emdashes begone (#10847)

This commit is contained in:
Tom
2026-07-01 19:01:27 -05:00
committed by GitHub
parent dee94e0758
commit 3becaf2d95
276 files changed
+1795 -1793

No files matched your search

+15 -15
View File
@@ -400,7 +400,7 @@ void setup()
// M23 (audit): APPROTECT engagement moved below fsInit() so we can gate
// on EncryptedStorage::isProvisioned(). Engaging on an unprovisioned dev
// board permanently locks SWD before the operator has even set a
// passphrase a misconfigured CI build flashed to a developer device
// passphrase - a misconfigured CI build flashed to a developer device
// would brick its debug port on first boot. Now we only engage when the
// device has a DEK file on flash, i.e. the operator has explicitly
// committed to lockdown via passphrase provisioning.
@@ -436,7 +436,7 @@ void setup()
#endif
// The DEBUG_MUTE "we are muted, FYI" banner spills APP_VERSION / APP_ENV /
// APP_REPO out the USB CDC even with logging otherwise suppressed a free
// APP_REPO out the USB CDC even with logging otherwise suppressed - a free
// firmware-fingerprinting primitive for an attacker holding the cable.
// Under MESHTASTIC_LOCKDOWN we want the device to look uniformly silent
// until the operator authenticates, so skip the banner entirely there.
@@ -516,9 +516,9 @@ void setup()
EncryptedStorage::initLocked();
if (!EncryptedStorage::isUnlocked()) {
if (!EncryptedStorage::isProvisioned()) {
LOG_WARN("Lockdown: Device not provisioned connect and set a passphrase to unlock storage");
LOG_WARN("Lockdown: Device not provisioned - connect and set a passphrase to unlock storage");
} else {
LOG_WARN("Lockdown: Device locked connect and provide passphrase to unlock storage");
LOG_WARN("Lockdown: Device locked - connect and provide passphrase to unlock storage");
}
}
#endif
@@ -530,7 +530,7 @@ void setup()
// otherwise burn SWD on first boot before the operator has even set a
// passphrase, taking the board out of the dev/recovery workflow with
// no real security benefit (there's no DEK to protect yet). Once a
// DEK file exists, the operator has committed to lockdown engaging
// DEK file exists, the operator has committed to lockdown - engaging
// APPROTECT then is the protection they asked for.
if (EncryptedStorage::isProvisioned()) {
enableAPProtect();
@@ -1150,8 +1150,8 @@ uint32_t shutdownAtMsec; // If not zero we will shutdown at this time (used to
bool suppressRebootBanner; // If true, suppress "Rebooting..." overlay (used for OTA handoff)
#if defined(MESHTASTIC_ENCRYPTED_STORAGE) && defined(MESHTASTIC_PHONEAPI_ACCESS_CONTROL)
volatile bool lockdownReloadPending; // see main.h deferred NodeDB reload after lockdown unlock
volatile bool lockdownDisablePending; // see main.h deferred decrypt-revert after lockdown disable
volatile bool lockdownReloadPending; // see main.h - deferred NodeDB reload after lockdown unlock
volatile bool lockdownDisablePending; // see main.h - deferred decrypt-revert after lockdown disable
#endif
// If a thread does something that might need for it to be rescheduled ASAP it can set this flag
@@ -1241,7 +1241,7 @@ void loop()
#if defined(MESHTASTIC_ENCRYPTED_STORAGE) && defined(MESHTASTIC_PHONEAPI_ACCESS_CONTROL)
if (lockdownDisablePending) {
lockdownDisablePending = false;
LOG_INFO("Lockdown: disabling reverting encrypted storage to plaintext");
LOG_INFO("Lockdown: disabling - reverting encrypted storage to plaintext");
if (nodeDB->disableLockdownToPlaintext()) {
LOG_INFO("Lockdown: disabled, rebooting into normal mode");
PhoneAPI::broadcastLockdownStatus(meshtastic_LockdownStatus_State_DISABLED, "", 0, 0, 0);
@@ -1251,7 +1251,7 @@ void loop()
// The DEK file is still present (it's deleted last), so the device
// stays in lockdown and the operator can retry disable. Surface
// the failure rather than leaving the client hanging.
LOG_ERROR("Lockdown: disable revert failed device remains in lockdown");
LOG_ERROR("Lockdown: disable revert failed - device remains in lockdown");
PhoneAPI::broadcastLockdownStatus(meshtastic_LockdownStatus_State_LOCKED, "disable_failed", 0, 0, 0);
}
}
@@ -1263,20 +1263,20 @@ void loop()
if (!reloadOk) {
// Storage decrypt/decode failed during reload. Treat as
// unrecoverable for this boot: lock storage, revoke any
// auth that managed to slip through (defense in depth the
// auth that managed to slip through (defense in depth - the
// cold-unlock path doesn't authorize until completion, but
// a concurrent re-verify-path call from another connection
// might have), and notify clients. Storage will be locked
// on next boot anyway; deferring to the user-visible
// notification path is sufficient for now.
LOG_ERROR("Lockdown: reload failed locking and notifying clients");
LOG_ERROR("Lockdown: reload failed - locking and notifying clients");
EncryptedStorage::lockNow();
PhoneAPI::revokeAllAuth();
}
PhoneAPI::completePendingUnlocks(reloadOk);
}
// Periodic session-expiry check. Cheap millis() comparison. Don't
// Periodic session-expiry check. Cheap - millis() comparison. Don't
// hammer it every loop tick; once a second is plenty.
static uint32_t lastSessionCheckMs = 0;
if (millis() - lastSessionCheckMs > 1000) {
@@ -1286,10 +1286,10 @@ void loop()
// 1. Budget remains (bootsRemaining > 0): decrement the
// on-flash boot count in place, revoke per-connection
// auth, re-engage screen redaction, re-arm the uptime
// timer all WITHOUT rebooting. Storage stays unlocked
// timer - all WITHOUT rebooting. Storage stays unlocked
// so the mesh keeps routing. Clients must re-authenticate
// to see content again. The decrement is what enforces
// the rollback ceiling bootsRemaining ticks down
// the rollback ceiling - bootsRemaining ticks down
// monotonically whether the device reboots or not.
// 2. Budget exhausted (bootsRemaining == 0): no more
// sessions to grant. Hard lock (token deleted, DEK
@@ -1338,7 +1338,7 @@ void loop()
RadioLibInterface::instance->pollMissedIrqs();
}
// Periodic AGC reset warm sleep + recalibrate to prevent stuck AGC gain
// Periodic AGC reset - warm sleep + recalibrate to prevent stuck AGC gain
static uint32_t lastAgcReset;
if (!Throttle::isWithinTimespanMs(lastAgcReset, AGC_RESET_INTERVAL_MS)) {
lastAgcReset = millis();