alex/esp-idf
alex/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2024-09-20 00:36:01 -04:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity
Espressif IoT Development Framework. Official development framework for Espressif SoCs. https://docs.espressif.com/projects/esp-idf/en/stable/esp32/index.html
33,779 Commits 19 Branches 147 Tags 377 MiB
C 95.6%
Python 2.1%
C++ 1.2%
CMake 0.7%
Assembly 0.3%
647c485a76
Go to file
Frantisek Hrbata 647c485a76 feat(docker): allow to add paths into git's safe.directory 
With 8959555cee7e[1] ("setup_git_directory(): add an owner check for the top..")
git added an ownership check of the git directory and refuses to
run any git commands, even parsing the config file, if the git directory
is not owned by the current user. The "fatal: detected dubious ownership in repository"
is reported.

This fixes CVE-2022-24765[2], which allows to compromise user account. On a
multi-user system or e.g. on a shared file system, one user may create a "rogue"
git repository with e.g. core.fsmonitor set to an arbitrary command. Other user
may unwillingly execute this command by running e.g. git-diff or
git-status within the "rogue" git repository, which may be in one of the parent
directories. If e.g. PS1 is set to display information about a git
repository in CWD, as suggested in Git in Bash[3], the user do not need to run
any git command to trigger this, just entering some subdirectory under
this "rogue" git repository is enough, because the git command will be
started transparently through the script used in PS1. The core.fsmonitor
can be set to arbitrary command. It's purpose is to help git to identify changed files
and speed up the scanning for changed files.

rogue
├── .git     # owned by user1
└── dir1     # owned by user2
    ├── dir2 # owned by user2
    └── .git # owned by user2

user1 sets core.fsmonitor for git repository in rogue directory
$ git config --add core.fsmonitor "bash -c 'rm -rf \$HOME'"

user2 enters dir1 and runs e.g. git diff and triggers the core.fsmonitor command.

The ownership check may cause problems when running git commands in
ESP-IDF Docker container. For example user may run the container as
root, but the mounted project may be owned by a particular user.

In this case git will refuse to execute any git command within the
"/project" directory, because it's not owned by root. To overcome this,
git allows to set safe.directories, for which the ownership check is
skipped. The security check may be completely disabled by setting
safe.directories to "*". This solution was proposed in PR 12636[4], but
it would allow make it possible to exploit this vulnerability again.

This fix allows user to specify git's safe.directory in IDF_GIT_SAFE_DIR
environmental variable, which may be set during container startup.

The IDF_GIT_SAFE_DIR has same format as PATH and multiple directories can be
specified by using a ":" separator. To entirely disable this git security check
within the container, user may set IDF_GIT_SAFE_DIR='*'. This might be
heplfull in CI.

Closes https://github.com/espressif/esp-idf/pull/12636

[1] - 8959555cee
[2] - https://nvd.nist.gov/vuln/detail/cve-2022-24765
[3] - https://git-scm.com/book/en/v2/Appendix-A%3A-Git-in-Other-Environments-Git-in-Bash
[4] - https://github.com/espressif/esp-idf/pull/12636

Signed-off-by: Frantisek Hrbata <frantisek.hrbata@espressif.com>
2023-11-30 12:18:40 +01:00
.github fix(ci): Use latest stable actions/checkout@v3 instead of v2 for GitHub Actions 2023-10-30 13:43:10 +05:30
.gitlab Merge branch 'test/improve_sdmmc_tests' into 'master' 2023-11-30 10:21:11 +08:00
components Merge branch 'fix/lwip_na_packets_router_flag' into 'master' 2023-11-30 17:48:42 +08:00
docs feat(docker): allow to add paths into git's safe.directory 2023-11-30 12:18:40 +01:00
examples Merge branch 'feature/p4_lp_core' into 'master' 2023-11-30 09:35:49 +08:00
tools feat(docker): allow to add paths into git's safe.directory 2023-11-30 12:18:40 +01:00
.editorconfig refactor(editorconfig): Removed FreeRTOS tab rule 2022-09-23 12:53:33 +02:00
.flake8 tinyusb: Use TinyUSB from component registry 2022-11-02 08:24:43 +01:00
.gitignore docs(vale): Add configuration for Vale documentation linter 2023-10-10 15:27:09 +08:00
.gitlab-ci.yml ci(danger-gitlab): migrate code; Danger Gitlab from Shared-CI-Danger 2023-11-27 09:36:34 +01:00
.gitmodules feat(unity): upgrade to 2.6.0-RC1 2023-11-28 20:22:02 +01:00
.mypy.ini Add mypy check to pre-commit-config 2021-02-25 07:05:43 +00:00
.pre-commit-config.yaml ci(pre-commit-hooks): update version conventional-precommit-linter 2023-11-25 08:58:54 +01:00
.pylintrc ci: pylint with codeclimate 2023-08-15 08:31:45 +08:00
.readthedocs.yml Whitespace: Automated whitespace fixes (large commit) 2020-11-11 07:36:35 +00:00
.shellcheckrc feat(tools): Add shellcheck for shell scripts to CI 2023-10-03 10:57:29 +02:00
.vale.ini docs(vale): Add configuration for Vale documentation linter 2023-10-10 15:27:09 +08:00
add_path.sh Whitespace: Automated whitespace fixes (large commit) 2020-11-11 07:36:35 +00:00
CMakeLists.txt fix(build_system): disable shrink-wrapping in Og builds to reduce binary size 2023-10-09 12:13:02 +04:00
COMPATIBILITY_CN.md docs(compatibility): decrease required version of EPS32-S2 v1.0 2023-11-01 10:57:16 +08:00
COMPATIBILITY.md docs(compatibility): decrease required version of EPS32-S2 v1.0 2023-11-01 10:57:16 +08:00
conftest.py ci: assign the test_case_name attribute to the case item while setting up a pytest session 2023-10-23 20:45:05 +08:00
CONTRIBUTING.md docs: make CONTRIBUTING.md readable on Github 2022-05-04 01:16:34 +02:00
export.bat feat(tools): add espsecure.py to the Windows export scripts 2023-07-28 15:35:50 +02:00
export.fish Fix references to IDF_ADD_PATHS_EXTRAS before being declared 2023-04-28 21:30:53 +08:00
export.ps1 feat(tools): add espsecure.py to the Windows export scripts 2023-07-28 15:35:50 +02:00
export.sh Merge branch 'pull12247' into 'master' 2023-10-05 17:50:32 +08:00
install.bat feat: Install script help 2023-05-04 13:47:05 +02:00
install.fish feat: Install script help 2023-05-04 13:47:05 +02:00
install.ps1 feat: Install script help 2023-05-04 13:47:05 +02:00
install.sh feat(tools): Add shellcheck for shell scripts to CI 2023-10-03 10:57:29 +02:00
Kconfig refactor(build_test_rules): invert the logic to avoid involving preview target 2023-11-28 16:14:17 +08:00
LICENSE Initial public version 2016-08-17 23:08:22 +08:00
pytest.ini ci: build and test only modified components related test cases 2023-05-26 22:59:57 +08:00
README_CN.md docs(readme): Remove unsupported versions and add new chip 2023-09-19 13:41:43 +02:00
README.md docs(readme): Remove unsupported versions and add new chip 2023-09-19 13:41:43 +02:00
sdkconfig.rename core-system: changed CONFIG_COMPILER_OPTIMIZATION_DEFAULT to CONFIG_COMPILER_OPTIMIZATION_DEBUG 2023-06-02 15:16:50 +08:00
SECURITY.md Add a note about Espressif Security Incident Policy document 2023-05-10 12:10:41 +05:30
sonar-project.properties ci: pylint with codeclimate 2023-08-15 08:31:45 +08:00
SUPPORT_POLICY_CN.md docs: udpate CN translation for readme and build-system 2022-05-11 19:49:16 +08:00
SUPPORT_POLICY.md docs: udpate CN translation for readme and build-system 2022-05-11 19:49:16 +08:00

README.md

Espressif IoT Development Framework

ESP-IDF is the development framework for Espressif SoCs supported on Windows, Linux and macOS.

ESP-IDF Release Support Schedule

Support Schedule

ESP-IDF Release and SoC Compatibility

The following table shows ESP-IDF support of Espressif SoCs where alt text and alt text denote preview status and support, respectively. The preview support is usually limited in time and intended for beta versions of chips. Please use an ESP-IDF release where the desired SoC is already supported.

Chip v4.3 v4.4 v5.0 v5.1 v5.2
ESP32 alt text alt text alt text alt text alt text
ESP32-S2 alt text alt text alt text alt text alt text
ESP32-C3 alt text alt text alt text alt text alt text
ESP32-S3 alt text alt text alt text alt text Announcement
ESP32-C2 alt text alt text alt text Announcement
ESP32-C6 alt text alt text Announcement
ESP32-H2 alt text alt text Announcement
ESP32-P4 alt text Announcement

There are variants of revisions for a series of chips. See Compatibility Between ESP-IDF Releases and Revisions of Espressif SoCs for the details of the compatibility between ESP-IDF and chip revisions.

Espressif SoCs released before 2016 (ESP8266 and ESP8285) are supported by RTOS SDK instead.

Developing With ESP-IDF

Setting Up ESP-IDF

See https://idf.espressif.com/ for links to detailed instructions on how to set up the ESP-IDF depending on chip you use.

Note: Each SoC series and each ESP-IDF release has its own documentation. Please see Section Versions on how to find documentation and how to checkout specific release of ESP-IDF.

Non-GitHub forks

ESP-IDF uses relative locations as its submodules URLs (.gitmodules). So they link to GitHub. If ESP-IDF is forked to a Git repository which is not on GitHub, you will need to run the script tools/set-submodules-to-github.sh after git clone.

The script sets absolute URLs for all submodules, allowing git submodule update --init --recursive to complete. If cloning ESP-IDF from GitHub, this step is not needed.

Finding a Project

As well as the esp-idf-template project mentioned in Getting Started, ESP-IDF comes with some example projects in the examples directory.

Once you've found the project you want to work with, change to its directory and you can configure and build it.

To start your own project based on an example, copy the example project directory outside of the ESP-IDF directory.

Quick Reference

See the Getting Started guide links above for a detailed setup guide. This is a quick reference for common commands when working with ESP-IDF projects:

Setup Build Environment

(See the Getting Started guide listed above for a full list of required steps with more details.)

  • Install host build dependencies mentioned in the Getting Started guide.
  • Run the install script to set up the build environment. The options include install.bat or install.ps1 for Windows, and install.sh or install.fish for Unix shells.
  • Run the export script on Windows (export.bat) or source it on Unix (source export.sh) in every shell environment before using ESP-IDF.

Configuring the Project

  • idf.py set-target <chip_name> sets the target of the project to <chip_name>. Run idf.py set-target without any arguments to see a list of supported targets.
  • idf.py menuconfig opens a text-based configuration menu where you can configure the project.

Compiling the Project

idf.py build

... will compile app, bootloader and generate a partition table based on the config.

Flashing the Project

When the build finishes, it will print a command line to use esptool.py to flash the chip. However you can also do this automatically by running:

idf.py -p PORT flash

Replace PORT with the name of your serial port (like COM3 on Windows, /dev/ttyUSB0 on Linux, or /dev/cu.usbserial-X on MacOS. If the -p option is left out, idf.py flash will try to flash the first available serial port.

This will flash the entire project (app, bootloader and partition table) to a new chip. The settings for serial port flashing can be configured with idf.py menuconfig.

You don't need to run idf.py build before running idf.py flash, idf.py flash will automatically rebuild anything which needs it.

Viewing Serial Output

The idf.py monitor target uses the esp-idf-monitor tool to display serial output from Espressif SoCs. esp-idf-monitor also has a range of features to decode crash output and interact with the device. Check the documentation page for details.

Exit the monitor by typing Ctrl-].

To build, flash and monitor output in one pass, you can run:

idf.py flash monitor

Compiling & Flashing Only the App

After the initial flash, you may just want to build and flash just your app, not the bootloader and partition table:

  • idf.py app - build just the app.
  • idf.py app-flash - flash just the app.

idf.py app-flash will automatically rebuild the app if any source files have changed.

(In normal development there's no downside to reflashing the bootloader and partition table each time, if they haven't changed.)

Erasing Flash

The idf.py flash target does not erase the entire flash contents. However it is sometimes useful to set the device back to a totally erased state, particularly when making partition table changes or OTA app updates. To erase the entire flash, run idf.py erase-flash.

This can be combined with other targets, ie idf.py -p PORT erase-flash flash will erase everything and then re-flash the new app, bootloader and partition table.

Resources