KiCad - the KiCad Bridge

@@ -248,6 +248,23 @@ with that page's skills package (adom/wiki#170). The zip stays here.  `tools/build_native_release.py --publish` signs `kicad-bridge.exe` as Adom Industries, Inc. as the LAST change to it, then checks that the exe inside the zip carries the signature, and refuses to publish otherwise. Windows 11-Smart App Control blocks unsigned exes; every native build up to 1.0.52 shipped unsigned. The signer is a private-tool outside this repo (`ADOM_SIGN_EXE`, default `~/bin/adom-sign-exe`); its account details never go in this repo,-a skill, a README or an issue. `--sign` signs a local build without publishing.+Smart App Control blocks unsigned exes; every native build up to 1.0.52 shipped unsigned. `--sign` signs a local+build without publishing. Two signers, one certificate:++- **A local helper** (`ADOM_SIGN_EXE`, default `~/bin/adom-sign-exe`) when one is installed.+- **Otherwise Azure Trusted Signing on the signing host** (from 1.0.59, `tools/sign_azure.py`), the path every+  Adom release uses (altium-bridge's `release.py`). Its private config (`config.json` + `sign-verify.ps1`) lives+  in `$ADOM_SIGNING_DIR`, else `~/.adom/signing/kicad-bridge`, else `~/.adom/signing/altium-bridge`. The script:+  1. stages the exe on the host (`send_files`, a folder name without dots);+  2. signs and verifies it there with one `run_script` (Status Valid, the expected subject, a Microsoft+     timestamp, `signtool verify /pa`);+  3. pulls it back, checks the sha256 and the signer `CN = "Adom Industries, Inc."` here, and writes+     `rust/dist/signing-report.json`.++  `az_token_unavailable` means the host's Azure login lapsed: renew it with a device-code `az login` on the host+  and have the account owner approve it.++The account details never go in this repo, a skill, a README, an issue or a reply.++The public manifest is `adom-bridge-kicad-manifest.json` on the page (bridge.json `updateManifestUrl`). An+insiders release never writes or pushes it: only `tools/promote.py` does, with a person's words.

@@ -91,6 +91,21 @@ CHECKS = {     # placement (1.0.3): live when the PCB editor has the board on the IPC API, the file otherwise     "placement_state": lambda r: ok(r) and "revision" in r and isinstance(r.get("footprints"), list)                                  and len(r["footprints"]) > 0 and "totalMm" in (r.get("ratsnest") or {}),+    # the EDA Bridge Standard board model and its companions (1.0.59), read from the fixture's file+    "standard_model": lambda r: ok(r) and r.get("units") == "mm" and len(r.get("pads") or []) > 0+                                and len(r.get("revision") or "") == 16 and isinstance(r.get("unconnected"), int)+                                and len(r.get("outlineEdges") or []) >= 3,+    "layer_stack": lambda r: ok(r) and (r.get("copperLayers") or 0) >= 2 and "dielectricUm" in (r.get("layers") or [{}])[0],+    "pour_state": lambda r: ok(r) and isinstance(r.get("zones"), list) and "filledAreaByLayerMm2" in r,+    "bodies": lambda r: ok(r) and (r.get("parts") or 0) > 0 and isinstance(r.get("bodies"), list)+                        and len(r["bodies"]) + len(r.get("noBody") or []) >= r["parts"],+    "std_netlist": lambda r: ok(r) and (r.get("netCount") or 0) > 0 and isinstance(r.get("nets"), dict)+                             and any(p.get("pins") for p in (r.get("parts") or [])),+    "board_summary": lambda r: ok(r) and (r.get("summary") or {}).get("components", 0) > 0,+    "count_list": lambda r: ok(r) and (r.get("count") or 0) > 0,+    "layers_in_use": lambda r: ok(r) and len(r.get("copperLayersInUse") or []) > 0,+    "component_data": lambda r: ok(r) and (r.get("component") or {}).get("pads", 0) > 0,+    "component_pins": lambda r: ok(r) and (r.get("count") or 0) > 0,     "move_dry": lambda r: ok(r) and r.get("dryRun") is True and r.get("mutated") is False                           and "checks" in r and r.get("undoSteps") == 0,     "taskbar_report": lambda r: ok(r) and r.get("errors") == 0 and ("already" in r or "written" in r),@@ -153,6 +168,19 @@ def matrix(w: dict) -> dict:         "run_erc":           dict(phase=2, args={"filePath": S}, timeout=200),         "lint_board":        dict(phase=2, args={"filePath": B}, timeout=200),         "lint_schematic":    dict(phase=2, args={"filePath": S}, timeout=200),+        # ---- phase 2a: the EDA Bridge Standard board model and companions (1.0.59), from the file+        "layer_stack":       dict(phase=2, args={"filePath": B, "source": "file"}, check="layer_stack"),+        "pour_state":        dict(phase=2, args={"filePath": B, "source": "file", "geometry": False}, check="pour_state"),+        "bodies":            dict(phase=2, args={"filePath": B, "source": "file"}, check="bodies", timeout=120,+                                  note="3D model bounds from the files the footprints name; every part is a body or in noBody"),+        "netlist":           dict(phase=2, args={"filePath": S, "parts": True}, check="std_netlist", timeout=120),+        "board_summary":     dict(phase=2, args={"filePath": B, "source": "file"}, check="board_summary"),+        "list_nets":         dict(phase=2, args={"filePath": B, "source": "file"}, check="count_list"),+        "list_designators":  dict(phase=2, args={"filePath": B, "source": "file"}, check="count_list"),+        "copper_layers":     dict(phase=2, args={"filePath": B, "source": "file"}, check="count_list"),+        "layers_in_use":     dict(phase=2, args={"filePath": B, "source": "file"}, check="layers_in_use"),+        "component_data":    dict(phase=2, args={"filePath": B, "source": "file", "designator": "U1"}, check="component_data"),+        "component_pins":    dict(phase=2, args={"filePath": B, "source": "file", "designator": "U1"}, check="component_pins"),         # ---- phase 2b: native-build verbs (Rust port). All read-only or on the fixture copy.         "freerouting":       dict(phase=1, args={"action": "status"}, timeout=60,                                   note="status only: install is on demand and asks the user first"),@@ -783,7 +811,12 @@ def main():                 if ok(st) and st.get("revision"):                     break                 time.sleep(5)-            record("routing_state", st, ok(st) and bool(st.get("revision")) and isinstance(st.get("pads"), (list, str)))+            # the standard board model, live: the same board, the revision the edit verbs accept+            sm = ab(a.target, "kicad_routing_state", {"filePath": L, "model": "standard"}, timeout=150)+            std_ok = CHECKS["standard_model"](sm) and sm.get("source") == "live-editor"+            record("routing_state", {"legacy": st, "standard": {k: sm.get(k) for k in ("success", "source", "revision", "unconnected", "counts", "errorCode", "error")}},+                   ok(st) and bool(st.get("revision")) and isinstance(st.get("pads"), (list, str)) and std_ok,+                   None if std_ok else "the standard model did not read live")             rev = [st.get("revision")]             pads = st.get("pads") or []             if isinstance(pads, str):@@ -824,8 +857,14 @@ def main():             if routed is not None:                 record("route_net", routed, ok(routed) and bool(routed.get("itemIds")))                 ids = routed.get("itemIds") or []+                # wiki #134: a dry run must leave the copper where it is+                d = step("remove_route", {"filePath": L, "expectedRevision": rev[0], "itemIds": ids, "dryRun": True, "reason": WHY}, chain=False)+                after = ab(a.target, "kicad_routing_state", {"filePath": L}, timeout=150)+                still = {x.get("uuid") for x in (after.get("segments") or [])} | {x.get("uuid") for x in (after.get("vias") or [])}+                dry_ok = ok(d) and d.get("mutated") is False and all(i in still for i in ids)                 r = step("remove_route", {"filePath": L, "expectedRevision": rev[0], "itemIds": ids, "reason": WHY})-                record("remove_route", r, ok(r))+                record("remove_route", {"dryRun": d, "remove": r}, dry_ok and ok(r),+                       None if dry_ok else "the dry run moved copper or did not answer mutated:false")             else:                 well_formed = bool(last.get("errorCode")) and last.get("mutated") is not True                 record("route_net", last, well_formed, "no straight pad-to-pad hop passed DRC; the refusal path was exercised")

@@ -137,14 +137,21 @@ def main():     # Smart App Control blocks unsigned exes, so a published build is ALWAYS signed as Adom     # Industries, Inc.; the signer is a private tool outside this public repo (ADOM_SIGN_EXE,     # default ~/bin/adom-sign-exe). Every native build up to 1.0.52 shipped unsigned.+    # Two signers, the same certificate: a local helper (ADOM_SIGN_EXE, ~/bin/adom-sign-exe) where one is+    # installed, else Azure Trusted Signing on the signing host through Adom Bridge (tools/sign_azure.py, the+    # path every Adom release uses; its private config is outside this repo).     signed = False     if publish or "--sign" in sys.argv:         signer = os.environ.get("ADOM_SIGN_EXE") or os.path.expanduser("~/bin/adom-sign-exe")-        if not os.path.isfile(signer):-            sys.exit(f"REFUSING: no exe signer at {signer}; an unsigned exe is never published")-        r = subprocess.run([signer, str(stage / "kicad-bridge.exe"), "--bridge", "kicad-bridge"], text=True)-        if r.returncode != 0:-            sys.exit("REFUSING: signing failed (see above); nothing was published")+        if os.path.isfile(signer):+            r = subprocess.run([signer, str(stage / "kicad-bridge.exe"), "--bridge", "kicad-bridge"], text=True)+            if r.returncode != 0:+                sys.exit("REFUSING: signing failed (see above); nothing was published")+        else:+            sys.path.insert(0, str(ROOT / "tools"))+            import sign_azure+            report = sign_azure.sign(stage / "kicad-bridge.exe", ver)+            (dist / "signing-report.json").write_text(json.dumps(report, indent=2) + "\n")         signed = authenticode_size(stage / "kicad-bridge.exe") > 0         if not signed:             sys.exit("REFUSING: the signer reported success but the exe carries no signature")@@ -189,7 +196,7 @@ def publish_zip(ver, zpath, sha, notes):     REF = "adom/kicad-bridge"     # 1. The repo must tell the same story as the zip: push every rust source file.     src = [str(p.relative_to(ROOT)) for p in sorted((RUST).rglob("*")) if p.is_file() and "target" not in p.parts and "dist" not in p.parts]-    src += ["tools/build_native_release.py"]+    src += ["tools/build_native_release.py", "tools/sign_azure.py"]     msg = f"{ver}: {notes}"     failed = push_chunked(REF, src, msg, cwd=str(ROOT))     if failed:@@ -207,7 +214,9 @@ def publish_zip(ver, zpath, sha, notes):     # ab reads every platforms entry as a download (url, sha256, size): one zip serves both OSes.     dl = {"url": m["url"], "sha256": sha, "size": zpath.stat().st_size}     m["platforms"] = {k: dict(v, **dl) for k, v in PLATFORMS.items() if v.get("supported")}-    mpath.write_text(json.dumps(m, indent=2) + "\n")+    # NOT written back to mpath: the page's adom-bridge-kicad-manifest.json IS the public tier+    # (bridge.json updateManifestUrl), so a local copy at the insiders version is one careless push+    # away from promoting it. Only tools/promote.py moves it.     # 4. INSIDERS tier only. The public manifest moves through tools/promote.py.     ins = dict(m); ins["tier"] = "insiders"     import tempfile@@ -223,6 +232,10 @@ def publish_zip(ver, zpath, sha, notes):     prior = led.read_text(encoding="utf-8")     head, _, rest = prior.partition("\n\n## ")     led.write_text((head + "\n\n" + entry + ("## " + rest if rest else "")) if rest else (prior + entry), encoding="utf-8")+    # 6. The page repo keeps the ledger (it was left local before). Never the public manifest here.+    failed = push_chunked(REF, ["RELEASE_NOTES.md"], f"{ver}: release record", cwd=str(ROOT))+    if failed:+        print("WARNING: the RELEASE_NOTES.md push failed; push it by hand")     print(f"\nSHIPPED TO INSIDERS ({ver}, native). Public tier untouched.")     print(f"  Promote with: python3 tools/promote.py {ver} --because \"<your words>\"")     print("  Boxes pick it up on the 4 h poll, or now with bridge_install {manifestUrl: the insiders version.json, force: true}")