3a1ff9ff, 2026-10-13). Large pages were not timed - at 1 MHz. + 17.5 s from G to the whole body at 1 MHz (turbo off), handshake done + at 5.8 s (sink build 146647e4, firmware f3df8261, 2026-10-15); and 6 s + from G at 48 MHz (esp-tls/m3-master 3a1ff9ff, 2026-10-13). Large pages + were not timed at 1 MHz. Interface implemented: $SPEC. How to run it