fix(omiglass): disable unauthenticated OTA

[undivisible]

What

Fixes #9589 by removing the OmiGlass BLE OTA downloader and its unauthenticated firmware-install path.

The removed path accepted an arbitrary URL over BLE, permitted HTTP, used WiFiClientSecure::setInsecure(), and installed bytes with Update.end(true) without an authenticated artifact verification path. The repository has no maintained CA/pinning configuration, signing key, signed manifest, or verifier that can safely support OTA today.

This change therefore fails closed: the BLE OTA service, URL/Wi-Fi/update commands, downloader, and installer are removed. USB UF2 and PlatformIO flashing remain available. OTA must not return until a real signed-artifact delivery design exists.

Guard and verification

• Added omiglass-ota-fail-closed, selected in both local and CI lanes for OmiGlass firmware changes. It rejects restored OTA files, OTA BLE command identifiers, insecure TLS, HTTP client, and direct Update install tokens.
• The guard failed before removal and passes after it.
• pio run -e seeed_xiao_esp32s3 passed: ESP32-S3 firmware compiled and linked successfully.
• python3 .github/scripts/test_run_checks.py passed.
• git diff --check passed.

Security boundary

This deliberately removes a vulnerable update capability rather than pretending HTTPS alone authenticates firmware. A follow-up enabling OTA must introduce a maintained transport trust policy and verified signed artifacts before exposing any device update command.

Product invariants

None affected.

Failure-Class: none

---

Note

Medium Risk
Firmware update surface is security-sensitive; this PR reduces risk by removing the vulnerable OTA installer while leaving normal BLE photo/audio behavior unchanged.

Overview
Removes the OmiGlass BLE OTA update path that could install firmware from arbitrary URLs over BLE (including HTTP and TLS with setInsecure()), with no signed-artifact verification. Deleted ota.cpp / ota.h, stripped the OTA BLE service and ota_loop() from app.cpp, and dropped OTA/Wi-Fi constants from config.h.

USB UF2 and PlatformIO flashing stay supported. The firmware readme now states that BLE OTA is off until authenticated signed delivery exists.

Adds omiglass-ota-fail-closed in .github/checks-manifest.yaml, running check_omiglass_ota_boundary.py on OmiGlass firmware changes to block restoring OTA sources or forbidden tokens (e.g. OTA_SERVICE_UUID, HTTPClient, Update.begin).

^{Reviewed by Cursor Bugbot for commit edac0fe. Configure here.}

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[Git-on-my-level]

Thanks for taking the conservative security direction here. Removing the unauthenticated BLE OTA downloader, the arbitrary URL/Wi-Fi command surface, setInsecure() TLS bypass, and direct Update install path is the right fail-closed move until there is a signed-artifact design.

I’m requesting changes for the current head because CI is still red on this PR:

• The repo Formatting job fails on omiGlass/firmware/src/config.h after this file is touched. Please run the repository formatting target/clang-format for that file so this PR does not leave a required hygiene check failing.
• The Desktop Swift checks are also red on the current head. They look unrelated to the OmiGlass firmware diff from the log I inspected, but this still needs a green/maintainer-accepted CI state before merge.

I also ran the new OmiGlass OTA boundary script on the PR checkout at 0cae05bdc97405312f112ac8006abd1426940fbe; it passes and I did not find the removed OTA files or blocked OTA/download/install tokens in omiGlass/firmware/src. Once formatting/CI is clean, this looks like a strong security hardening change for human maintainer review.

---

by AI on behalf of David — if you need David’s attention urgently, please @Git-on-my-level and escalate with need human response.

Superseded by re-review of head 4b7b131: the prior CI/formatting blockers are now green; human maintainer sign-off is still required for the firmware security boundary.

[Git-on-my-level]

Thanks for the update here. I re-reviewed the current head and the earlier automation blockers appear resolved: the repository Formatting check and Desktop Swift checks are now green, and the new OmiGlass OTA boundary script passes on the PR checkout.

This is a positive security-hardening direction: the PR removes the BLE OTA service, arbitrary URL/Wi-Fi command surface, setInsecure() TLS bypass, and direct Update install path, then adds a static tripwire so this unauthenticated OTA surface stays removed until there is a signed-artifact delivery design.

Because this intentionally changes a firmware update/security boundary, I’m leaving it for human maintainer sign-off rather than formal automation approval. I’d want the maintainer pass to confirm the product tradeoff of disabling BLE OTA for OmiGlass and, if possible, include/confirm the firmware compile or device-flashing validation evidence before merge.

---

by AI on behalf of David — if you need David’s attention urgently, please @Git-on-my-level and escalate with need human response.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_73f89dc6-b94e-431a-a07b-bfa2832379cb)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_28ea6594-f7f0-4fc7-893e-5a44ad4ec90a)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_fe81569e-5f1d-4d02-adf3-58993216bc00)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_a12e78e9-a010-4a74-a25c-97c48c32cca4)

[Git-on-my-level]

Thanks for the update here. I re-reviewed this head and the core security direction still looks good: this remains a fail-closed removal of the unauthenticated OmiGlass OTA path, not a partial hardening of it.

File-specific notes:

• .github/checks-manifest.yaml registers omiglass-ota-fail-closed in both local and CI lanes for OmiGlass firmware and the guard itself, which is the right place for this static boundary check.
• .github/scripts/check_omiglass_ota_boundary.py explicitly fails if ota.cpp/ota.h return or if firmware sources reintroduce the old BLE OTA/download/install tokens (OTA_SERVICE_UUID, setInsecure, HTTPClient, Update.begin, Update.end, etc.). I ran it on this checkout and it passes.
• omiGlass/firmware/readme.md now tells users that BLE OTA is disabled until authenticated signed-artifact delivery exists while USB/PlatformIO flashing remain available; that matches the implementation.
• omiGlass/firmware/src/app.cpp removes the ota.h include, OTA BLE UUIDs/characteristics, OTA callback, OTA service startup, and ota_loop() call while leaving the existing photo/audio/battery services intact.
• omiGlass/firmware/src/config.h removes the OTA UUIDs, command/status constants, Wi-Fi credential limits, and OTA URL length constants; the remaining audio/OMI BLE constants are unchanged aside from formatting alignment.
• omiGlass/firmware/src/ota.cpp and omiGlass/firmware/src/ota.h are deleted, removing the arbitrary BLE-provided firmware URL path, temporary Wi-Fi credential handling, insecure TLS bypass, and direct Update install flow.

Validation I ran locally:

• python3 .github/scripts/check_omiglass_ota_boundary.py passed.
• git diff --check origin/main...HEAD passed.
• python3 .github/scripts/test_run_checks.py passed (44 tests).
• A repository search under omiGlass/firmware found no remaining old OTA tokens guarded by the new script.

I did not run a firmware PlatformIO build here because PlatformIO is not installed in this environment. GitHub is also currently showing failing Desktop Swift checks (Desktop Swift Build & Tests / Desktop Swift Static & Test Contracts), with the failing log pointing at RewindAllTimeSearchTests, which appears unrelated to these OmiGlass firmware files. I’m therefore leaving this as a positive maintainer signal rather than a blocking change request or formal approval.

Human maintainer sign-off is still needed for the security-sensitive decision to keep BLE OTA disabled until there is a signed-artifact verification design, and the branch should be rechecked once CI is green.

Automated maintainer review.

---

by AI on behalf of David — if you need David’s attention urgently, please @Git-on-my-level and escalate with need human response.