Merge remote-tracking branch 'upstream/dev' into noise-session-resume

# Conflicts:
#	esphome/components/noise/noise.h

esphome/__main__.py

@@ -1289,9 +1289,10 @@ def _choose_ota_platform(config: ConfigType, requested: str | None) -> str:
     The native API uses challenge-response auth with MD5/SHA256 hashing of a
     server-issued nonce, so the password is never sent over the wire; the
     ``web_server`` path uses HTTP Basic auth which transmits credentials in
-    cleartext over the LAN. (The native path also compresses the upload:
-    gzip on ESP8266 and RP2040, which inflate it at reboot, and a deflate
-    stream on ESP32/LibreTiny, which inflate it as it arrives.) Falls back to
+    cleartext over the LAN. (The native path also supports gzip compression
+    on ESP8266, where flash space is tight; on ESP32/RP2040/LibreTiny the
+    backend reports ``supports_compression() == false`` and the firmware is
+    sent uncompressed regardless of which platform is used.) Falls back to
     ``web_server`` only when that is the only available platform.
     """
     # Use a dict (insertion-ordered) instead of a list so error messages and

esphome/components/api/api.proto

@@ -893,6 +893,20 @@ message NoiseEncryptionSetKeyResponse {
   bool success = 1;
 }
 
+// Single-use session resume ticket, sent unsolicited by the device after a
+// Noise connection authenticates. A client presents it in the ClientHello of
+// its next connection to skip the curve25519 handshake; the device then
+// issues a fresh ticket on that connection. Never sent on plaintext
+// connections. Clients that do not understand it drop it silently.
+// Contents are secret; the device generator redacts this message from dump_to
+message NoiseResumeTicket {
+  option (id) = 152;
+  option (source) = SOURCE_SERVER;
+  option (ifdef) = "USE_API_NOISE";
+
+  bytes ticket = 1;  // session_id(8) || secret(32)
+}
+
 // ==================== HOMEASSISTANT.SERVICE ====================
 message SubscribeHomeassistantServicesRequest {
   option (id) = 34;

esphome/components/api/api_connection.cpp

@@ -1779,6 +1779,9 @@ void APIConnection::complete_authentication_() {
     this->send_time_request();
   }
 #endif
+#ifdef USE_API_NOISE
+  this->send_resume_ticket_();
+#endif
 #ifdef USE_ZWAVE_PROXY
   if (zwave_proxy::global_zwave_proxy != nullptr) {
     zwave_proxy::global_zwave_proxy->api_connection_authenticated(this);
@@ -1786,6 +1789,27 @@ void APIConnection::complete_authentication_() {
 #endif
 }
 
+#ifdef USE_API_NOISE
+void APIConnection::send_resume_ticket_() {
+#ifdef USE_API_PLAINTEXT
+  // Only encrypted transports get a ticket: on dual-mode builds a plaintext
+  // connection has no frame footer
+  if (this->helper_->frame_footer_size() == 0) {
+    return;
+  }
+#endif
+  noise::ResumeTicket ticket;
+  if (!this->parent_->get_noise_ctx().resume_cache().issue(ticket)) {
+    return;
+  }
+  NoiseResumeTicket msg;
+  msg.set_ticket(reinterpret_cast<const uint8_t *>(&ticket), sizeof(ticket));
+  // A dropped ticket is harmless: the client does a full handshake next time
+  static_cast<void>(this->send_message(msg));
+  noise_clean(&ticket, sizeof(ticket));
+}
+#endif
+
 bool APIConnection::send_hello_response_(const HelloRequest &msg) {
   // Copy client name with truncation if needed (set_client_name handles truncation)
   this->helper_->set_client_name(msg.client_info.c_str(), msg.client_info.size());

esphome/components/api/api_connection.h

@@ -381,6 +381,11 @@ class APIConnection final : public APIServerConnectionBase {
   // Helper function to handle authentication completion
   void complete_authentication_();
 
+#ifdef USE_API_NOISE
+  // Issue a fresh single-use session resume ticket over the encrypted channel
+  void send_resume_ticket_();
+#endif
+
   // Pattern B helpers: send response and return success/failure
   bool send_hello_response_(const HelloRequest &msg);
   bool send_disconnect_response_();

esphome/components/api/api_frame_helper_noise.cpp

@@ -271,8 +271,8 @@ APIError APINoiseFrameHelper::state_action_client_hello_() {
   if (aerr != APIError::OK) {
     return handle_handshake_frame_error_(aerr);
   }
-  // ignore contents, may be used in future for flags
-  // Resize for: existing prologue + 2 size bytes + frame data
+  // Contents are extension flags (today: the resume offer); mixed into the
+  // prologue either way. Resize for: existing prologue + 2 size bytes + frame data
   size_t old_size = this->prologue_.size();
   size_t rx_size = this->rx_buf_.size();
   if (!this->prologue_.resize(old_size + 2 + rx_size)) [[unlikely]] {
@@ -289,6 +289,8 @@ APIError APINoiseFrameHelper::state_action_client_hello_() {
   return APIError::OK;
 }
 APIError APINoiseFrameHelper::state_action_server_hello_() {
+  // A verified resume offer (still in rx_buf_ from the client hello step)
+  // replaces the whole handshake; any failure falls back to the full one.
   // send server hello
   const auto &name = App.get_name();
   char mac[MAC_ADDRESS_BUFFER_SIZE];
@@ -302,7 +304,9 @@ APIError APINoiseFrameHelper::state_action_server_hello_() {
 
   // 1 (proto) + name (max ESPHOME_DEVICE_NAME_MAX_LEN) + 1 (name null)
   // + mac (MAC_ADDRESS_BUFFER_SIZE - 1) + 1 (mac null)
-  constexpr size_t max_msg_size = 1 + ESPHOME_DEVICE_NAME_MAX_LEN + 1 + MAC_ADDRESS_BUFFER_SIZE;
+  // + optional resume accept extension
+  constexpr size_t max_msg_size =
+      1 + ESPHOME_DEVICE_NAME_MAX_LEN + 1 + MAC_ADDRESS_BUFFER_SIZE + noise::RESUME_ACCEPT_SIZE;
   uint8_t msg[max_msg_size];
 
   // chosen proto
@@ -313,16 +317,32 @@ APIError APINoiseFrameHelper::state_action_server_hello_() {
   // node mac, terminated by null byte
   std::memcpy(msg + mac_offset, mac, MAC_ADDRESS_BUFFER_SIZE);
 
+  // The accept extension, if any, is written straight after the mac
+  size_t ext_len = this->ctx_.resume_cache().try_accept(
+      this->rx_buf_.data(), this->rx_buf_.size(), this->prologue_.data(), this->prologue_.size(), msg + total_size,
+      sizeof(msg) - total_size, send_cipher_, recv_cipher_);
+  bool resume = ext_len != 0;
+  total_size += ext_len;
+
   APIError aerr = write_frame_(msg, total_size);
   if (aerr != APIError::OK)
     return aerr;
 
-  // start handshake
-  aerr = init_handshake_();
-  if (aerr != APIError::OK)
-    return aerr;
-
-  state_ = State::HANDSHAKE;
+  if (resume) {
+    // A resuming client waits for this hello instead of pipelining
+    // handshake message 1, so the transport is ready now
+    this->frame_footer_size_ = noise_cipherstate_get_mac_length(this->send_cipher_);
+    HELPER_LOG("Session resumed!");
+    state_ = State::DATA;
+  } else {
+    aerr = init_handshake_();
+    if (aerr != APIError::OK)
+      return aerr;
+    state_ = State::HANDSHAKE;
+  }
+  // init_handshake_ copied the prologue into the handshake state; the resume
+  // path is done with it too
+  this->prologue_.release();
   return APIError::OK;
 }
 APIError APINoiseFrameHelper::state_action_handshake_() {
@@ -552,8 +572,6 @@ APIError APINoiseFrameHelper::init_handshake_() {
   APIError aerr = handle_noise_error_(err, LOG_STR("noise_handshake_init"), APIError::HANDSHAKESTATE_SETUP_FAILED);
   if (aerr != APIError::OK)
     return aerr;
-  // init copies the prologue into the handshakestate, so we can get rid of it now
-  prologue_.release();
   return APIError::OK;
 }
 

esphome/components/api/api_pb2.cpp

@@ -1061,6 +1061,16 @@ uint32_t NoiseEncryptionSetKeyResponse::calculate_size() const {
   size += ProtoSize::calc_bool(1, this->success);
   return size;
 }
+uint8_t *NoiseResumeTicket::encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const {
+  uint8_t *__restrict__ pos = buffer.get_pos();
+  ProtoEncode::encode_bytes(pos PROTO_ENCODE_DEBUG_ARG, 1, this->ticket_ptr_, this->ticket_len_);
+  return pos;
+}
+uint32_t NoiseResumeTicket::calculate_size() const {
+  uint32_t size = 0;
+  size += ProtoSize::calc_length(1, this->ticket_len_);
+  return size;
+}
 #endif
 #ifdef USE_API_HOMEASSISTANT_SERVICES
 uint8_t *HomeassistantServiceMap::encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const {

esphome/components/api/api_pb2.h

@@ -1147,6 +1147,27 @@ class NoiseEncryptionSetKeyResponse final : public ProtoMessage {
 
  protected:
 };
+class NoiseResumeTicket final : public ProtoMessage {
+ public:
+  static constexpr uint16_t MESSAGE_TYPE = 152;
+  static constexpr uint8_t ESTIMATED_SIZE = 19;
+#ifdef HAS_PROTO_MESSAGE_DUMP
+  const LogString *message_name() const override { return LOG_STR("noise_resume_ticket"); }
+#endif
+  const uint8_t *ticket_ptr_{nullptr};
+  size_t ticket_len_{0};
+  void set_ticket(const uint8_t *data, size_t len) {
+    this->ticket_ptr_ = data;
+    this->ticket_len_ = len;
+  }
+  uint8_t *encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const;
+  uint32_t calculate_size() const;
+#ifdef HAS_PROTO_MESSAGE_DUMP
+  const char *dump_to(DumpBuffer &out) const override;
+#endif
+
+ protected:
+};
 #endif
 #ifdef USE_API_HOMEASSISTANT_SERVICES
 class HomeassistantServiceMap final : public ProtoMessage {

esphome/components/api/api_pb2_dump.cpp

@@ -1393,6 +1393,10 @@ const char *NoiseEncryptionSetKeyResponse::dump_to(DumpBuffer &out) const {
   dump_field(out, ESPHOME_PSTR("success"), this->success);
   return out.c_str();
 }
+const char *NoiseResumeTicket::dump_to(DumpBuffer &out) const {
+  out.append_p(ESPHOME_PSTR("NoiseResumeTicket {}"));
+  return out.c_str();
+}
 #endif
 #ifdef USE_API_HOMEASSISTANT_SERVICES
 const char *HomeassistantServiceMap::dump_to(DumpBuffer &out) const {

esphome/components/audio/audio_reader.cpp

@@ -58,9 +58,6 @@ esp_err_t AudioReader::add_sink(const std::weak_ptr<ring_buffer::RingBuffer> &ou
   if (current_audio_file_ != nullptr) {
     // A transfer buffer isn't ncessary for a local file
     this->file_ring_buffer_ = output_ring_buffer.lock();
-    if (this->file_ring_buffer_ == nullptr) {
-      return ESP_ERR_INVALID_STATE;
-    }
     return ESP_OK;
   }
 

esphome/components/audio/audio_transfer_buffer.cpp

@@ -51,14 +51,14 @@ void AudioTransferBuffer::increase_buffer_length(size_t bytes) { this->buffer_le
 
 void AudioTransferBuffer::clear_buffered_data() {
   this->buffer_length_ = 0;
-  if (this->ring_buffer_ != nullptr) {
+  if (this->ring_buffer_.use_count() > 0) {
     this->ring_buffer_->reset();
   }
 }
 
 void AudioSinkTransferBuffer::clear_buffered_data() {
   this->buffer_length_ = 0;
-  if (this->ring_buffer_ != nullptr) {
+  if (this->ring_buffer_.use_count() > 0) {
     this->ring_buffer_->reset();
   }
 #ifdef USE_SPEAKER
@@ -69,7 +69,7 @@ void AudioSinkTransferBuffer::clear_buffered_data() {
 }
 
 bool AudioTransferBuffer::has_buffered_data() const {
-  if (this->ring_buffer_ != nullptr) {
+  if (this->ring_buffer_.use_count() > 0) {
     return ((this->ring_buffer_->available() > 0) || (this->available() > 0));
   }
   return (this->available() > 0);
@@ -144,7 +144,7 @@ size_t AudioSourceTransferBuffer::transfer_data_from_source(TickType_t ticks_to_
   size_t bytes_to_read = AudioTransferBuffer::free();
   size_t bytes_read = 0;
   if (bytes_to_read > 0) {
-    if (this->ring_buffer_ != nullptr) {
+    if (this->ring_buffer_.use_count() > 0) {
       bytes_read = this->ring_buffer_->read((void *) this->get_buffer_end(), bytes_to_read, ticks_to_wait);
     }
 
@@ -161,7 +161,7 @@ size_t AudioSinkTransferBuffer::transfer_data_to_sink(TickType_t ticks_to_wait,
       bytes_written = this->speaker_->play(this->data_start_, this->available(), ticks_to_wait);
     } else
 #endif
-        if (this->ring_buffer_ != nullptr) {
+        if (this->ring_buffer_.use_count() > 0) {
       bytes_written =
           this->ring_buffer_->write_without_replacement((void *) this->data_start_, this->available(), ticks_to_wait);
     } else if (this->sink_callback_ != nullptr) {
@@ -186,7 +186,7 @@ bool AudioSinkTransferBuffer::has_buffered_data() const {
     return (this->speaker_->has_buffered_data() || (this->available() > 0));
   }
 #endif
-  if (this->ring_buffer_ != nullptr) {
+  if (this->ring_buffer_.use_count() > 0) {
     return ((this->ring_buffer_->available() > 0) || (this->available() > 0));
   }
   return (this->available() > 0);

esphome/components/esphome/ota/__init__.py

@@ -283,18 +283,10 @@ FINAL_VALIDATE_SCHEMA = ota_esphome_final_validate
 
 
 FILTER_SOURCE_FILES = filter_source_files_from_defines(
-    {
-        "ota_esphome_noise.cpp": "USE_OTA_ENCRYPTION",
-        "ota_esphome_inflate.c": "USE_OTA_DEFLATE",
-    }
+    {"ota_esphome_noise.cpp": "USE_OTA_ENCRYPTION"}
 )
 
 
-def enable_deflate() -> None:
-    """Compile the on-the-fly inflater for compressed uploads."""
-    cg.add_define("USE_OTA_DEFLATE")
-
-
 @coroutine_with_priority(CoroPriority.OTA_UPDATES)
 async def to_code(config: ConfigType) -> None:
     var = cg.new_Pvariable(config[CONF_ID])
@@ -313,10 +305,6 @@ async def to_code(config: ConfigType) -> None:
     if config.get(CONF_ALLOW_PARTITION_ACCESS):
         cg.add_define("USE_OTA_PARTITIONS")
 
-    # ESP8266 and RP2040 inflate gzip at reboot; the rest inflate on the fly
-    if not (CORE.is_esp8266 or CORE.is_rp2):
-        enable_deflate()
-
     # One key per device: an api encryption block supplies it (static or
     # runtime) and offers; the ota block only adds the requirement
     api_conf = CORE.config.get(CONF_API) or {}

esphome/components/esphome/ota/ota_esphome.cpp

@@ -22,11 +22,8 @@
 #include "esphome/core/lwip_fast_select.h"
 #endif
 
-#include <algorithm>
 #include <cerrno>
 #include <cstdio>
-#include <cstring>
-#include <new>
 #include <sys/time.h>
 
 namespace esphome {
@@ -44,12 +41,7 @@ const noise::NoiseContext &ESPHomeOTAComponent::noise_context_() const {
 #endif
 static constexpr uint16_t OTA_BLOCK_SIZE = 8192;
 static constexpr uint32_t OTA_SOCKET_TIMEOUT_HANDSHAKE = 20000;  // milliseconds for initial handshake
-// Milliseconds for data transfer. Covers the lwIP retransmit run seen in
-// practice for a lost chunk ack (1.5 + 3 + 6 + 12 + 24 + 48 s); the CLI waits
-// longer (espota2.DATA_PHASE_TIMEOUT) so the device is free before it retries
-static constexpr uint32_t OTA_SOCKET_TIMEOUT_DATA = 105000;
-static constexpr uint32_t OTA_PROGRESS_INTERVAL_MS = 1000;
-static constexpr size_t OTA_SIZE_FIELD_BYTES = 4;  // sizes on the wire are 4 bytes MSB first
+static constexpr uint32_t OTA_SOCKET_TIMEOUT_DATA = 90000;       // milliseconds for data transfer
 
 // Single-instance pointer — multi-port configs are rejected in final_validate.
 // NOLINTNEXTLINE(cppcoreguidelines-avoid-non-const-global-variables)
@@ -187,23 +179,12 @@ static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_COMPRESSION = 0x01;
 static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_SHA256_AUTH = 0x02;
 static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL = 0x04;
 static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_NOISE = 0x08;
-static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_DEFLATE = 0x10;
 // Noise needs the extended protocol: the prologue binds the 2-byte feature ack
 static constexpr uint8_t CLIENT_NOISE_FEATURES =
     CLIENT_FEATURE_SUPPORTS_NOISE | CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL;
 static constexpr uint8_t SERVER_FEATURE_SUPPORTS_COMPRESSION = 0x01;
 static constexpr uint8_t SERVER_FEATURE_SUPPORTS_PARTITION_ACCESS = 0x02;
 static constexpr uint8_t SERVER_FEATURE_SUPPORTS_NOISE = 0x04;
-// Raw deflate, window <= OTA_INFLATE_WINDOW_SIZE. Binding once offered: the
-// client must then send the image size frame and a deflate stream.
-static constexpr uint8_t SERVER_FEATURE_SUPPORTS_DEFLATE = 0x08;
-
-#ifdef USE_OTA_ENCRYPTION
-inline bool ESPHomeOTAComponent::noise_offered_() const {
-  return (this->handshake_buf_[1] & SERVER_FEATURE_SUPPORTS_NOISE) != 0 &&
-         (this->ota_features_ & CLIENT_NOISE_FEATURES) == CLIENT_NOISE_FEATURES;
-}
-#endif
 
 inline bool ESPHomeOTAComponent::extended_proto_() const {
 #ifdef USE_OTA_ENCRYPTION_REQUIRED
@@ -309,7 +290,7 @@ void ESPHomeOTAComponent::handle_handshake_() {
       this->transition_ota_state_(OTAState::FEATURE_ACK);
 
       const bool supports_compression =
-          (this->ota_features_ & CLIENT_FEATURE_SUPPORTS_COMPRESSION) != 0 && ota::OTABackend::supports_compression();
+          (this->ota_features_ & CLIENT_FEATURE_SUPPORTS_COMPRESSION) != 0 && this->backend_->supports_compression();
 
       // Compose the feature-ack response. When the client negotiates the extended protocol we emit
       // a 2-byte response (marker + server feature flags); otherwise we emit the single-byte
@@ -329,26 +310,6 @@ void ESPHomeOTAComponent::handle_handshake_() {
 #elif defined(USE_OTA_ENCRYPTION)
         // A yaml key always exists: validation rejects the all-zeros key
         this->handshake_buf_[1] |= SERVER_FEATURE_SUPPORTS_NOISE;
-#endif
-#ifdef USE_OTA_ENCRYPTION
-        // Reserve the noise session before the optional inflate buffer, so the
-        // required allocation is not starved by the compression window
-        if (this->noise_offered_()) {
-          this->noise_reserve_session_();
-        }
-#endif
-#ifdef USE_OTA_DEFLATE
-        // Offered only once the session memory is in hand; else uncompressed
-        if ((this->ota_features_ & CLIENT_FEATURE_SUPPORTS_DEFLATE) != 0) {
-          // Value initialized: a corrupt stream that back references the
-          // window before it is filled then copies zeros, never stale memory
-          this->inflate_.reset(new (std::nothrow) InflateSession());
-          if (this->inflate_ != nullptr) {
-            this->handshake_buf_[1] |= SERVER_FEATURE_SUPPORTS_DEFLATE;
-          } else {
-            ESP_LOGW(TAG, "No memory to inflate");
-          }
-        }
 #endif
       } else {
         this->handshake_buf_[0] =
@@ -367,7 +328,8 @@ void ESPHomeOTAComponent::handle_handshake_() {
 #ifdef USE_OTA_ENCRYPTION
       // Latch the offer actually sent: a key activating between the two
       // states must not start a session the client never expects
-      if (this->noise_offered_()) {
+      if ((this->handshake_buf_[1] & SERVER_FEATURE_SUPPORTS_NOISE) != 0 &&
+          (this->ota_features_ & CLIENT_NOISE_FEATURES) == CLIENT_NOISE_FEATURES) {
         // handshake_buf_ still holds the feature ack composed above; a
         // would-block re-entry lands here without rebuilding it
         if (!this->noise_start_session_(this->handshake_buf_[1])) {
@@ -465,11 +427,16 @@ void ESPHomeOTAComponent::handle_data_() {
   // Backend calls overwrite this with OK; reset to UNKNOWN before any
   // goto error that follows a successful begin()/write()
   ota::OTAResponseTypes error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN;
-  DataTransfer xfer;
+  size_t total = 0;
+  uint32_t last_progress = 0;
+  uint32_t last_data_ms = 0;
   uint8_t buf[OTA_BUFFER_SIZE];
   char *sbuf = reinterpret_cast<char *>(buf);
-  size_t image_size;
+  size_t ota_size;
   ota::OTAType ota_type = ota::OTA_TYPE_UPDATE_APP;
+#if USE_OTA_VERSION == 2
+  size_t size_acknowledged = 0;
+#endif
 
   // Set socket timeouts and blocking mode (see strategy table above)
   struct timeval tv;
@@ -492,13 +459,14 @@ void ESPHomeOTAComponent::handle_data_() {
   }
   ESP_LOGV(TAG, "OTA type is 0x%02x", ota_type);
 
-  if (!this->read_size_(buf, xfer.ota_size, LOG_STR("size")))
+  // Read size, 4 bytes MSB first
+  if (!this->data_readall_(buf, 4)) {
+    this->log_read_error_(LOG_STR("size"));
     goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
-  image_size = xfer.ota_size;
-#ifdef USE_OTA_DEFLATE
-  if (this->inflate_ != nullptr && !this->read_size_(buf, image_size, LOG_STR("image size")))
-    goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
-#endif
+  }
+  ota_size = (static_cast<size_t>(buf[0]) << 24) | (static_cast<size_t>(buf[1]) << 16) |
+             (static_cast<size_t>(buf[2]) << 8) | buf[3];
+  ESP_LOGV(TAG, "Size is %zu bytes", ota_size);
 
 #ifndef USE_OTA_PARTITIONS
   if (ota_type != ota::OTA_TYPE_UPDATE_APP) {
@@ -518,7 +486,7 @@ void ESPHomeOTAComponent::handle_data_() {
 #endif
 
   // begin() returns quickly; flash sectors are erased incrementally during write().
-  error_code = this->backend_->begin(image_size, ota_type);
+  error_code = this->backend_->begin(ota_size, ota_type);
   if (error_code != ota::OTA_RESPONSE_OK)
     goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
 
@@ -538,25 +506,75 @@ void ESPHomeOTAComponent::handle_data_() {
   // Acknowledge MD5 OK - 1 byte
   this->data_write_byte_(ota::OTA_RESPONSE_BIN_MD5_OK);
 
-  xfer.last_data_ms = millis();
-#ifdef USE_OTA_DEFLATE
-  if (this->inflate_ != nullptr) {
-    error_code = this->inflate_data_(buf, image_size, xfer);
-    if (error_code != ota::OTA_RESPONSE_OK)
+  // Track when we last received data so a silently-vanished peer (no FIN/RST
+  // delivered, e.g. uploader killed mid-transfer or NAT/router dropped state)
+  // can't wedge the device indefinitely. Without this, the loop only exits
+  // on actual data, EOF, or a non-EWOULDBLOCK error from read(), and lwIP
+  // TCP keepalive isn't enabled here.
+  last_data_ms = millis();
+  while (total < ota_size) {
+    if (millis() - last_data_ms > OTA_SOCKET_TIMEOUT_DATA) {
+      ESP_LOGW(TAG, "No data received for %u ms", (unsigned) OTA_SOCKET_TIMEOUT_DATA);
+      error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN;
       goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
-  } else
-#endif
-  {
-    while (xfer.total < xfer.ota_size) {
-      ssize_t read = this->receive_data_(buf, xfer);
-      if (read < 0) {
+    }
+    size_t remaining = ota_size - total;
+    size_t requested = remaining < OTA_BUFFER_SIZE ? remaining : OTA_BUFFER_SIZE;
+    ssize_t read;
+#ifdef USE_OTA_ENCRYPTION
+    if (this->noise_ != nullptr) {
+      // One frame per call; noise_read_data_ waits internally (readall_), so
+      // there is no would-block retry here and failures are already logged.
+      read = this->noise_read_data_(buf, requested);
+      if (read <= 0) {
         error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN;
         goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
       }
-      error_code = this->write_flash_(buf, read);
-      if (error_code != ota::OTA_RESPONSE_OK)
+    } else
+#endif
+    {
+      read = this->client_->read(buf, requested);
+      if (read == -1) {
+        const int err = errno;
+        if (this->would_block_(err)) {
+          // read() already waited up to SO_RCVTIMEO for data, just feed WDT
+          App.feed_wdt();
+          continue;
+        }
+        ESP_LOGW(TAG, "Read err %d", err);
+        error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN;
         goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
-      this->ack_written_(xfer);
+      } else if (read == 0) {
+        ESP_LOGW(TAG, "Remote closed");
+        error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN;
+        goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
+      }
+    }
+
+    last_data_ms = millis();
+    error_code = this->backend_->write(buf, read);
+    if (error_code != ota::OTA_RESPONSE_OK) {
+      ESP_LOGW(TAG, "Flash write err %d", error_code);
+      goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
+    }
+    total += read;
+#if USE_OTA_VERSION == 2
+    while (size_acknowledged + OTA_BLOCK_SIZE <= total || (total == ota_size && size_acknowledged < ota_size)) {
+      this->data_write_byte_(ota::OTA_RESPONSE_CHUNK_OK);
+      size_acknowledged += OTA_BLOCK_SIZE;
+    }
+#endif
+
+    uint32_t now = millis();
+    if (now - last_progress > 1000) {
+      last_progress = now;
+      float percentage = (total * 100.0f) / ota_size;
+      ESP_LOGD(TAG, "Progress: %0.1f%%", percentage);
+#ifdef USE_OTA_STATE_LISTENER
+      this->notify_state_(ota::OTA_IN_PROGRESS, percentage, 0);
+#endif
+      // feed watchdog and give other tasks a chance to run
+      this->yield_and_feed_watchdog_();
     }
   }
 
@@ -753,171 +771,6 @@ bool ESPHomeOTAComponent::try_write_(size_t to_write, const LogString *desc) {
   return this->handshake_buf_pos_ >= to_write;
 }
 
-bool ESPHomeOTAComponent::read_size_(uint8_t *buf, size_t &size, const LogString *desc) {
-  if (!this->data_readall_(buf, OTA_SIZE_FIELD_BYTES)) {
-    this->log_read_error_(desc);
-    return false;
-  }
-  size = encode_uint32(buf[0], buf[1], buf[2], buf[3]);
-  ESP_LOGV(TAG, "%s is %zu bytes", LOG_STR_ARG(desc), size);
-  return true;
-}
-
-ota::OTAResponseTypes ESPHomeOTAComponent::write_flash_(uint8_t *data, size_t len) {
-  ota::OTAResponseTypes result = this->backend_->write(data, len);
-  if (result != ota::OTA_RESPONSE_OK) {
-    ESP_LOGW(TAG, "Flash write err %d", result);
-  }
-  return result;
-}
-
-ssize_t ESPHomeOTAComponent::receive_data_(uint8_t *buf, DataTransfer &xfer) {
-  const size_t remaining = xfer.ota_size - xfer.total;
-  const size_t requested = std::min(remaining, OTA_BUFFER_SIZE);
-  ssize_t read;
-  for (;;) {
-    // A silently-vanished peer (no FIN/RST delivered, e.g. uploader killed
-    // mid-transfer or NAT/router dropped state) must not wedge the device:
-    // read() only fails on EOF or a real error, and lwIP TCP keepalive isn't
-    // enabled here.
-    if (millis() - xfer.last_data_ms > OTA_SOCKET_TIMEOUT_DATA) {
-      ESP_LOGW(TAG, "No data received for %u ms", (unsigned) OTA_SOCKET_TIMEOUT_DATA);
-      return -1;
-    }
-#ifdef USE_OTA_ENCRYPTION
-    if (this->noise_ != nullptr) {
-      // One frame per call; noise_read_data_ waits internally (readall_), so
-      // there is no would-block retry here and failures are already logged.
-      read = this->noise_read_data_(buf, requested);
-      if (read <= 0)
-        return -1;
-      break;
-    }
-#endif
-    read = this->client_->read(buf, requested);
-    if (read > 0)
-      break;
-    if (read == 0) {
-      this->log_remote_closed_(LOG_STR("data"));
-      return -1;
-    }
-    if (!this->would_block_(errno)) {
-      this->log_socket_error_(LOG_STR("data"));
-      return -1;
-    }
-    // read() already waited up to SO_RCVTIMEO for data, just feed WDT
-    App.feed_wdt();
-  }
-
-  const uint32_t now = millis();
-  xfer.last_data_ms = now;
-  xfer.total += read;
-  this->ack_received_(xfer);
-  if (now - xfer.last_progress > OTA_PROGRESS_INTERVAL_MS) {
-    xfer.last_progress = now;
-    float percentage = (xfer.total * 100.0f) / xfer.ota_size;
-    ESP_LOGD(TAG, "Progress: %0.1f%%", percentage);
-#ifdef USE_OTA_STATE_LISTENER
-    this->notify_state_(ota::OTA_IN_PROGRESS, percentage, 0);
-#endif
-    // feed watchdog and give other tasks a chance to run
-    this->yield_and_feed_watchdog_();
-  }
-  return read;
-}
-
-void ESPHomeOTAComponent::send_chunk_acks_(DataTransfer &xfer) {
-#if USE_OTA_VERSION == 2
-  while (xfer.acknowledged + OTA_BLOCK_SIZE <= xfer.total ||
-         (xfer.total == xfer.ota_size && xfer.acknowledged < xfer.ota_size)) {
-    this->data_write_byte_(ota::OTA_RESPONSE_CHUNK_OK);
-    xfer.acknowledged += OTA_BLOCK_SIZE;
-  }
-#endif
-}
-
-#ifdef USE_OTA_DEFLATE
-// The window doubles as the output buffer; flushed bytes stay as back
-// reference history for the next windowful.
-ota::OTAResponseTypes ESPHomeOTAComponent::inflate_flush_(InflateSession &session) {
-  const size_t produced = session.dest - session.window;
-  const size_t pending = produced - session.flushed;
-  if (pending != 0) {
-    if (pending > session.image_size - session.written) {
-      ESP_LOGW(TAG, "Inflate overrun");
-      return ota::OTA_RESPONSE_ERROR_UNKNOWN;
-    }
-    ota::OTAResponseTypes result = this->write_flash_(session.window + session.flushed, pending);
-    if (result != ota::OTA_RESPONSE_OK)
-      return result;
-    session.flushed = produced;
-    session.written += pending;
-    // A compressible region yields many windows per socket read
-    App.feed_wdt();
-  }
-  // Even with nothing new written: a block boundary can fall inside a header
-  this->ack_written_(*session.xfer);
-  return ota::OTA_RESPONSE_OK;
-}
-
-ota::OTAResponseTypes ESPHomeOTAComponent::inflate_data_(uint8_t *in, size_t image_size, DataTransfer &xfer) {
-  InflateSession &session = *this->inflate_;
-  session.self = this;
-  session.xfer = &xfer;
-  session.in = in;
-  session.image_size = image_size;
-  session.written = 0;
-  session.error = ota::OTA_RESPONSE_OK;
-  ota_inflate_init(&session, session.window, OTA_INFLATE_WINDOW_SIZE);
-  // Where the ack must follow the write, flush and ack before waiting for
-  // input, or the client waits for an ack while the decoder waits for data
-  session.source_read_cb = [](OtaInflateState *d) -> int {
-    auto *s = static_cast<InflateSession *>(d);
-    if (ACK_AFTER_WRITE) {
-      s->error = s->self->inflate_flush_(*s);
-      if (s->error != ota::OTA_RESPONSE_OK)
-        return -1;
-    }
-    // More input than announced; reported by the size check below
-    if (s->xfer->total >= s->xfer->ota_size)
-      return -1;
-    ssize_t read = s->self->receive_data_(s->in, *s->xfer);
-    if (read <= 0) {
-      // Already logged by receive_data_
-      s->error = ota::OTA_RESPONSE_ERROR_UNKNOWN;
-      return -1;
-    }
-    d->source = s->in + 1;
-    d->source_limit = s->in + read;
-    return s->in[0];
-  };
-
-  int res;
-  do {
-    // The ring index wrapped to 0 exactly when the window filled
-    session.dest = session.window;
-    session.dest_limit = session.window + OTA_INFLATE_WINDOW_SIZE;
-    session.flushed = 0;
-    res = ota_inflate(&session);
-    // A stored block keeps emitting zeros after a failed read, hence eof
-    if (res < 0 || session.eof)
-      break;
-    session.error = this->inflate_flush_(session);
-  } while (res != OTA_INFLATE_DONE && session.error == ota::OTA_RESPONSE_OK);
-
-  // Transport and flash failures are logged where they happen
-  if (session.error != ota::OTA_RESPONSE_OK)
-    return session.error;
-  if (res != OTA_INFLATE_DONE || session.written != image_size || xfer.total != xfer.ota_size) {
-    ESP_LOGW(TAG, "Inflate err %d, %zu of %zu B from %zu of %zu", res, session.written, image_size, xfer.total,
-             xfer.ota_size);
-    return ota::OTA_RESPONSE_ERROR_UNKNOWN;
-  }
-  ESP_LOGD(TAG, "Inflated %zu bytes from %zu", session.written, xfer.total);
-  return ota::OTA_RESPONSE_OK;
-}
-#endif  // USE_OTA_DEFLATE
-
 void ESPHomeOTAComponent::cleanup_connection_() {
   this->client_->close();
   this->client_ = nullptr;
@@ -931,9 +784,6 @@ void ESPHomeOTAComponent::cleanup_connection_() {
 #endif
 #ifdef USE_OTA_ENCRYPTION
   this->noise_ = nullptr;
-#endif
-#ifdef USE_OTA_DEFLATE
-  this->inflate_ = nullptr;
 #endif
   // Intentionally no disable_loop() — letting loop() run one more iteration catches
   // any connection that queued on the listener mid-session (otherwise the wake flag,

esphome/components/esphome/ota/ota_esphome.h

@@ -7,9 +7,6 @@
 #ifdef USE_OTA_ENCRYPTION
 #include "esphome/components/noise/noise_handshake.h"
 #endif
-#ifdef USE_OTA_DEFLATE
-#include "ota_esphome_inflate.h"
-#endif
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 #include "esphome/core/preferences.h"
@@ -91,9 +88,6 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
   };
   // The api server's live context when the api has encryption, else our own
   const noise::NoiseContext &noise_context_() const;
-  // True once the feature ack offers noise and the client asked for it
-  bool noise_offered_() const;
-  void noise_reserve_session_();
   bool noise_start_session_(uint8_t server_feature_flags);
   bool handle_noise_handshake_();
   bool noise_try_read_frame_();
@@ -125,38 +119,6 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
     return this->readall_(buf, len);
   }
 
-  // Upload accounting shared by the data loop and the inflate read callback
-  struct DataTransfer {
-    size_t ota_size{0};  // bytes the client sends
-    size_t total{0};     // bytes received so far
-#if USE_OTA_VERSION == 2
-    size_t acknowledged{0};
-#endif
-    uint32_t last_data_ms{0};
-    uint32_t last_progress{0};
-  };
-  // Up to OTA_BUFFER_SIZE bytes into buf; returns bytes read, -1 on failure (logged)
-  inline ssize_t receive_data_(uint8_t *buf, DataTransfer &xfer);
-  // Raw lwIP cannot service the radio during a sector write, so the ack waits
-  // for the write there; a socket task lets the next block arrive meanwhile
-#ifdef USE_SOCKET_IMPL_LWIP_TCP
-  static constexpr bool ACK_AFTER_WRITE = true;
-#else
-  static constexpr bool ACK_AFTER_WRITE = false;
-#endif
-  void send_chunk_acks_(DataTransfer &xfer);
-  inline void ack_received_(DataTransfer &xfer) {
-    if (!ACK_AFTER_WRITE)
-      this->send_chunk_acks_(xfer);
-  }
-  inline void ack_written_(DataTransfer &xfer) {
-    if (ACK_AFTER_WRITE)
-      this->send_chunk_acks_(xfer);
-  }
-  inline bool read_size_(uint8_t *buf, size_t &size, const LogString *desc);
-  // Writes to the backend and logs a failure
-  inline ota::OTAResponseTypes write_flash_(uint8_t *data, size_t len);
-
   bool try_read_(size_t to_read, const LogString *desc);
   bool try_write_(size_t to_write, const LogString *desc);
 
@@ -209,31 +171,6 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
   static_assert(OTA_BUFFER_SIZE >= NOISE_CLIENT_MAX_PLAINTEXT + noise::MAC_SIZE,
                 "OTA_BUFFER_SIZE must fit a full encrypted data frame");
 #endif
-#ifdef USE_OTA_DEFLATE
-  // At least 1 << espota2.DEFLATE_WINDOW_BITS; also the inflate output buffer
-  static constexpr size_t OTA_INFLATE_WINDOW_SIZE = 4096;
-  // Heap-allocated only while a deflate upload is negotiated; the decoder
-  // state is the base so the read callback can recover the session
-  struct InflateSession : OtaInflateState {
-    ESPHomeOTAComponent *self;
-    DataTransfer *xfer;
-    uint8_t *in;  // caller's buffer for the compressed input, valid during inflate_data_
-    size_t image_size;
-    size_t written;               // inflated bytes in flash
-    size_t flushed;               // bytes of the current window already in flash
-    ota::OTAResponseTypes error;  // first failure inside the read callback
-    uint8_t window[OTA_INFLATE_WINDOW_SIZE];
-  };
-#ifndef CLANG_TIDY  // static analysis sets every define at once
-  static_assert(!ota::OTABackend::supports_compression(),
-                "USE_OTA_DEFLATE is for backends that cannot store a gzip image");
-#endif
-  // Writes the decoded bytes not yet in flash without moving dest
-  ota::OTAResponseTypes inflate_flush_(InflateSession &session);
-  ota::OTAResponseTypes inflate_data_(uint8_t *in, size_t image_size, DataTransfer &xfer);
-  std::unique_ptr<InflateSession> inflate_;
-#endif
-
   static constexpr uint8_t MAGIC_BYTES[5] = {0x6C, 0x26, 0xF7, 0x5C, 0x45};
   // Derived from the feature byte; storing it would pad the trailing bytes
   bool extended_proto_() const;

esphome/components/esphome/ota/ota_esphome_inflate.c

@@ -1,498 +0,0 @@
-/*
- * uzlib  -  tiny deflate/inflate library (deflate, gzip, zlib)
- *
- * Copyright (c) 2003 by Joergen Ibsen / Jibz
- * All Rights Reserved
- * http://www.ibsensoftware.com/
- *
- * Copyright (c) 2014-2018 by Paul Sokolovsky
- *
- * This software is provided 'as-is', without any express
- * or implied warranty.  In no event will the authors be
- * held liable for any damages arising from the use of
- * this software.
- *
- * Permission is granted to anyone to use this software
- * for any purpose, including commercial applications,
- * and to alter it and redistribute it freely, subject to
- * the following restrictions:
- *
- * 1. The origin of this software must not be
- *    misrepresented; you must not claim that you
- *    wrote the original software. If you use this
- *    software in a product, an acknowledgment in
- *    the product documentation would be appreciated
- *    but is not required.
- *
- * 2. Altered source versions must be plainly marked
- *    as such, and must not be misrepresented as
- *    being the original software.
- *
- * 3. This notice may not be removed or altered from
- *    any source distribution.
- */
-
-/*
- * Altered for ESPHome: this is the raw deflate decoder from uzlib's
- * tinflate.c (v2.9.5) with the gzip/zlib header parsers, checksums,
- * runtime table builder and in-memory (non ring window) output path
- * removed, and the public names prefixed with ota_inflate.
- */
-
-#include "ota_esphome_inflate.h"
-
-#include <stddef.h>
-
-#define TINF_OK OTA_INFLATE_OK
-#define TINF_DONE OTA_INFLATE_DONE
-#define TINF_DATA_ERROR OTA_INFLATE_DATA_ERROR
-#define TINF_DICT_ERROR OTA_INFLATE_DICT_ERROR
-#define TINF_DATA struct OtaInflateState
-#define TINF_TREE struct OtaInflateTree
-#define TINF_ARRAY_SIZE(arr) (sizeof(arr) / sizeof(*(arr)))
-
-/* every output byte also goes into the ring window */
-#define TINF_PUT(d, c) \
-  { \
-    *d->dest++ = c; \
-    d->dict_ring[d->dict_idx++] = c; \
-    if (d->dict_idx == d->dict_size) \
-      d->dict_idx = 0; \
-  }
-
-/* --------------------------------------------------- *
- * -- constant tables (upstream builds them at runtime) -- *
- * --------------------------------------------------- */
-
-static const unsigned char LENGTH_BITS[30] = {0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2,
-                                              2, 2, 3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5};
-static const unsigned short LENGTH_BASE[30] = {3,  4,  5,  6,  7,  8,  9,  10, 11,  13,  15,  17,  19,  23, 27,
-                                               31, 35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258};
-
-static const unsigned char DIST_BITS[30] = {0, 0, 0, 0, 1, 1, 2, 2,  3,  3,  4,  4,  5,  5,  6,
-                                            6, 7, 7, 8, 8, 9, 9, 10, 10, 11, 11, 12, 12, 13, 13};
-static const unsigned short DIST_BASE[30] = {1,    2,    3,    4,    5,    7,    9,    13,    17,    25,
-                                             33,   49,   65,   97,   129,  193,  257,  385,   513,   769,
-                                             1025, 1537, 2049, 3073, 4097, 6145, 8193, 12289, 16385, 24577};
-
-/* special ordering of code length codes */
-static const unsigned char CLCIDX[] = {16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15};
-
-/* ----------------------- *
- * -- utility functions -- *
- * ----------------------- */
-
-/* given an array of code lengths, build a tree */
-static void tinf_build_tree(TINF_TREE *t, const unsigned char *lengths, unsigned int num) {
-  unsigned short offs[16];
-  unsigned int i, sum;
-
-  /* clear code length count table */
-  for (i = 0; i < 16; ++i)
-    t->table[i] = 0;
-
-  /* scan symbol lengths, and sum code length counts */
-  for (i = 0; i < num; ++i)
-    t->table[lengths[i]]++;
-
-  /* In the lengths array, 0 means unused code. So, t->table[0] now contains
-     number of unused codes. But table's purpose is to contain # of codes of
-     particular length, and there're 0 codes of length 0. */
-  t->table[0] = 0;
-
-  /* compute offset table for distribution sort */
-  for (sum = 0, i = 0; i < 16; ++i) {
-    offs[i] = sum;
-    sum += t->table[i];
-  }
-
-  /* create code->symbol translation table (symbols sorted by code) */
-  for (i = 0; i < num; ++i) {
-    if (lengths[i])
-      t->trans[offs[lengths[i]]++] = i;
-  }
-}
-
-/* ---------------------- *
- * -- decode functions -- *
- * ---------------------- */
-
-static unsigned char uzlib_get_byte(TINF_DATA *d) {
-  /* If end of source buffer is not reached, return next byte from source
-     buffer. */
-  if (d->source < d->source_limit) {
-    return *d->source++;
-  }
-
-  /* Otherwise if there's callback and we haven't seen EOF yet, try to
-     read next byte using it. (Note: the callback can also update ->source
-     and ->source_limit). */
-  if (!d->eof) {
-    int val = d->source_read_cb(d);
-    if (val >= 0) {
-      return (unsigned char) val;
-    }
-  }
-
-  /* Otherwise, we hit EOF (either from ->source_read_cb() or from exhaustion
-     of the buffer), and it will be "sticky", i.e. further calls to this
-     function will end up here too. */
-  d->eof = true;
-
-  return 0;
-}
-
-/* get one bit from source stream */
-static int tinf_getbit(TINF_DATA *d) {
-  unsigned int bit;
-
-  /* check if tag is empty */
-  if (!d->bitcount--) {
-    /* load next tag */
-    d->tag = uzlib_get_byte(d);
-    d->bitcount = 7;
-  }
-
-  /* shift bit out of tag */
-  bit = d->tag & 0x01;
-  d->tag >>= 1;
-
-  return bit;
-}
-
-/* read a num bit value from a stream and add base */
-static unsigned int tinf_read_bits(TINF_DATA *d, int num, int base) {
-  unsigned int val = 0;
-
-  /* read num bits */
-  if (num) {
-    unsigned int limit = 1 << (num);
-    unsigned int mask;
-
-    for (mask = 1; mask < limit; mask *= 2)
-      if (tinf_getbit(d))
-        val += mask;
-  }
-
-  return val + base;
-}
-
-/* given a data stream and a tree, decode a symbol */
-static int tinf_decode_symbol(TINF_DATA *d, TINF_TREE *t) {
-  int sum = 0, cur = 0, len = 0;
-
-  /* get more bits while code value is above sum */
-  do {
-    cur = 2 * cur + tinf_getbit(d);
-
-    if (++len == TINF_ARRAY_SIZE(t->table)) {
-      return TINF_DATA_ERROR;
-    }
-
-    sum += t->table[len];
-    cur -= t->table[len];
-
-  } while (cur >= 0);
-
-  sum += cur;
-  if (sum < 0 || sum >= t->size) {
-    return TINF_DATA_ERROR;
-  }
-
-  return t->trans[sum];
-}
-
-/* given a data stream, decode dynamic trees from it */
-static int tinf_decode_trees(TINF_DATA *d, TINF_TREE *lt, TINF_TREE *dt) {
-  /* code lengths for 288 literal/len symbols and 32 dist symbols */
-  unsigned char lengths[288 + 32];
-  unsigned int hlit, hdist, hclen, hlimit;
-  unsigned int i, num, length;
-
-  /* get 5 bits HLIT (257-286) */
-  hlit = tinf_read_bits(d, 5, 257);
-
-  /* get 5 bits HDIST (1-32) */
-  hdist = tinf_read_bits(d, 5, 1);
-
-  /* get 4 bits HCLEN (4-19) */
-  hclen = tinf_read_bits(d, 4, 4);
-
-  for (i = 0; i < 19; ++i)
-    lengths[i] = 0;
-
-  /* read code lengths for code length alphabet */
-  for (i = 0; i < hclen; ++i) {
-    /* get 3 bits code length (0-7) */
-    unsigned int clen = tinf_read_bits(d, 3, 0);
-
-    lengths[CLCIDX[i]] = clen;
-  }
-
-  /* build code length tree, temporarily use length tree */
-  tinf_build_tree(lt, lengths, 19);
-
-  /* decode code lengths for the dynamic trees */
-  hlimit = hlit + hdist;
-  for (num = 0; num < hlimit;) {
-    int sym = tinf_decode_symbol(d, lt);
-    unsigned char fill_value = 0;
-    int lbits, lbase = 3;
-
-    /* error decoding */
-    if (sym < 0)
-      return sym;
-
-    switch (sym) {
-      case 16:
-        /* copy previous code length 3-6 times (read 2 bits) */
-        if (num == 0)
-          return TINF_DATA_ERROR;
-        fill_value = lengths[num - 1];
-        lbits = 2;
-        break;
-      case 17:
-        /* repeat code length 0 for 3-10 times (read 3 bits) */
-        lbits = 3;
-        break;
-      case 18:
-        /* repeat code length 0 for 11-138 times (read 7 bits) */
-        lbits = 7;
-        lbase = 11;
-        break;
-      default:
-        /* values 0-15 represent the actual code lengths */
-        lengths[num++] = sym;
-        /* continue the for loop */
-        continue;
-    }
-
-    /* special code length 16-18 are handled here */
-    length = tinf_read_bits(d, lbits, lbase);
-    if (num + length > hlimit)
-      return TINF_DATA_ERROR;
-    for (; length; --length) {
-      lengths[num++] = fill_value;
-    }
-  }
-
-  /* Check that there's "end of block" symbol */
-  if (lengths[256] == 0) {
-    return TINF_DATA_ERROR;
-  }
-
-  /* build dynamic trees */
-  tinf_build_tree(lt, lengths, hlit);
-  tinf_build_tree(dt, lengths + hlit, hdist);
-
-  return TINF_OK;
-}
-
-/* build the fixed huffman trees (RFC 1951 3.2.6) through the generic tree
-   builder; altered from upstream, which unrolls them by hand */
-static void tinf_build_fixed_trees(TINF_TREE *lt, TINF_TREE *dt) {
-  unsigned char lengths[288];
-  unsigned int i;
-
-  for (i = 0; i < 144; ++i)
-    lengths[i] = 8;
-  for (; i < 256; ++i)
-    lengths[i] = 9;
-  for (; i < 280; ++i)
-    lengths[i] = 7;
-  for (; i < 288; ++i)
-    lengths[i] = 8;
-  tinf_build_tree(lt, lengths, 288);
-
-  for (i = 0; i < 32; ++i)
-    lengths[i] = 5;
-  tinf_build_tree(dt, lengths, 32);
-}
-
-/* ----------------------------- *
- * -- block inflate functions -- *
- * ----------------------------- */
-
-/* given a stream and two trees, inflate next chunk of output (a byte or more) */
-static int tinf_inflate_block_data(TINF_DATA *d, TINF_TREE *lt, TINF_TREE *dt) {
-  if (d->curlen == 0) {
-    unsigned int offs;
-    int dist;
-    int sym = tinf_decode_symbol(d, lt);
-
-    if (d->eof) {
-      return TINF_DATA_ERROR;
-    }
-
-    if (sym < 0) {
-      return sym;
-    }
-
-    /* literal byte */
-    if (sym < 256) {
-      TINF_PUT(d, sym);
-      return TINF_OK;
-    }
-
-    /* end of block */
-    if (sym == 256) {
-      return TINF_DONE;
-    }
-
-    /* substring from sliding dictionary */
-    sym -= 257;
-    if (sym >= 29) {
-      return TINF_DATA_ERROR;
-    }
-
-    /* possibly get more bits from length code */
-    d->curlen = tinf_read_bits(d, LENGTH_BITS[sym], LENGTH_BASE[sym]);
-
-    dist = tinf_decode_symbol(d, dt);
-    if (dist < 0 || dist >= 30) {
-      return TINF_DATA_ERROR;
-    }
-
-    /* possibly get more bits from distance code */
-    offs = tinf_read_bits(d, DIST_BITS[dist], DIST_BASE[dist]);
-
-    /* calculate and validate actual LZ offset to use */
-    if (offs > d->dict_size) {
-      return TINF_DICT_ERROR;
-    }
-    /* Note: we don't try to catch offset which points to not yet filled
-       part of the dictionary here. Doing so would require keeping another
-       variable to track "filled in" size of the dictionary. Appearance of
-       such an offset cannot lead to accessing memory outside of the
-       dictionary buffer, and clients which don't want to leak unrelated
-       information, should explicitly initialize dictionary buffer passed
-       to uzlib. */
-
-    d->lz_off = d->dict_idx - offs;
-    if (d->lz_off < 0) {
-      d->lz_off += d->dict_size;
-    }
-  }
-
-  /* copy next byte from dict substring */
-  TINF_PUT(d, d->dict_ring[d->lz_off]);
-  if ((unsigned) ++d->lz_off == d->dict_size) {
-    d->lz_off = 0;
-  }
-  d->curlen--;
-  return TINF_OK;
-}
-
-/* inflate next byte from uncompressed block of data */
-static int tinf_inflate_uncompressed_block(TINF_DATA *d) {
-  if (d->curlen == 0) {
-    unsigned int length, invlength;
-
-    /* get length */
-    length = uzlib_get_byte(d);
-    length += 256 * uzlib_get_byte(d);
-    /* get one's complement of length */
-    invlength = uzlib_get_byte(d);
-    invlength += 256 * uzlib_get_byte(d);
-    /* check length */
-    if (length != (~invlength & 0x0000ffff))
-      return TINF_DATA_ERROR;
-
-    /* increment length to properly return TINF_DONE below, without
-       producing data at the same time */
-    d->curlen = length + 1;
-
-    /* make sure we start next block on a byte boundary */
-    d->bitcount = 0;
-  }
-
-  if (--d->curlen == 0) {
-    return TINF_DONE;
-  }
-
-  unsigned char c = uzlib_get_byte(d);
-  TINF_PUT(d, c);
-  return TINF_OK;
-}
-
-/* ---------------------- *
- * -- public functions -- *
- * ---------------------- */
-
-/* initialize decompression structure */
-void ota_inflate_init(TINF_DATA *d, unsigned char *dict, unsigned int dict_len) {
-  d->source = NULL;
-  d->source_limit = NULL;
-  d->tag = 0;
-  d->eof = 0;
-  d->bitcount = 0;
-  d->lz_off = 0;
-  d->bfinal = 0;
-  d->btype = -1;
-  d->dict_size = dict_len;
-  d->dict_ring = dict;
-  d->dict_idx = 0;
-  d->curlen = 0;
-  d->ltree.trans = d->ltrans;
-  d->ltree.size = TINF_ARRAY_SIZE(d->ltrans);
-  d->dtree.trans = d->dtrans;
-  d->dtree.size = TINF_ARRAY_SIZE(d->dtrans);
-}
-
-/* inflate next output bytes from compressed stream */
-int ota_inflate(TINF_DATA *d) {
-  do {
-    int res;
-
-    /* start a new block */
-    if (d->btype == -1) {
-      int old_btype;
-    next_blk:
-      old_btype = d->btype;
-      /* read final block flag */
-      d->bfinal = tinf_getbit(d);
-      /* read block type (2 bits) */
-      d->btype = tinf_read_bits(d, 2, 0);
-
-      if (d->btype == 1 && old_btype != 1) {
-        /* build fixed huffman trees */
-        tinf_build_fixed_trees(&d->ltree, &d->dtree);
-      } else if (d->btype == 2) {
-        /* decode trees from stream */
-        res = tinf_decode_trees(d, &d->ltree, &d->dtree);
-        if (res != TINF_OK) {
-          return res;
-        }
-      }
-    }
-
-    /* process current block */
-    switch (d->btype) {
-      case 0:
-        /* decompress uncompressed block */
-        res = tinf_inflate_uncompressed_block(d);
-        break;
-      case 1:
-      case 2:
-        /* decompress block with fixed/dynamic huffman trees */
-        /* trees were decoded previously, so it's the same routine for both */
-        res = tinf_inflate_block_data(d, &d->ltree, &d->dtree);
-        break;
-      default:
-        return TINF_DATA_ERROR;
-    }
-
-    if (res == TINF_DONE && !d->bfinal) {
-      /* the block has ended (without producing more data), but we
-         can't return without data, so start procesing next block */
-      goto next_blk;
-    }
-
-    if (res != TINF_OK) {
-      return res;
-    }
-
-  } while (d->dest < d->dest_limit);
-
-  return TINF_OK;
-}

esphome/components/esphome/ota/ota_esphome_inflate.h

@@ -1,66 +0,0 @@
-#pragma once
-// Raw deflate decoder cut down from uzlib (https://github.com/pfalcon/uzlib,
-// zlib licence, see the .c file); output goes through a ring window.
-
-#include <stdbool.h>
-#include <stdint.h>
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-enum OtaInflateResult {
-  OTA_INFLATE_OK = 0,   /* more data produced, call again */
-  OTA_INFLATE_DONE = 1, /* end of compressed stream reached */
-  OTA_INFLATE_DATA_ERROR = -3,
-  OTA_INFLATE_DICT_ERROR = -5,
-};
-
-struct OtaInflateTree {
-  uint16_t table[16]; /* table of code length counts */
-  uint16_t *trans;    /* code -> symbol translation table, size entries */
-  uint16_t size;
-};
-
-struct OtaInflateState {
-  /* Next byte in the input buffer and one past its end */
-  const unsigned char *source;
-  const unsigned char *source_limit;
-  /* Called when source is exhausted; returns the next byte or -1 at EOF.
-     It may refill source/source_limit for buffered operation. */
-  int (*source_read_cb)(struct OtaInflateState *d);
-
-  unsigned int tag;
-  unsigned int bitcount;
-
-  /* Output cursor and one past the end of the output buffer */
-  unsigned char *dest;
-  unsigned char *dest_limit;
-
-  bool eof;
-
-  int btype;
-  int bfinal;
-  unsigned int curlen;
-  int lz_off;
-  /* Ring window holding the last dict_size output bytes for back references */
-  unsigned char *dict_ring;
-  unsigned int dict_size;
-  unsigned int dict_idx;
-
-  struct OtaInflateTree ltree; /* dynamic length/symbol tree */
-  struct OtaInflateTree dtree; /* dynamic distance tree */
-  uint16_t ltrans[288];
-  uint16_t dtrans[32]; /* the distance alphabet has 30 symbols, so the tree is kept small */
-};
-
-/* dict must cover the encoder's window (its largest back reference) */
-void ota_inflate_init(struct OtaInflateState *d, unsigned char *dict, unsigned int dict_len);
-/* Fills dest up to dest_limit (OK) or to the end of the stream (DONE). dest may
-   alias dict only if dest_limit - dest == dict_len and dest is reset to dict
-   exactly when a call returns OK, so the ring index and dest stay in lockstep */
-int ota_inflate(struct OtaInflateState *d);
-
-#ifdef __cplusplus
-}
-#endif

esphome/components/esphome/ota/ota_esphome_noise.cpp

@@ -33,13 +33,7 @@ ESPHomeOTAComponent::NoiseSession::~NoiseSession() {
   }
 }
 
-void ESPHomeOTAComponent::noise_reserve_session_() {
-  // Default-init: the frame buffer is written before it is read
-  // NOLINTNEXTLINE(clang-analyzer-cplusplus.NewDeleteLeaks)
-  this->noise_ = std::unique_ptr<NoiseSession>(new (std::nothrow) NoiseSession);
-}
-
-/** Start the responder handshake, on the session reserved at offer time.
+/** Allocate the session and start the responder handshake.
  *
  * The prologue binds the whole plaintext preamble, so any tampering with the
  * negotiation (a stripped feature flag, a changed version) breaks the first
@@ -48,7 +42,10 @@ void ESPHomeOTAComponent::noise_reserve_session_() {
  */
 bool ESPHomeOTAComponent::noise_start_session_(uint8_t server_feature_flags) {
   // A provisioned key cleared between the offer and here is not guarded: the
-  // session runs on the zero key load_psk fills in and fails the client's MAC
+  // session runs on the zero key load_psk fills in and fails the client's MAC.
+  // Default-init: the frame buffer is written before it is read
+  // NOLINTNEXTLINE(clang-analyzer-cplusplus.NewDeleteLeaks)
+  this->noise_ = std::unique_ptr<NoiseSession>(new (std::nothrow) NoiseSession);
   static constexpr size_t PROLOGUE_ACK_LEN = 2;  // OTA_RESPONSE_OK + version
   static constexpr size_t PROLOGUE_CLIENT_FEATURES_LEN = 1;
   static constexpr size_t PROLOGUE_FEATURE_ACK_LEN = 2;  // OTA_RESPONSE_FEATURE_FLAGS + server flags

esphome/components/i2s_audio/speaker/i2s_audio_speaker.cpp

@@ -118,24 +118,21 @@ void I2SAudioSpeakerBase::loop() {
         break;
       }
 
-      // Still starting up or winding down from a previous run
-      if ((this->tx_handle_ != nullptr) || (this->speaker_task_handle_ != nullptr)) {
-        break;
-      }
-
       if (this->start_i2s_driver(this->audio_stream_info_) != ESP_OK) {
         ESP_LOGE(TAG, "Driver failed to start; retrying in 1 second");
         this->status_momentary_error("driver-failure", 1000);
         break;
       }
 
-      xTaskCreate(I2SAudioSpeakerBase::speaker_task, "speaker_task", TASK_STACK_SIZE, (void *) this, TASK_PRIORITY,
-                  &this->speaker_task_handle_);
-
       if (this->speaker_task_handle_ == nullptr) {
-        ESP_LOGE(TAG, "Task failed to start, retrying in 1 second");
-        this->status_momentary_error("task-failure", 1000);
-        this->stop_i2s_driver_();  // Stops the driver to return the lock; will be reloaded in next attempt
+        xTaskCreate(I2SAudioSpeakerBase::speaker_task, "speaker_task", TASK_STACK_SIZE, (void *) this, TASK_PRIORITY,
+                    &this->speaker_task_handle_);
+
+        if (this->speaker_task_handle_ == nullptr) {
+          ESP_LOGE(TAG, "Task failed to start, retrying in 1 second");
+          this->status_momentary_error("task-failure", 1000);
+          this->stop_i2s_driver_();  // Stops the driver to return the lock; will be reloaded in next attempt
+        }
       }
       break;
     case speaker::STATE_RUNNING:   // Intentional fallthrough
@@ -221,8 +218,8 @@ size_t I2SAudioSpeakerBase::play(const uint8_t *data, size_t length, TickType_t
 }
 
 bool I2SAudioSpeakerBase::has_buffered_data() const {
-  std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = this->audio_ring_buffer_.lock();
-  if (temp_ring_buffer != nullptr) {
+  if (this->audio_ring_buffer_.use_count() > 0) {
+    std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = this->audio_ring_buffer_.lock();
     return temp_ring_buffer->available() > 0;
   }
   return false;

esphome/components/micro_wake_word/micro_wake_word.cpp

@@ -129,7 +129,7 @@ void MicroWakeWord::setup() {
       return;
     }
     std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = this->ring_buffer_.lock();
-    if (temp_ring_buffer != nullptr) {
+    if (this->ring_buffer_.use_count() > 1) {
       // Producer-only write: never touches consumer state. If the buffer is full, ask the inference task
       // to drain it - reset() is a consumer operation and must run on the inference task's thread.
       // Disable partial writes so audio chunks are either fully accepted or rejected and handled below.
@@ -446,9 +446,9 @@ void MicroWakeWord::loop() {
     xEventGroupClearBits(this->event_group_, EventGroupBits::TASK_STOPPING);
   }
 
-  // Retries on a subsequent loop if the task is still running on the other core
-  if ((event_group_bits & EventGroupBits::TASK_STOPPED) && this->inference_task_.deallocate()) {
+  if ((event_group_bits & EventGroupBits::TASK_STOPPED)) {
     ESP_LOGD(TAG, "Inference task is finished, freeing task resources");
+    this->inference_task_.deallocate();
     xEventGroupClearBits(this->event_group_, ALL_BITS);
     xQueueReset(this->detection_queue_);
     this->set_state_(State::STOPPED);

esphome/components/microphone/microphone_source.h

@@ -48,7 +48,7 @@ class MicrophoneSource final {
   template<typename F> void add_data_callback(F &&data_callback) {
     this->mic_->add_data_callback([this, data_callback](const std::vector<uint8_t> &data) {
       if (this->enabled_ || this->passive_) {
-        if (this->processed_samples_ == nullptr) {
+        if (this->processed_samples_.use_count() == 0) {
           // Create vector if its unused
           this->processed_samples_ = std::make_shared<std::vector<uint8_t>>();
         }

esphome/components/mixer/speaker/mixer_speaker.cpp

@@ -218,7 +218,7 @@ size_t SourceSpeaker::play(const uint8_t *data, size_t length, TickType_t ticks_
   }
   size_t bytes_written = 0;
   std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = this->ring_buffer_.lock();
-  if (temp_ring_buffer != nullptr) {
+  if (temp_ring_buffer.use_count() > 0) {
     // Only write to the ring buffer if the reference is valid
     bytes_written = temp_ring_buffer->write_without_replacement(data, length, ticks_to_wait);
     if (bytes_written > 0) {
@@ -250,14 +250,14 @@ esp_err_t SourceSpeaker::start_() {
   // avoids unnecessary single-frame splices.
   const size_t ring_buffer_size =
       (this->audio_stream_info_.ms_to_bytes(this->buffer_duration_ms_) / bytes_per_frame) * bytes_per_frame;
-  if (this->audio_source_ == nullptr) {
+  if (this->audio_source_.use_count() == 0) {
     std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = this->ring_buffer_.lock();
-    if (temp_ring_buffer == nullptr) {
+    if (!temp_ring_buffer) {
       temp_ring_buffer = ring_buffer::RingBuffer::create(ring_buffer_size);
       this->ring_buffer_ = temp_ring_buffer;
     }
 
-    if (temp_ring_buffer == nullptr) {
+    if (!temp_ring_buffer) {
       return ESP_ERR_NO_MEM;
     }
 
@@ -278,7 +278,7 @@ void SourceSpeaker::stop() { this->send_command_(SOURCE_SPEAKER_COMMAND_STOP); }
 void SourceSpeaker::finish() { this->send_command_(SOURCE_SPEAKER_COMMAND_FINISH); }
 
 bool SourceSpeaker::has_buffered_data() const {
-  return ((this->audio_source_ != nullptr) && this->audio_source_->has_buffered_data());
+  return ((this->audio_source_.use_count() > 0) && this->audio_source_->has_buffered_data());
 }
 
 void SourceSpeaker::set_mute_state(bool mute_state) {
@@ -382,8 +382,8 @@ void MixerSpeaker::loop() {
     ESP_LOGV(TAG, "Stopping");
     xEventGroupClearBits(this->event_group_, MIXER_TASK_STATE_STOPPING);
   }
-  // Retries on a subsequent loop if the task is still running on the other core
-  if ((event_group_bits & MIXER_TASK_STATE_STOPPED) && this->task_.deallocate()) {
+  if (event_group_bits & MIXER_TASK_STATE_STOPPED) {
+    this->task_.deallocate();
     ESP_LOGD(TAG, "Stopped");
     xEventGroupClearBits(this->event_group_, MIXER_TASK_ALL_BITS);
     this->all_stopped_since_ms_ = 0;
@@ -496,7 +496,7 @@ void MixerSpeaker::audio_mixer_task(void *params) {
         if (speaker->is_running() && !speaker->get_pause_state()) {
           // Speaker is running and not paused, so it possibly can provide audio data
           std::shared_ptr<audio::RingBufferAudioSource> audio_source = speaker->get_audio_source().lock();
-          if (audio_source == nullptr) {
+          if (audio_source.use_count() == 0) {
             // No audio source allocated, so skip processing this speaker
             continue;
           }

esphome/components/noise/__init__.py

@@ -88,12 +88,12 @@ def encryption_schema(config: ConfigType | None) -> ConfigType:
 
 async def to_code(config: ConfigType) -> None:
     cg.add_define("USE_NOISE")
-    cg.add_library("esphome/noise-c", "0.1.26")
+    cg.add_library("esphome/noise-c", "0.1.24")
     # noise-c depends on libsodium, but declaring it here too lets the
     # library manager see the full set up front instead of discovering
     # libsodium only after noise-c has downloaded, so the two can download
     # in parallel. The version must match noise-c's library.json.
-    cg.add_library("esphome/libsodium", "1.10021.8")
+    cg.add_library("esphome/libsodium", "1.10021.6")
     # Enable optimized memzero/memcmp in libsodium instead of volatile byte loops
     cg.add_build_flag("-DHAVE_WEAK_SYMBOLS=1")
     cg.add_build_flag("-DHAVE_INLINE_ASM=1")

esphome/components/noise/noise.h

@@ -6,6 +6,8 @@
 #include <cstdint>
 #include "esphome/core/log.h"
 
+#include "noise_resume.h"
+
 namespace esphome::noise {
 
 using psk_t = std::array<uint8_t, 32>;
@@ -26,13 +28,19 @@ class NoiseContext {
   /// psk points at 32 bytes that outlive the context (PROGMEM or caller owned
   /// RAM); nullptr means no key. Runtime callers map the all-zeros key to
   /// nullptr themselves; validation keeps it out of yaml.
-  void set_psk(const uint8_t *psk) { this->psk_ = psk; }
+  void set_psk(const uint8_t *psk) {
+    this->psk_ = psk;
+    // Resume tickets were minted under the old key; forget them
+    this->resume_cache_.clear();
+  }
   /// Copy the key out (flash-aware on ESP8266); all zeros when none is set.
   void load_psk(psk_t &out) const;
   bool has_psk() const { return this->psk_ != nullptr; }
+  ResumeTicketCache &resume_cache() { return this->resume_cache_; }
 
  protected:
   const uint8_t *psk_{nullptr};
+  ResumeTicketCache resume_cache_;
 };
 
 /// Convert a noise error code to a readable error

esphome/components/noise/noise_resume.cpp

@@ -0,0 +1,127 @@
+#include "noise_resume.h"
+#ifdef USE_NOISE
+#include <cstring>
+
+#include <noise/protocol.h>
+
+#include "esphome/core/hal.h"
+#include "esphome/core/helpers.h"
+
+namespace esphome::noise {
+
+const char RESUME_LABEL_OFFER[6] PROGMEM = "offer";
+const char RESUME_LABEL_CONFIRM[8] PROGMEM = "confirm";
+const char RESUME_LABEL_KEYS[5] PROGMEM = "keys";
+bool resume_kdf(const uint8_t *secret, const char *label, size_t label_len, const uint8_t *a, size_t a_len,
+                const uint8_t *b, size_t b_len, const uint8_t *hash_in, size_t hash_in_len, uint8_t *out1,
+                size_t out1_len, uint8_t *out2) {
+  uint8_t data[RESUME_KDF_MAX_DATA];
+  uint8_t scratch[32];
+  size_t len = label_len + a_len + b_len;
+  progmem_memcpy(data, label, label_len);
+  std::memcpy(data + label_len, a, a_len);
+  std::memcpy(data + label_len + a_len, b, b_len);
+  NoiseHashState *hash = nullptr;
+  if (noise_hashstate_new_by_id(&hash, NOISE_HASH_SHA256) != NOISE_ERROR_NONE) {
+    return false;
+  }
+  int err = NOISE_ERROR_NONE;
+  if (hash_in != nullptr) {
+    err = noise_hashstate_hash_one(hash, hash_in, hash_in_len, data + len, 32);
+    len += 32;
+  }
+  if (err == NOISE_ERROR_NONE) {
+    err = noise_hashstate_hkdf(hash, secret, RESUME_SECRET_SIZE, data, len, out1, out1_len,
+                               out2 != nullptr ? out2 : scratch, 32);
+  }
+  noise_hashstate_free(hash);
+  noise_clean(data, sizeof(data));
+  noise_clean(scratch, sizeof(scratch));
+  return err == NOISE_ERROR_NONE;
+}
+
+bool ResumeTicketCache::issue(ResumeTicket &out) {
+  if (!random_bytes(reinterpret_cast<uint8_t *>(&out), sizeof(out))) {
+    return false;
+  }
+  uint8_t slot = this->next_;
+  this->next_ = static_cast<uint8_t>((slot + 1) % SLOTS);
+  this->slots_[slot] = out;
+  this->used_mask_ |= static_cast<uint8_t>(1u << slot);
+  return true;
+}
+
+size_t ResumeTicketCache::try_accept(const uint8_t *offer, size_t offer_len, const uint8_t *prologue,
+                                     size_t prologue_len, uint8_t *out_ext, size_t out_capacity,
+                                     NoiseCipherState *&send_cipher, NoiseCipherState *&recv_cipher) {
+  if (offer_len != RESUME_OFFER_SIZE || offer[0] != RESUME_OFFER_VERSION || out_capacity < RESUME_ACCEPT_SIZE) {
+    return 0;
+  }
+  const uint8_t *session_id = offer + RESUME_OFFER_SESSION_ID_OFFSET;
+  const uint8_t *client_nonce = offer + RESUME_OFFER_NONCE_OFFSET;
+  ResumeTicket *ticket = nullptr;
+  for (uint8_t i = 0; i < SLOTS; i++) {
+    if ((this->used_mask_ & (1u << i)) &&
+        std::memcmp(this->slots_[i].session_id, session_id, RESUME_SESSION_ID_SIZE) == 0) {
+      ticket = &this->slots_[i];
+      this->used_mask_ &= static_cast<uint8_t>(~(1u << i));
+      break;
+    }
+  }
+  if (ticket == nullptr) {
+    return 0;
+  }
+  uint8_t expected[RESUME_MAC_SIZE];
+  bool ok = resume_compute_offer_mac(ticket->secret, session_id, client_nonce, expected) &&
+            noise_is_equal(expected, offer + RESUME_OFFER_MAC_OFFSET, RESUME_MAC_SIZE);
+  noise_clean(expected, sizeof(expected));
+  if (!ok) {
+    // Bad MAC: keep the ticket so a forger cannot burn it
+    this->used_mask_ |= static_cast<uint8_t>(1u << static_cast<uint8_t>(ticket - this->slots_));
+    return 0;
+  }
+  // The ticket is spent from here; any later failure falls back to the full
+  // handshake and the client gets a fresh one.
+  uint8_t *server_nonce = out_ext + 1;
+  uint8_t k_c2d[32];
+  uint8_t k_d2c[32];
+  out_ext[0] = RESUME_ACCEPT_VERSION;
+  ok = random_bytes(server_nonce, RESUME_NONCE_SIZE) &&
+       resume_compute_confirm_mac(ticket->secret, client_nonce, server_nonce, out_ext + 1 + RESUME_NONCE_SIZE) &&
+       resume_derive_keys(ticket->secret, client_nonce, server_nonce, prologue, prologue_len, k_c2d, k_d2c);
+  noise_clean(ticket, sizeof(*ticket));
+  if (ok) {
+    recv_cipher = resume_make_cipher(k_c2d);
+    send_cipher = resume_make_cipher(k_d2c);
+    ok = recv_cipher != nullptr && send_cipher != nullptr;
+    if (!ok) {
+      noise_cipherstate_free(recv_cipher);
+      noise_cipherstate_free(send_cipher);
+      recv_cipher = nullptr;
+      send_cipher = nullptr;
+    }
+  }
+  noise_clean(k_c2d, sizeof(k_c2d));
+  noise_clean(k_d2c, sizeof(k_d2c));
+  return ok ? RESUME_ACCEPT_SIZE : 0;
+}
+
+void ResumeTicketCache::clear() {
+  noise_clean(this->slots_, sizeof(this->slots_));
+  this->used_mask_ = 0;
+}
+
+NoiseCipherState *resume_make_cipher(const uint8_t *key) {
+  NoiseCipherState *cipher = nullptr;
+  if (noise_cipherstate_new_by_id(&cipher, NOISE_CIPHER_CHACHAPOLY) != NOISE_ERROR_NONE) {
+    return nullptr;
+  }
+  if (noise_cipherstate_init_key(cipher, key, 32) != NOISE_ERROR_NONE) {
+    noise_cipherstate_free(cipher);
+    return nullptr;
+  }
+  return cipher;
+}
+
+}  // namespace esphome::noise
+#endif  // USE_NOISE

esphome/components/noise/noise_resume.h

@@ -0,0 +1,132 @@
+#pragma once
+#include "esphome/core/defines.h"
+#ifdef USE_NOISE
+#include <cstddef>
+#include <cstdint>
+
+// Forward declaration matching <noise/protocol/cipherstate.h>; keeps noise-c
+// headers out of everything that includes noise.h.
+extern "C" {
+typedef struct NoiseCipherState_s NoiseCipherState;  // NOLINT(modernize-use-using)
+}
+
+namespace esphome::noise {
+
+/** Session resume for the noise transports.
+ *
+ * After a full handshake the responder issues a single-use ticket over the
+ * encrypted channel. A client presents it in its next ClientHello and both
+ * sides derive the transport keys with HKDF-SHA256 alone, skipping the two
+ * curve25519 operations. Old peers ignore the extension bytes on both
+ * sides, so every mismatch degrades to a normal full handshake.
+ *
+ * HKDF is the Noise construction (noise_hashstate_hkdf). Derivations:
+ *   offer_mac   = HKDF(secret, "offer"   || session_id || client_nonce).out1[:16]
+ *   confirm_mac = HKDF(secret, "confirm" || client_nonce || server_nonce).out1[:16]
+ *   k_c2d, k_d2c = HKDF(secret, "keys" || client_nonce || server_nonce || SHA256(prologue))
+ *
+ * An offering client sends handshake message 1 only after a decline.
+ * Resumed sessions have no ephemeral DH; the ticket is wiped on use.
+ */
+
+static constexpr uint8_t RESUME_OFFER_VERSION = 0x01;
+static constexpr uint8_t RESUME_ACCEPT_VERSION = 0x01;
+static constexpr size_t RESUME_SESSION_ID_SIZE = 8;
+static constexpr size_t RESUME_NONCE_SIZE = 16;
+static constexpr size_t RESUME_MAC_SIZE = 16;
+static constexpr size_t RESUME_SECRET_SIZE = 32;
+
+// ClientHello body: version | session_id | client_nonce | offer_mac
+static constexpr size_t RESUME_OFFER_SIZE = 1 + RESUME_SESSION_ID_SIZE + RESUME_NONCE_SIZE + RESUME_MAC_SIZE;  // 41
+static constexpr size_t RESUME_OFFER_SESSION_ID_OFFSET = 1;
+static constexpr size_t RESUME_OFFER_NONCE_OFFSET = RESUME_OFFER_SESSION_ID_OFFSET + RESUME_SESSION_ID_SIZE;
+static constexpr size_t RESUME_OFFER_MAC_OFFSET = RESUME_OFFER_NONCE_OFFSET + RESUME_NONCE_SIZE;
+
+// ServerHello trailing extension: version | server_nonce | confirm_mac
+static constexpr size_t RESUME_ACCEPT_SIZE = 1 + RESUME_NONCE_SIZE + RESUME_MAC_SIZE;  // 33
+
+struct ResumeTicket {
+  uint8_t session_id[RESUME_SESSION_ID_SIZE];
+  uint8_t secret[RESUME_SECRET_SIZE];
+};
+// Sent on the wire as one blob: session_id || secret
+static_assert(sizeof(ResumeTicket) == RESUME_SESSION_ID_SIZE + RESUME_SECRET_SIZE, "ticket must be packed");
+
+/// Fixed-slot RAM cache of single-use resume tickets. Lost on reboot by
+/// design: clients fall back to a full handshake.
+class ResumeTicketCache {
+ public:
+  /// Generate a fresh ticket into out and store it, evicting the oldest
+  /// slot. Returns false (and stores nothing) if the RNG fails.
+  bool issue(ResumeTicket &out);
+  /// Accept a resume offer: verify and consume the ticket (single use; a
+  /// forged MAC never burns one), build both transport ciphers, and write
+  /// the ServerHello accept extension into out_ext. Returns the extension
+  /// length, or 0 (nothing allocated) on any miss, failure, or when
+  /// out_capacity is too small. Secrets are wiped internally.
+  size_t try_accept(const uint8_t *offer, size_t offer_len, const uint8_t *prologue, size_t prologue_len,
+                    uint8_t *out_ext, size_t out_capacity, NoiseCipherState *&send_cipher,
+                    NoiseCipherState *&recv_cipher);
+  /// Forget every ticket (PSK change).
+  void clear();
+
+  // Round robin; more clients than slots thrash and fall back to full handshakes
+  static constexpr uint8_t SLOTS = 2;
+  static_assert(SLOTS <= 8, "used_mask_ is uint8_t");
+
+ protected:
+  ResumeTicket slots_[SLOTS];
+  uint8_t used_mask_{0};
+  uint8_t next_{0};
+};
+
+/// HKDF labels, PROGMEM on ESP8266.
+extern const char RESUME_LABEL_OFFER[6];
+extern const char RESUME_LABEL_CONFIRM[8];
+extern const char RESUME_LABEL_KEYS[5];
+
+// Largest KDF input: "keys" || client_nonce || server_nonce || SHA256(prologue)
+static constexpr size_t RESUME_KDF_MAX_DATA =
+    sizeof(RESUME_LABEL_KEYS) - 1 + RESUME_NONCE_SIZE + RESUME_NONCE_SIZE + 32;
+
+/// Noise-construction HKDF-SHA256 keyed with the ticket secret over
+/// label || a || b [|| SHA256(hash_in)], at most RESUME_KDF_MAX_DATA. out2 == nullptr means MAC only.
+bool resume_kdf(const uint8_t *secret, const char *label, size_t label_len, const uint8_t *a, size_t a_len,
+                const uint8_t *b, size_t b_len, const uint8_t *hash_in, size_t hash_in_len, uint8_t *out1,
+                size_t out1_len, uint8_t *out2);
+
+/// offer_mac for the ClientHello resume offer (what a client computes and
+/// try_accept checks).
+inline bool resume_compute_offer_mac(const uint8_t *secret, const uint8_t *session_id, const uint8_t *client_nonce,
+                                     uint8_t *out_mac) {
+  static_assert(sizeof(RESUME_LABEL_OFFER) - 1 + RESUME_SESSION_ID_SIZE + RESUME_NONCE_SIZE <= RESUME_KDF_MAX_DATA,
+                "KDF buffer");
+  return resume_kdf(secret, RESUME_LABEL_OFFER, sizeof(RESUME_LABEL_OFFER) - 1, session_id, RESUME_SESSION_ID_SIZE,
+                    client_nonce, RESUME_NONCE_SIZE, nullptr, 0, out_mac, RESUME_MAC_SIZE, nullptr);
+}
+
+/// confirm_mac for the ServerHello extension.
+inline bool resume_compute_confirm_mac(const uint8_t *secret, const uint8_t *client_nonce, const uint8_t *server_nonce,
+                                       uint8_t *out_mac) {
+  static_assert(sizeof(RESUME_LABEL_CONFIRM) - 1 + RESUME_NONCE_SIZE + RESUME_NONCE_SIZE <= RESUME_KDF_MAX_DATA,
+                "KDF buffer");
+  return resume_kdf(secret, RESUME_LABEL_CONFIRM, sizeof(RESUME_LABEL_CONFIRM) - 1, client_nonce, RESUME_NONCE_SIZE,
+                    server_nonce, RESUME_NONCE_SIZE, nullptr, 0, out_mac, RESUME_MAC_SIZE, nullptr);
+}
+
+/// Derive the transport keys. k_c2d encrypts client-to-device traffic,
+/// k_d2c device-to-client.
+inline bool resume_derive_keys(const uint8_t *secret, const uint8_t *client_nonce, const uint8_t *server_nonce,
+                               const uint8_t *prologue, size_t prologue_len, uint8_t *k_c2d, uint8_t *k_d2c) {
+  static_assert(sizeof(RESUME_LABEL_KEYS) - 1 + RESUME_NONCE_SIZE + RESUME_NONCE_SIZE + 32 <= RESUME_KDF_MAX_DATA,
+                "KDF buffer");
+  return resume_kdf(secret, RESUME_LABEL_KEYS, sizeof(RESUME_LABEL_KEYS) - 1, client_nonce, RESUME_NONCE_SIZE,
+                    server_nonce, RESUME_NONCE_SIZE, prologue, prologue_len, k_c2d, 32, k_d2c);
+}
+
+/// Build a ChaChaPoly cipher state keyed with key (32 bytes); nullptr on
+/// failure. Nonce counter starts at 0, exactly like a post-split cipher.
+NoiseCipherState *resume_make_cipher(const uint8_t *key);
+
+}  // namespace esphome::noise
+#endif  // USE_NOISE

esphome/components/ota/ota_backend.h

@@ -7,7 +7,6 @@
 #include <concepts>
 #include <cstddef>
 #include <cstdint>
-#include <type_traits>
 
 #ifdef USE_OTA_STATE_LISTENER
 #include <vector>
@@ -103,8 +102,6 @@ enum OTAType : uint8_t {
 // - set_update_md5: expected digest of the incoming image, hex string.
 // - write: consume the next chunk; end: finalize and mark bootable.
 // - abort: safe to call in any state, including after end().
-// - supports_compression: constexpr, whether a gzip image is stored as is and
-//   inflated at reboot.
 template<typename T>
 concept OTABackendContract = requires(T backend, size_t image_size, uint8_t *data, size_t len, const char *md5) {
   { backend.begin(image_size, OTA_TYPE_UPDATE_APP) } -> std::same_as<OTAResponseTypes>;
@@ -113,9 +110,7 @@ concept OTABackendContract = requires(T backend, size_t image_size, uint8_t *dat
   { backend.write(data, len) } -> std::same_as<OTAResponseTypes>;
   { backend.end() } -> std::same_as<OTAResponseTypes>;
   backend.abort();
-  { T::supports_compression() } -> std::same_as<bool>;
-  // The value must be a constant expression
-  typename std::bool_constant<T::supports_compression()>;
+  { backend.supports_compression() } -> std::same_as<bool>;
 };
 
 /** Listener interface for OTA state changes.

esphome/components/ota/ota_backend_arduino_libretiny.h

@@ -13,7 +13,7 @@ class ArduinoLibreTinyOTABackend final {
   OTAResponseTypes write(uint8_t *data, size_t len);
   OTAResponseTypes end();
   void abort();
-  static constexpr bool supports_compression() { return false; }
+  bool supports_compression() { return false; }
 
  private:
   bool md5_set_{false};

esphome/components/ota/ota_backend_arduino_rp2.h

@@ -15,10 +15,7 @@ class ArduinoRP2OTABackend final {
   OTAResponseTypes write(uint8_t *data, size_t len);
   OTAResponseTypes end();
   void abort();
-  // The core's OTA stub inflates a staged gzip image at reboot, on every chip
-  // from 4.0.3 (ESPHome pins 6.0.0). begin() only sees the gzip size; the
-  // inflated size is known when the stub reads the trailer.
-  static constexpr bool supports_compression() { return USE_ARDUINO_VERSION_CODE >= VERSION_CODE(4, 0, 3); }
+  bool supports_compression() { return false; }
 
  private:
   bool md5_set_{false};

esphome/components/ota/ota_backend_esp8266.h

@@ -20,7 +20,7 @@ class ESP8266OTABackend final {
   OTAResponseTypes end();
   void abort();
   // Compression supported in all ESP8266 Arduino versions ESPHome supports (>= 2.7.0)
-  static constexpr bool supports_compression() { return true; }
+  bool supports_compression() { return true; }
 
  protected:
   /// Erase flash sector if current address is at sector boundary

esphome/components/ota/ota_backend_esp_idf.h

@@ -33,7 +33,7 @@ class IDFOTABackend final {
   OTAResponseTypes write(uint8_t *data, size_t len);
   OTAResponseTypes end();
   void abort();
-  static constexpr bool supports_compression() { return false; }
+  bool supports_compression() { return false; }
 
  protected:
 #ifdef USE_OTA_PARTITIONS

esphome/components/ota/ota_backend_factory.h

@@ -25,7 +25,7 @@ struct StubOTABackend {
   OTAResponseTypes write(uint8_t *data, size_t len) { return OTA_RESPONSE_ERROR_UNKNOWN; }
   OTAResponseTypes end() { return OTA_RESPONSE_ERROR_UNKNOWN; }
   void abort() {}
-  static constexpr bool supports_compression() { return false; }
+  bool supports_compression() { return false; }
 };
 std::unique_ptr<StubOTABackend> make_ota_backend();
 }  // namespace esphome::ota
@@ -33,7 +33,6 @@ std::unique_ptr<StubOTABackend> make_ota_backend();
 
 namespace esphome::ota {
 using OTABackendPtr = decltype(make_ota_backend());
-using OTABackend = OTABackendPtr::element_type;
-static_assert(OTABackendContract<OTABackend>,
+static_assert(OTABackendContract<OTABackendPtr::element_type>,
               "The platform's OTA backend is missing part of the backend surface (ota_backend.h)");
 }  // namespace esphome::ota

esphome/components/ota/ota_backend_host.h

@@ -19,7 +19,7 @@ class HostOTABackend final {
   OTAResponseTypes write(uint8_t *data, size_t len);
   OTAResponseTypes end();
   void abort();
-  static constexpr bool supports_compression() { return false; }
+  bool supports_compression() { return false; }
 
  protected:
   md5::MD5Digest md5_{};

esphome/components/resampler/speaker/resampler_speaker.cpp

@@ -153,8 +153,8 @@ void ResamplerSpeaker::loop() {
     ESP_LOGV(TAG, "Stopping");
     xEventGroupClearBits(this->event_group_, ResamplingEventGroupBits::STATE_STOPPING);
   }
-  // Retries on a subsequent loop if the task is still running on the other core
-  if ((event_group_bits & ResamplingEventGroupBits::STATE_STOPPED) && this->task_.deallocate()) {
+  if (event_group_bits & ResamplingEventGroupBits::STATE_STOPPED) {
+    this->task_.deallocate();
     ESP_LOGD(TAG, "Stopped");
     xEventGroupClearBits(this->event_group_, ResamplingEventGroupBits::ALL_BITS);
   }
@@ -235,7 +235,7 @@ size_t ResamplerSpeaker::play(const uint8_t *data, size_t length, TickType_t tic
     bytes_written = this->output_speaker_->play(data, length, ticks_to_wait);
   } else {
     std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = this->ring_buffer_.lock();
-    if (temp_ring_buffer != nullptr) {
+    if (temp_ring_buffer) {
       // Only write to the ring buffer if the reference is valid
       bytes_written = temp_ring_buffer->write_without_replacement(data, length, ticks_to_wait);
     } else {
@@ -299,7 +299,7 @@ bool ResamplerSpeaker::has_buffered_data() const {
   bool has_ring_buffer_data = false;
   if (this->requires_resampling_()) {
     std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = this->ring_buffer_.lock();
-    if (temp_ring_buffer != nullptr) {
+    if (temp_ring_buffer) {
       has_ring_buffer_data = (temp_ring_buffer->available() > 0);
     }
   }
@@ -342,7 +342,7 @@ void ResamplerSpeaker::resample_task(void *params) {
       std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = ring_buffer::RingBuffer::create(
           this_resampler->audio_stream_info_.ms_to_bytes(this_resampler->buffer_duration_ms_));
 
-      if (temp_ring_buffer == nullptr) {
+      if (!temp_ring_buffer) {
         err = ESP_ERR_NO_MEM;
       } else {
         this_resampler->ring_buffer_ = temp_ring_buffer;

esphome/components/speaker/media_player/audio_pipeline.cpp

@@ -202,15 +202,8 @@ AudioPipelineState AudioPipeline::process_state() {
     if (!this->is_playing_) {
       // The tasks have been stopped for two ``process_state`` calls in a row, so delete the tasks
       if (this->read_task_.is_created() || this->decode_task_.is_created()) {
-        // Both are attempted every time; a task that is still running on the other core is freed by a
-        // subsequent call, and freeing an already freed task succeeds without doing anything
-        bool read_task_freed = this->read_task_.deallocate();
-        bool decode_task_freed = this->decode_task_.deallocate();
-        if (!read_task_freed || !decode_task_freed) {
-          // A task is still running on the other core, so keep the pipeline in its current state and try
-          // again on the next call
-          return AudioPipelineState::PLAYING;
-        }
+        this->read_task_.deallocate();
+        this->decode_task_.deallocate();
         if (this->hard_stop_) {
           // Stop command was sent, so immediately end the playback
           this->speaker_->stop();
@@ -322,17 +315,17 @@ void AudioPipeline::read_task(void *params) {
       if (err == ESP_OK) {
         size_t file_ring_buffer_size = this_pipeline->buffer_size_;
 
-        std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer = this_pipeline->raw_file_ring_buffer_.lock();
+        std::shared_ptr<ring_buffer::RingBuffer> temp_ring_buffer;
 
-        if (temp_ring_buffer == nullptr) {
+        if (!this_pipeline->raw_file_ring_buffer_.use_count()) {
           temp_ring_buffer = ring_buffer::RingBuffer::create(file_ring_buffer_size);
           this_pipeline->raw_file_ring_buffer_ = temp_ring_buffer;
         }
 
-        if (temp_ring_buffer == nullptr) {
+        if (!this_pipeline->raw_file_ring_buffer_.use_count()) {
           err = ESP_ERR_NO_MEM;
         } else {
-          err = reader->add_sink(temp_ring_buffer);
+          reader->add_sink(this_pipeline->raw_file_ring_buffer_);
         }
       }
 
@@ -403,9 +396,7 @@ void AudioPipeline::decode_task(void *params) {
           make_unique<audio::AudioDecoder>(this_pipeline->transfer_buffer_size_, this_pipeline->transfer_buffer_size_);
 
       esp_err_t err = decoder->start(this_pipeline->current_audio_file_type_);
-      if (err == ESP_OK) {
-        err = decoder->add_source(this_pipeline->raw_file_ring_buffer_);
-      }
+      decoder->add_source(this_pipeline->raw_file_ring_buffer_);
 
       if (err != ESP_OK) {
         // Send specific error message

esphome/core/defines.h

@@ -244,7 +244,6 @@
 #define USE_RUNTIME_IMAGE_QOI
 #define USE_RUNTIME_STATS
 #define USE_OTA
-#define USE_OTA_DEFLATE
 #define USE_OTA_ENCRYPTION
 #define USE_OTA_ENCRYPTION_FROM_API
 #define USE_OTA_ENCRYPTION_PROVISIONED

esphome/core/static_task.cpp

@@ -40,31 +40,16 @@ bool StaticTask::create(TaskFunction_t fn, const char *name, uint32_t stack_size
   return true;
 }
 
-bool StaticTask::destroy() {
-  if (this->handle_ == nullptr) {
-    return true;
+void StaticTask::destroy() {
+  if (this->handle_ != nullptr) {
+    TaskHandle_t handle = this->handle_;
+    this->handle_ = nullptr;
+    vTaskDelete(handle);
   }
-
-  // Suspending takes the task off the ready and event lists, so nothing can schedule it again. It only asks
-  // the other core to yield though, so the task may still be running on it for a moment.
-  vTaskSuspend(this->handle_);
-  if (eTaskGetState(this->handle_) != eSuspended) {
-    // The task is still running on the other core and using its stack. Deleting it now would only put it on
-    // the termination list and return, so the caller has to try again once it has been swapped out.
-    return false;
-  }
-
-  // The task cannot run again, so the delete completes right away instead of being left to the idle task.
-  TaskHandle_t handle = this->handle_;
-  this->handle_ = nullptr;
-  vTaskDelete(handle);
-  return true;
 }
 
-bool StaticTask::deallocate() {
-  if (!this->destroy()) {
-    return false;
-  }
+void StaticTask::deallocate() {
+  this->destroy();
   if (this->stack_buffer_ != nullptr) {
     RAMAllocator<StackType_t> allocator(this->use_psram_ ? RAMAllocator<StackType_t>::ALLOC_EXTERNAL
                                                          : RAMAllocator<StackType_t>::ALLOC_INTERNAL);
@@ -72,7 +57,6 @@ bool StaticTask::deallocate() {
     this->stack_buffer_ = nullptr;
     this->stack_size_ = 0;
   }
-  return true;
 }
 
 }  // namespace esphome

esphome/core/static_task.h

@@ -11,7 +11,6 @@ namespace esphome {
 
 /** Helper for FreeRTOS static task management.
  * Bundles TaskHandle_t, StaticTask_t, and the stack buffer into one object with create/destroy methods.
- * Call destroy() and deallocate() from another task: a task cannot free the stack it is still running on.
  */
 class StaticTask {
  public:
@@ -24,7 +23,7 @@ class StaticTask {
   /// @brief Allocate stack and create task.
   /// @param fn         Task function
   /// @param name       Task name (for debug)
-  /// @param stack_size Stack size in bytes (StackType_t is a byte on ESP-IDF)
+  /// @param stack_size Stack size in StackType_t words
   /// @param param      Parameter passed to task function
   /// @param priority   FreeRTOS task priority
   /// @param use_psram  If true, allocate stack in PSRAM; otherwise internal RAM
@@ -32,17 +31,11 @@ class StaticTask {
   bool create(TaskFunction_t fn, const char *name, uint32_t stack_size, void *param, UBaseType_t priority,
               bool use_psram);
 
-  /// @brief Delete the task, keeping the stack buffer allocated for reuse by a subsequent create() call.
-  /// The task must have finished its work and parked itself, either suspended or blocked indefinitely: it is
-  /// suspended here so that it cannot be scheduled again, and it is given no chance to clean up.
-  /// @return true if the task was deleted; false if it is still running on another core, in which case the
-  /// caller should try again later.
-  bool destroy();
+  /// @brief Delete the task but keep the stack buffer allocated for reuse by a subsequent create() call.
+  void destroy();
 
-  /// @brief Delete the task (if created) and free the stack buffer.
-  /// @return true if the stack buffer was freed; false if the task is still running on another core, in
-  /// which case the caller should try again later.
-  bool deallocate();
+  /// @brief Delete the task (if running) and free the stack buffer.
+  void deallocate();
 
  protected:
   TaskHandle_t handle_{nullptr};

esphome/espota2.py

@@ -11,7 +11,6 @@ import secrets
 import socket
 import time
 from typing import Any
-import zlib
 
 from esphome.core import EsphomeError
 from esphome.helpers import ProgressBar, resolve_ip_address
@@ -66,15 +65,9 @@ CLIENT_FEATURE_SUPPORTS_COMPRESSION = 0x01
 CLIENT_FEATURE_SUPPORTS_SHA256_AUTH = 0x02
 CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL = 0x04
 CLIENT_FEATURE_SUPPORTS_NOISE = 0x08
-CLIENT_FEATURE_SUPPORTS_DEFLATE = 0x10
 SERVER_FEATURE_SUPPORTS_COMPRESSION = 0x01
 SERVER_FEATURE_SUPPORTS_PARTITION_ACCESS = 0x02
 SERVER_FEATURE_SUPPORTS_NOISE = 0x04
-# Binding once offered: the device then expects the image size and a deflate stream
-SERVER_FEATURE_SUPPORTS_DEFLATE = 0x08
-
-# Wire constant: the deflate bit promises a 4 KB window (OTA_INFLATE_WINDOW_SIZE)
-DEFLATE_WINDOW_BITS = 12
 
 NOISE_FRAME_INDICATOR = 0x01
 NOISE_HANDSHAKE_OK = 0x00
@@ -94,9 +87,6 @@ _SUPPORTED_OTA_TYPES: frozenset[int] = frozenset(
 )
 
 UPLOAD_BLOCK_SIZE = 8192
-# Sizes on the wire are 4 bytes MSB first
-SIZE_FIELD_BYTES = 4
-COMPRESS_LEVEL = 9
 UPLOAD_BUFFER_SIZE = UPLOAD_BLOCK_SIZE * 8
 
 # Flaky Wi-Fi links often drop the first OTA attempt, and the device may need time
@@ -106,10 +96,6 @@ UPLOAD_BUFFER_SIZE = UPLOAD_BLOCK_SIZE * 8
 # across the addresses on top of that.
 EXTRA_UPLOAD_ATTEMPTS = 2
 UPLOAD_RETRY_DELAY = 5.0
-# Data phase timeout; must stay longer than the device's OTA_SOCKET_TIMEOUT_DATA
-# (105 s) so a stalled session is gone before a retry, and long enough for lwIP
-# to get a lost chunk ack through after the retransmit run seen in practice
-DATA_PHASE_TIMEOUT = 160.0
 
 _LOGGER = logging.getLogger(__name__)
 
@@ -561,7 +547,6 @@ def perform_ota(
         CLIENT_FEATURE_SUPPORTS_COMPRESSION
         | CLIENT_FEATURE_SUPPORTS_SHA256_AUTH
         | CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL
-        | CLIENT_FEATURE_SUPPORTS_DEFLATE
     )
     if noise_psk:
         features_to_send |= CLIENT_FEATURE_SUPPORTS_NOISE
@@ -655,16 +640,8 @@ def perform_ota(
                 f"retry {flag_name}."
             )
 
-    deflate = bool(extended_proto and features & SERVER_FEATURE_SUPPORTS_DEFLATE)
-    if deflate:
-        # The device inflates while receiving through a small ring window
-        upload_contents = zlib.compress(
-            file_contents, COMPRESS_LEVEL, wbits=-DEFLATE_WINDOW_BITS
-        )
-        _LOGGER.info("Compressed to %s bytes (deflate)", len(upload_contents))
-    elif features & SERVER_FEATURE_SUPPORTS_COMPRESSION:
-        # The device stores the gzip file and inflates it when it reboots
-        upload_contents = gzip.compress(file_contents, compresslevel=COMPRESS_LEVEL)
+    if features & SERVER_FEATURE_SUPPORTS_COMPRESSION:
+        upload_contents = gzip.compress(file_contents, compresslevel=9)
         _LOGGER.info("Compressed to %s bytes", len(upload_contents))
     else:
         upload_contents = file_contents
@@ -717,26 +694,29 @@ def perform_ota(
 
     _LOGGER.info("Handshake complete")
 
-    sock.settimeout(DATA_PHASE_TIMEOUT)
+    # Timeout must match device-side OTA_SOCKET_TIMEOUT_DATA to prevent premature failures
+    sock.settimeout(90.0)
 
     if extended_proto:
         send_check(sock, ota_type, "ota type")
 
     upload_size = len(upload_contents)
+    upload_size_encoded = [
+        (upload_size >> 24) & 0xFF,
+        (upload_size >> 16) & 0xFF,
+        (upload_size >> 8) & 0xFF,
+        (upload_size >> 0) & 0xFF,
+    ]
     # The device erases flash between receiving the size and acking the
     # prepare, so this window shows the erase cost (near zero when the
     # device erases lazily during the upload)
     prepare_start = time.perf_counter()
-    send_check(sock, upload_size.to_bytes(SIZE_FIELD_BYTES, "big"), "binary size")
-    if deflate:
-        # Own frame: an encrypted session carries one field per frame
-        send_check(sock, file_size.to_bytes(SIZE_FIELD_BYTES, "big"), "image size")
+    send_check(sock, upload_size_encoded, "binary size")
     receive_exactly(sock, 1, "update prepare result", RESPONSE_UPDATE_PREPARE_OK)
     prepare_duration = time.perf_counter() - prepare_start
     _LOGGER.info("Preparing for upload took %.2f seconds", prepare_duration)
 
-    # The device hashes what it writes: the inflated image, else the received bytes
-    upload_md5 = hashlib.md5(file_contents if deflate else upload_contents).hexdigest()
+    upload_md5 = hashlib.md5(upload_contents).hexdigest()
     _LOGGER.debug("MD5 of upload is %s", upload_md5)
 
     send_check(sock, upload_md5, "file checksum")
@@ -874,7 +854,7 @@ def run_ota_impl_(
     # clean up a half-open connection (its handshake watchdog runs at 20s);
     # moving on to the next address family stays immediate. Known limitation:
     # a silent mid-transfer drop with no reset can wedge the device until its
-    # 105s data timeout, which outlasts this budget; the retries target the
+    # 90s data timeout, which outlasts this budget; the retries target the
     # common failures where the device resets or closes the link promptly.
     total_attempts = len(res) + EXTRA_UPLOAD_ATTEMPTS
     last_error = ""

platformio.ini

@@ -45,7 +45,7 @@ lib_deps_base =
 lib_deps =
     ${common.lib_deps_base}
     https://github.com/dudanov/MideaUART.git#eeea6c3e9b4474f067054592b435be1c4e466815 ; midea
-    esphome/noise-c@0.1.26                 ; noise (api, ota)
+    esphome/noise-c@0.1.24                 ; noise (api, ota)
     improv/Improv@1.2.7                    ; improv_serial / esp32_improv
     kikuchan98/pngle@1.1.0                 ; online_image
     ; Using the repository directly, otherwise ESP-IDF can't use the library
@@ -244,7 +244,7 @@ lib_deps =
     ${common:idf-component-libs.lib_deps}
     ESP32Async/ESPAsyncWebServer@3.9.6    ; web_server_base
     droscy/esp_wireguard@0.4.5            ; wireguard
-    esphome/noise-c@0.1.26                ; noise (api, ota)
+    esphome/noise-c@0.1.24                ; noise (api, ota)
     ESP32Async/AsyncTCP@3.4.5             ; async_tcp
     DNSServer                             ; captive_portal
     heman/AsyncMqttClient-esphome@2.0.0   ; mqtt
@@ -641,7 +641,7 @@ build_unflags =
 extends = common
 platform = platformio/native
 lib_deps =
-    esphome/noise-c@0.1.26  ; used by noise (api, ota)
+    esphome/noise-c@0.1.24  ; used by noise (api, ota)
     lvgl/lvgl@9.5.0         ; lvgl
 build_flags =
     ${common.build_flags}

requirements.txt

@@ -10,7 +10,7 @@ tzlocal==5.4.4    # from time
 tzdata>=2026.3  # from time
 pyserial==3.5
 platformio==6.1.19
-esptool==5.4.0
+esptool==5.3.1
 click==8.3.3
 aioesphomeapi==46.3.0
 aiohappyeyeballs==2.7.1  # Happy Eyeballs for requests downloads; already pulled in by aioesphomeapi

script/api_protobuf/api_protobuf.py

@@ -2531,6 +2531,11 @@ def calculate_message_max_size(desc: descriptor.DescriptorProto) -> int | None:
     return total_size
 
 
+# Contents must never reach the log: dump_to prints only the name
+SENSITIVE_MESSAGES = {"NoiseResumeTicket"}
+SENSITIVE_MESSAGES_SEEN: set[str] = set()
+
+
 def build_message_type(
     desc: descriptor.DescriptorProto,
     base_class_fields: dict[str, list[descriptor.FieldDescriptorProto]],
@@ -2808,6 +2813,10 @@ def build_message_type(
         public_content.append(prot)
     # If no fields to calculate size for or message doesn't need encoding, the default implementation in ProtoMessage will be used
 
+    if desc.name in SENSITIVE_MESSAGES:
+        dump = []
+        SENSITIVE_MESSAGES_SEEN.add(desc.name)
+
     # dump_to method declaration in header
     prot = "#ifdef HAS_PROTO_MESSAGE_DUMP\n"
     prot += "const char *dump_to(DumpBuffer &out) const override;\n"
@@ -3715,6 +3724,11 @@ static const char *const TAG = "api.service";
     except ImportError:
         pass
 
+    # A renamed message must fail the build, not silently start dumping secrets
+    missing = SENSITIVE_MESSAGES - SENSITIVE_MESSAGES_SEEN
+    if missing:
+        raise RuntimeError(f"SENSITIVE_MESSAGES not found in api.proto: {missing}")
+
 
 if __name__ == "__main__":
     sys.exit(main())

script/ci-custom.py

@@ -823,8 +823,6 @@ def lint_relative_py_import(fname: Path, line, col, content):
         # neither can live in a C++ namespace.
         "esphome/components/esp32_hosted/esp_now_hosted.cpp",
         "esphome/components/esp32_hosted/esp_now_hosted_rpc.h",
-        # C header shared with the vendored decoder
-        "esphome/components/esphome/ota/ota_esphome_inflate.h",
     ],
 )
 def lint_namespace(fname: Path, content: str) -> str | None:

tests/components/esphome/__init__.py

@@ -1,12 +0,0 @@
-from esphome.loader import FileResource
-from tests.testing_helpers import ComponentManifestOverride
-
-
-def override_manifest(manifest: ComponentManifestOverride) -> None:
-    # to_code emits the component count the application needs
-    manifest.enable_codegen()
-    # Only the decoder is under test; its ota platform is not in this build
-    manifest.resources = manifest.resources + [
-        FileResource("esphome.components.esphome", "ota/ota_esphome_inflate.c"),
-        FileResource("esphome.components.esphome", "ota/ota_esphome_inflate.h"),
-    ]

tests/components/esphome/test_ota_inflate.cpp

@@ -1,324 +0,0 @@
-#include <gtest/gtest.h>
-
-#include <cstdint>
-#include <cstring>
-#include <vector>
-
-#include "esphome/components/esphome/ota/ota_esphome_inflate.h"
-
-namespace esphome::testing {
-
-// build_plain() compressed with the CLI's window (espota2.DEFLATE_WINDOW_BITS):
-//   DEFLATED = zlib.compress(plain, 9, wbits=-12)
-//   STORED = zlib.compress(plain[:300], 0, wbits=-12)
-static const uint8_t DEFLATED[] = {
-    0xed, 0xc8, 0xf7, 0x3f, 0xd4, 0x0f, 0x03, 0x00, 0x70, 0x67, 0xaf, 0x4b, 0x67, 0x66, 0x9f, 0x90, 0x91, 0x11, 0xc2,
-    0x11, 0x91, 0xb8, 0xb3, 0xf7, 0x3a, 0xd9, 0x5f, 0x4e, 0x99, 0x67, 0x1e, 0xce, 0x8a, 0xac, 0xec, 0x59, 0xb8, 0xc2,
-    0x95, 0x5d, 0x56, 0x42, 0x67, 0x73, 0x46, 0xf6, 0xca, 0xce, 0xc8, 0xc8, 0xc8, 0x91, 0x8a, 0x7c, 0x2f, 0x7a, 0xfe,
-    0x86, 0xe7, 0x87, 0xe7, 0x87, 0xe7, 0xf5, 0xfa, 0xbc, 0x7f, 0x7c, 0xbb, 0x07, 0xa2, 0x1f, 0xfa, 0xf9, 0xb8, 0x43,
-    0xfd, 0x82, 0x5c, 0xa0, 0x6e, 0xee, 0x28, 0x6f, 0x97, 0x20, 0x77, 0xa8, 0x3b, 0x70, 0xc0, 0x01, 0x07, 0x1c, 0x70,
-    0xc0, 0x01, 0x07, 0x1c, 0x70, 0xc0, 0x01, 0x07, 0x1c, 0x70, 0xc0, 0x01, 0x07, 0x1c, 0x70, 0xc0, 0x01, 0x07, 0x1c,
-    0x70, 0xc0, 0x01, 0xf7, 0x5f, 0xdd, 0x40, 0xd4, 0x63, 0x2f, 0x03, 0xf2, 0x17, 0xb2, 0xe5, 0x69, 0xc7, 0x5a, 0x04,
-    0xdf, 0x46, 0x22, 0xa8, 0x4b, 0x6e, 0xd5, 0x3a, 0x80, 0x05, 0xe1, 0x81, 0x4a, 0x44, 0x56, 0x27, 0xa9, 0x21, 0xf7,
-    0xad, 0xd9, 0xb0, 0xd3, 0xf1, 0xa5, 0x0b, 0x6a, 0x96, 0x56, 0xb2, 0xca, 0xb5, 0xee, 0x0f, 0x96, 0x28, 0xc3, 0x9e,
-    0x8f, 0x6e, 0xf2, 0x84, 0xa4, 0x3b, 0x2d, 0x16, 0x64, 0x08, 0x6a, 0x28, 0x91, 0xee, 0x87, 0x1a, 0x81, 0xff, 0xed,
-    0x2c, 0x5f, 0xda, 0x4a, 0x48, 0x5f, 0x91, 0xf0, 0x31, 0xfe, 0x6b, 0xbd, 0x81, 0x86, 0x92, 0x33, 0x1a, 0x6c, 0x69,
-    0x32, 0xfb, 0x19, 0x56, 0x2c, 0xc6, 0xaa, 0xef, 0xe8, 0x16, 0x98, 0xcf, 0x98, 0xbf, 0xa0, 0x2d, 0xde, 0x7f, 0xdf,
-    0x4b, 0xcb, 0xf6, 0x5c, 0xaf, 0x11, 0x24, 0xf0, 0x46, 0x3e, 0x49, 0x0e, 0x67, 0x0e, 0xcf, 0xf3, 0x57, 0xca, 0xb0,
-    0x39, 0x55, 0xe1, 0xe7, 0xfc, 0x37, 0x29, 0xe8, 0xd7, 0xf3, 0x08, 0x2e, 0xfb, 0x7b, 0x6d, 0x3e, 0xfe, 0xe9, 0x2c,
-    0x68, 0xe4, 0x20, 0x88, 0x57, 0x56, 0x41, 0x3d, 0xab, 0x9b, 0xbf, 0x0c, 0x0c, 0xae, 0x51, 0x48, 0x8b, 0x72, 0xcc,
-    0xb8, 0xbb, 0xf3, 0x30, 0xa8, 0x5c, 0xb5, 0xa1, 0x2f, 0x07, 0x52, 0xe9, 0x36, 0xb8, 0x3c, 0xbc, 0xee, 0xbc, 0xf1,
-    0xa3, 0x8b, 0x81, 0xc2, 0x03, 0xbf, 0x29, 0x5a, 0x22, 0x24, 0x97, 0xf8, 0xc9, 0xb5, 0xbf, 0xd2, 0x24, 0x4a, 0x86,
-    0xc1, 0x2b, 0xb7, 0xb8, 0xde, 0xa7, 0xea, 0xa5, 0x1d, 0x13, 0x1c, 0x1d, 0xd3, 0x3c, 0x81, 0x60, 0x2e, 0x2f, 0x93,
-    0x5c, 0x78, 0x43, 0x2e, 0x39, 0x68, 0x09, 0x13, 0x09, 0x10, 0xce, 0xd6, 0x8d, 0xe9, 0x2f, 0xaf, 0x88, 0x6f, 0x99,
-    0x4f, 0xcd, 0xdc, 0xaa, 0xf9, 0x47, 0xdb, 0x1c, 0xb5, 0x89, 0x53, 0x10, 0x3d, 0x77, 0xac, 0x26, 0x04, 0x3a, 0x3b,
-    0x18, 0xf8, 0x47, 0x75, 0x56, 0xa5, 0xda, 0x70, 0xfb, 0xf7, 0x0d, 0x3b, 0x6e, 0x4b, 0x2a, 0xbc, 0x49, 0x32, 0x43,
-    0x95, 0x62, 0x83, 0x3d, 0xdc, 0x0a, 0x1f, 0x1d, 0xf9, 0x59, 0x6b, 0x95, 0xf0, 0x9b, 0xf5, 0x53, 0x9e, 0xb5, 0x65,
-    0xeb, 0x74, 0xfa, 0x81, 0x9b, 0x61, 0xa3, 0x57, 0x2f, 0xda, 0x2c, 0xcd, 0xf8, 0xb0, 0x74, 0xb9, 0x62, 0x39, 0x91,
-    0xd9, 0x7d, 0xb3, 0x03, 0x65, 0x2e, 0x66, 0x20, 0x18, 0xac, 0xa2, 0xeb, 0x3b, 0x35, 0x98, 0xa3, 0x28, 0x46, 0x30,
-    0xee, 0xd3, 0xeb, 0x47, 0x49, 0x11, 0xc5, 0xcd, 0xa0, 0xa5, 0x1c, 0x2e, 0x9d, 0x14, 0xd6, 0x46, 0x4a, 0x05, 0x7b,
-    0xd3, 0xb9, 0x0d, 0xeb, 0xd7, 0x6f, 0xb5, 0xf4, 0xed, 0x3f, 0x27, 0xb8, 0xec, 0x51, 0xb1, 0x6e, 0xb0, 0x14, 0xed,
-    0xdf, 0x90, 0x72, 0x59, 0x71, 0xd5, 0xf5, 0xf2, 0x61, 0x5f, 0xa7, 0x8a, 0xd7, 0x0f, 0x80, 0x2f, 0xe5, 0x0f, 0x45,
-    0xf2, 0x4d, 0xd1, 0xdc, 0xdd, 0xce, 0x46, 0xdf, 0x77, 0xf2, 0xa6, 0xa2, 0x79, 0x77, 0xf0, 0x0e, 0xaa, 0x68, 0x14,
-    0x85, 0x32, 0x05, 0x29, 0x75, 0x2b, 0x6c, 0xb0, 0x7c, 0x84, 0xc9, 0xec, 0x49, 0x70, 0x9b, 0x38, 0x36, 0x4c, 0xe9,
-    0xa5, 0xdc, 0xb1, 0xb8, 0x28, 0xd6, 0x20, 0x89, 0x8a, 0x2a, 0x62, 0xc1, 0x90, 0x3a, 0x43, 0x48, 0xaa, 0xfc, 0xec,
-    0x52, 0xf4, 0x02, 0xa7, 0xcd, 0x46, 0xf9, 0x78, 0x64, 0x4f, 0xad, 0x6b, 0x17, 0xdb, 0x56, 0xa2, 0xa1, 0x6a, 0xcf,
-    0x3b, 0x66, 0x64, 0x01, 0xc2, 0xd6, 0xae, 0x23, 0x34, 0x82, 0x60, 0x0a, 0x3a, 0xe4, 0xdd, 0x7f, 0xaa, 0x97, 0x44,
-    0x9a, 0x63, 0x8f, 0xaf, 0xa9, 0x97, 0x5a, 0x55, 0xcc, 0x81, 0x48, 0x83, 0xf8, 0xe6, 0xc5, 0xef, 0xdf, 0xfa, 0x5a,
-    0x4f, 0x7f, 0x18, 0x56, 0xc0, 0x66, 0x36, 0xad, 0x8a, 0x79, 0xab, 0xde, 0xf4, 0x7b, 0x70, 0x98, 0xea, 0xfa, 0xf4,
-    0xc7, 0x01, 0x31, 0x16, 0xea, 0xf1, 0x70, 0x8d, 0xee, 0x87, 0x52, 0x13, 0x01, 0x9e, 0x0c, 0xbd, 0x5a, 0x14, 0x01,
-    0x8e, 0xf7, 0x6e, 0xff, 0xce, 0x7f, 0xa4, 0xd1, 0xa1, 0x6a, 0x9b, 0x95, 0xb2, 0x31, 0x8a, 0x6f, 0xc8, 0xfe, 0x8c,
-    0x29, 0x55, 0xbc, 0xfc, 0x61, 0xd0, 0xde, 0xb0, 0xa9, 0x0c, 0x01, 0x0f, 0xba, 0x77, 0x7e, 0x77, 0xd9, 0x76, 0xa4,
-    0xfd, 0xab, 0x38, 0x18, 0x92, 0xec, 0xf0, 0xd3, 0x57, 0x7f, 0xf4, 0xbd, 0x65, 0xd4, 0x77, 0x8e, 0xa1, 0x92, 0x82,
-    0x0c, 0x7b, 0x34, 0xd3, 0x11, 0xfb, 0xc0, 0x36, 0x23, 0x8e, 0xbb, 0x89, 0xdf, 0x70, 0xdc, 0x9a, 0x76, 0x45, 0x0b,
-    0x22, 0xfa, 0x35, 0xdf, 0x8f, 0x45, 0x48, 0x7d, 0xed, 0xdc, 0x06, 0x01, 0x5e, 0xbb, 0xe9, 0xf9, 0x07, 0x93, 0xf6,
-    0x69, 0x6f, 0xf1, 0xfc, 0xfd, 0xfa, 0x41, 0xc0, 0x13, 0x9e, 0x74, 0x2d, 0x76, 0xfe, 0xa7, 0xbe, 0x4e, 0xd9, 0xaa,
-    0x64, 0xa6, 0xed, 0xd3, 0xad, 0xee, 0x62, 0x9d, 0x39, 0xc9, 0xb8, 0xae, 0x86, 0x31, 0x4f, 0x62, 0x57, 0xea, 0xea,
-    0x5a, 0xe3, 0x59, 0xd8, 0x99, 0xb3, 0xcd, 0x9f, 0x3b, 0xea, 0x58, 0x99, 0x11, 0xdc, 0x3d, 0xac, 0x58, 0xd9, 0xa6,
-    0xae, 0x2d, 0x07, 0x1d, 0xd7, 0xfa, 0x87, 0x78, 0xa7, 0x7f, 0x2a, 0x4f, 0x25, 0x58, 0xef, 0x53, 0x78, 0x2e, 0x93,
-    0xdc, 0x44, 0xcc, 0x53, 0x88, 0x77, 0x1c, 0xda, 0x14, 0xaf, 0xe1, 0x67, 0x92, 0xff, 0x36, 0x96, 0x20, 0x6f, 0x9d,
-    0x2c, 0x7f, 0xea, 0x31, 0xf2, 0x34, 0x50, 0xc2, 0x39, 0x84, 0xee, 0x4c, 0xbe, 0xca, 0x06, 0x6f, 0x67, 0x42, 0xea,
-    0x13, 0x58, 0xee, 0xdd, 0x8e, 0x29, 0x4f, 0xee, 0xd8, 0x93, 0x0d, 0x45, 0x80, 0x4d, 0xf3, 0x12, 0x79, 0xbb, 0x36,
-    0xa3, 0x73, 0x95, 0x95, 0xb6, 0xfc, 0x54, 0x60, 0xb2, 0xcc, 0x71, 0xaa, 0xf1, 0x6b, 0x66, 0xed, 0xba, 0x8b, 0xd6,
-    0x6d, 0x61, 0x79, 0x61, 0x1d, 0xb3, 0xba, 0xa6, 0x2f, 0xaa, 0xdc, 0x1d, 0xb8, 0x22, 0xd8, 0x98, 0x58, 0xed, 0x4d,
-    0x3c, 0xea, 0xa9, 0x37, 0x5e, 0x5e, 0x7b, 0x47, 0xa1, 0x7a, 0x39, 0x42, 0xe4, 0x3b, 0xbb, 0x69, 0x0a, 0x8b, 0x32,
-    0x6e, 0x63, 0xeb, 0x87, 0xf6, 0x5d, 0xaa, 0xbf, 0xbe, 0xc5, 0xb2, 0x85, 0x60, 0xdc, 0x32, 0x07, 0x85, 0x73, 0x3d,
-    0x96, 0x8b, 0x89, 0x71, 0x52, 0xb4, 0x93, 0xe6, 0x18, 0xad, 0xbf, 0xce, 0x21, 0x1d, 0x33, 0xb5, 0xb3, 0x35, 0x6a,
-    0x5b, 0xe7, 0x47, 0x13, 0x19, 0x8f, 0x53, 0xf4, 0x0c, 0x2a, 0x39, 0x16, 0x37, 0x39, 0x3b, 0x5f, 0x81, 0x51, 0xbc,
-    0x23, 0x92, 0x2c, 0x8d, 0xbf, 0x2f, 0xee, 0xbf, 0xed, 0x9d, 0x3f, 0xe0, 0x16, 0x21, 0x5a, 0x57, 0xa6, 0x8c, 0x58,
-    0x7a, 0xd5, 0xa1, 0x6d, 0xed, 0xe8, 0x90, 0x97, 0x14, 0xb4, 0x6b, 0xa5, 0x3b, 0xd7, 0x90, 0x84, 0x9e, 0x07, 0xc2,
-    0x7f, 0x1e, 0x08, 0xa0, 0x6f, 0x69, 0xf1, 0xcc, 0x4e, 0xca, 0x07, 0x64, 0xa2, 0xb4, 0xbc, 0x5f, 0xe0, 0xa7, 0x0e,
-    0x31, 0x77, 0x6f, 0x35, 0xd7, 0x66, 0x83, 0x5d, 0x64, 0x4e, 0xf1, 0x3c, 0x7a, 0xcb, 0xa5, 0xfc, 0xc9, 0x95, 0xab,
-    0x27, 0x30, 0x6b, 0x82, 0x57, 0xcd, 0xb0, 0x85, 0x9d, 0xc5, 0xa9, 0x0f, 0xdb, 0xe3, 0x5a, 0xc1, 0xb2, 0x3f, 0xfa,
-    0xea, 0xf3, 0x3a, 0xa0, 0xe4, 0xad, 0xd7, 0x14, 0xcf, 0x4f, 0xc9, 0x46, 0x09, 0x6e, 0x70, 0x27, 0xe4, 0x9b, 0x5f,
-    0x61, 0x4a, 0xb2, 0xfb, 0xc3, 0xf0, 0x3a, 0x53, 0x38, 0x2a, 0x59, 0x48, 0x2b, 0xab, 0x21, 0x64, 0x1a, 0x1c, 0x90,
-    0xb6, 0x69, 0xbb, 0x89, 0xe3, 0x9a, 0x12, 0xb7, 0xfd, 0x47, 0xcc, 0x57, 0xdb, 0x2b, 0xf6, 0x35, 0xe1, 0x79, 0xe0,
-    0xbf, 0x6d, 0x7f, 0x71, 0x3c, 0x21, 0x27, 0x82, 0x12, 0x05, 0xae, 0x43, 0x11, 0x0f, 0xc8, 0xe7, 0x3c, 0xf0, 0x0b,
-    0xe4, 0x69, 0xff, 0xb2, 0xda, 0x9e, 0x7f, 0xfe, 0xa4, 0x3f, 0xdf, 0x02, 0x58, 0xaa, 0x60, 0xd2, 0x8e, 0xd5, 0x6c,
-    0x92, 0x22, 0x38, 0xb1, 0xd2, 0x84, 0x80, 0xea, 0xce, 0xfe, 0x34, 0x79, 0xd6, 0x94, 0xb0, 0xad, 0x51, 0x67, 0x65,
-    0xf5, 0xab, 0xd5, 0x18, 0x05, 0x92, 0x8a, 0x24, 0x36, 0xc2, 0xc4, 0x99, 0xad, 0x0d, 0x26, 0xb8, 0x70, 0xea, 0x5b,
-    0x74, 0x35, 0x6a, 0xfa, 0xac, 0x97, 0xd8, 0x4c, 0x08, 0x6d, 0xc1, 0xfe, 0x60, 0xe4, 0xd4, 0x8f, 0x93, 0xd4, 0xaf,
-    0xa2, 0xec, 0xb8, 0x71, 0xf6, 0xcb, 0x3f, 0xdc, 0x3e, 0x42, 0xca, 0xe2, 0x8d, 0xb9, 0x0a, 0x2c, 0xef, 0xb6, 0x18,
-    0x75, 0x46, 0x8a, 0x2b, 0x21, 0xeb, 0xc5, 0x12, 0x4d, 0xd7, 0xb8, 0x8e, 0x6c, 0xec, 0x9d, 0x12, 0xde, 0xa5, 0x45,
-    0xab, 0xc4, 0x26, 0x47, 0xfa, 0x57, 0xad, 0x78, 0x4c, 0x5e, 0x87, 0x0b, 0x42, 0x6a, 0xbe, 0xef, 0xbd, 0xbc, 0xe5,
-    0xd7, 0x4c, 0x3a, 0x0f, 0x96, 0x29, 0xcb, 0x45, 0x46, 0x3f, 0x8a, 0x31, 0xda, 0x8d, 0x7f, 0x89, 0xa4, 0xd6, 0xb4,
-    0xe5, 0x99, 0x27, 0xa7, 0xab, 0x15, 0x82, 0x75, 0x3e, 0xc0, 0x9d, 0xae, 0x8c, 0x7f, 0x19, 0x80, 0xf5, 0xa6, 0x89,
-    0xbc, 0xb7, 0x36, 0x50, 0x1f, 0x63, 0xca, 0x40, 0x3e, 0xe1, 0x4c, 0x2d, 0x1e, 0x15, 0x51, 0x93, 0xf2, 0x1a, 0x97,
-    0x3e, 0xad, 0x5e, 0xba, 0xe2, 0xd6, 0xa7, 0x7c, 0x51, 0x45, 0xdf, 0x92, 0xbe, 0x35, 0xf3, 0xb4, 0xe8, 0x5c, 0x2e,
-    0x6a, 0x5c, 0xda, 0xe8, 0xf7, 0x51, 0xdc, 0xcb, 0x06, 0xd2, 0xd2, 0xa4, 0x7c, 0x7d, 0x5f, 0x20, 0xb8, 0x50, 0x04,
-    0xb5, 0xb1, 0x9a, 0x4e, 0xc9, 0x94, 0xe4, 0x40, 0x2b, 0x85, 0xc8, 0xd3, 0x71, 0xfa, 0x83, 0x81, 0x28, 0x53, 0xef,
-    0xa0, 0xb0, 0xf0, 0xc8, 0xb9, 0x52, 0xb2, 0x0f, 0x8c, 0x49, 0x93, 0xeb, 0x2a, 0x95, 0x83, 0x4f, 0x47, 0xe8, 0x0c,
-    0x83, 0x7b, 0x88, 0x18, 0x63, 0xa9, 0x87, 0x7f, 0xe3, 0x57, 0xa6, 0x57, 0xdd, 0x6d, 0x2a, 0x85, 0xe9, 0x79, 0x16,
-    0x3b, 0x07, 0x59, 0x4f, 0xed, 0x9a, 0x17, 0xe7, 0xcd, 0x35, 0xa6, 0x9b, 0x06, 0x1d, 0x18, 0x5e, 0xb2, 0x9b, 0xac,
-    0x18, 0xc6, 0x5b, 0xec, 0xbe, 0x29, 0xa3, 0x57, 0xc2, 0x6b, 0x3f, 0x11, 0x89, 0xd1, 0x57, 0xe4, 0xb8, 0xaf, 0x11,
-    0xba, 0x90, 0x93, 0x4f, 0x5e, 0x0c, 0x6b, 0x9f, 0x61, 0x5c, 0xdd, 0xb6, 0xcf, 0x18, 0xcc, 0x9a, 0x95, 0x32, 0x5f,
-    0x6f, 0xf1, 0x43, 0x17, 0x2d, 0xbc, 0x70, 0xbe, 0xd4, 0x76, 0x38, 0x42, 0xcc, 0xdd, 0xf0, 0xff, 0x5b, 0xe8, 0x19,
-    0xc9, 0xf4, 0x25, 0xda, 0xdb, 0x5f, 0xd2, 0x3c, 0xf3, 0xe0, 0xed, 0xb0, 0xa2, 0x4c, 0xdf, 0x05, 0xf2, 0x0c, 0xc4,
-    0x21, 0xb9, 0xc4, 0x02, 0xd2, 0x1e, 0x46, 0x2c, 0x57, 0x78, 0xb0, 0xf1, 0x85, 0x33, 0x51, 0xc5, 0x3e, 0xce, 0x69,
-    0x68, 0x77, 0x3e, 0xb4, 0x5a, 0x4e, 0x43, 0x89, 0x85, 0x71, 0x36, 0x84, 0x56, 0x5c, 0x6b, 0xce, 0x78, 0x4e, 0x86,
-    0x6a, 0x5f, 0xf1, 0x2d, 0x73, 0x4c, 0xba, 0xc1, 0x5e, 0x2b, 0x6e, 0x0d, 0xdd, 0x45, 0x1d, 0x92, 0xb4, 0x31, 0xd9,
-    0xce, 0x0b, 0x58, 0x67, 0xc1, 0xa6, 0x47, 0x2e, 0x5e, 0x6d, 0x6d, 0xa3, 0x78, 0xed, 0xc5, 0xcb, 0xac, 0x20, 0xb8,
-    0x6a, 0x14, 0x32, 0x55, 0xe8, 0xfb, 0xe0, 0xee, 0x31, 0xfc, 0x47, 0x33, 0xf6, 0xe7, 0x54, 0xd1, 0x61, 0x91, 0x74,
-    0x90, 0xfa, 0x44, 0x0a, 0xc8, 0xaf, 0xa2, 0xdb, 0x2c, 0x83, 0xda, 0xe8, 0xd0, 0xb7, 0x34, 0x8a, 0xc8, 0xbb, 0x86,
-    0x58, 0x82, 0x1a, 0x2f, 0xd6, 0xc5, 0x92, 0xe9, 0xd0, 0x21, 0x11, 0xf6, 0xeb, 0x9b, 0xed, 0xbf, 0xa9, 0x71, 0x89,
-    0xb2, 0x59, 0x76, 0xb3, 0xeb, 0x9c, 0xe1, 0x73, 0x79, 0x7b, 0x11, 0x3d, 0x4e, 0x33, 0xca, 0xf6, 0x7e, 0xd8, 0xcf,
-    0x06, 0x41, 0x39, 0xef, 0x78, 0x5a, 0x89, 0x69, 0x0c, 0xff, 0xda, 0x31, 0x16, 0x32, 0xd4, 0xe5, 0x2d, 0x8b, 0x22,
-    0xb9, 0x82, 0x38, 0xd8, 0x22, 0xfc, 0xe8, 0xbd, 0xbf, 0x0d, 0x4b, 0xc9, 0x0d, 0x74, 0x5e, 0x2d, 0xb2, 0x1f, 0x23,
-    0xa8, 0xf8, 0xa7, 0x27, 0xe1, 0x02, 0x61, 0x83, 0xc4, 0xd0, 0x63, 0x0e, 0x23, 0xf2, 0x34, 0x06, 0x69, 0xd1, 0xa3,
-    0xa2, 0x76, 0x76, 0x94, 0xbc, 0x1f, 0x78, 0x73, 0x5a, 0x48, 0x82, 0xb4, 0x68, 0x3d, 0x24, 0x52, 0xe8, 0x92, 0x4e,
-    0x58, 0xdf, 0x55, 0x3f, 0xa8, 0x48, 0x59, 0x35, 0x90, 0x9b, 0x55, 0xc9, 0xdc, 0xff, 0xcc, 0x22, 0x7c, 0xd1, 0x29,
-    0xe0, 0xd5, 0xd8, 0x31, 0x3d, 0x9b, 0xae, 0x38, 0x52, 0x2a, 0xa1, 0xc5, 0x86, 0x19, 0x93, 0xe7, 0x2d, 0x9b, 0xa9,
-    0x09, 0xbf, 0xdd, 0x89, 0x43, 0x35, 0xb2, 0x6f, 0x91, 0xba, 0x28, 0xfa, 0x2f, 0x2c, 0xab, 0xe8, 0x58, 0xe6, 0x4c,
-    0xbf, 0xd5, 0xaf, 0x49, 0xcd, 0x7f, 0x18, 0xa4, 0x69, 0xd3, 0xff, 0x99, 0xad, 0x9d, 0xb0, 0x93, 0x3b, 0x04, 0x01,
-    0xd5, 0x7d, 0x33, 0xe0, 0x66, 0xe2, 0xd4, 0xeb, 0xae, 0xcd, 0x7f, 0x66, 0xf2, 0x2c, 0xa7, 0xfe, 0x7d, 0x51, 0x8b,
-    0x2a, 0x25, 0xa8, 0x90, 0xb2, 0x71, 0xe5, 0x98, 0x40, 0xb8, 0xe9, 0x1f, 0x64, 0xd9, 0x90, 0xf2, 0x39, 0x25, 0x6f,
-    0x58, 0x35, 0x9e, 0x40, 0x25, 0x92, 0xbb, 0xa2, 0x4d, 0x45, 0xf6, 0xc3, 0x1a, 0xc6, 0xc0, 0xf6, 0xc2, 0x9b, 0x2b,
-    0xb5, 0xc7, 0xe9, 0xc8, 0x75, 0x03, 0x71, 0x1c, 0x76, 0x0e, 0xde, 0x5c, 0xe7, 0xf4, 0x91, 0xc4, 0x1d, 0x9f, 0xcb,
-    0x67, 0x1c, 0x1b, 0xc9, 0x25, 0x6d, 0x95, 0x05, 0xd7, 0x3b, 0xbf, 0x2d, 0x90, 0x96, 0xc3, 0x44, 0xa3, 0x0a, 0xee,
-    0x7a, 0x4c, 0x7e, 0x7f, 0xc2, 0x4e, 0x4f, 0x38, 0x88, 0xe9, 0x9f, 0x93, 0xd8, 0xd1, 0x10, 0x8c, 0x85, 0x89, 0xb2,
-    0xd0, 0x95, 0xc3, 0xe4, 0xd2, 0x8f, 0x2b, 0x0c, 0x82, 0xbd, 0x25, 0x74, 0x39, 0xe7, 0x3e, 0xef, 0xd2, 0x2f, 0x6f,
-    0xdc, 0xe0, 0x75, 0x6b, 0xf2, 0x66, 0x7d, 0x65, 0x18, 0x26, 0xb0, 0x7a, 0x7a, 0x45, 0xf0, 0xf2, 0xc4, 0xbe, 0x70,
-    0x6e, 0x58, 0x3a, 0x54, 0x31, 0x64, 0xf6, 0x49, 0xb5, 0xdc, 0x1c, 0x9e, 0x87, 0xdb, 0x6a, 0x92, 0x2a, 0x59, 0x73,
-    0x35, 0x4d, 0x59, 0xed, 0xd0, 0x8a, 0xd9, 0xac, 0xea, 0x7c, 0xc0, 0x0a, 0xfe, 0x8f, 0x29, 0xb7, 0xda, 0xdc, 0x8a,
-    0x55, 0x0f, 0x61, 0xc0, 0x82, 0x49, 0x4c, 0xc2, 0x51, 0x4b, 0x41, 0x7d, 0x1f, 0xf1, 0x07, 0x13, 0x23, 0x16, 0xe4,
-    0x88, 0x76, 0x38, 0x92, 0xbd, 0x3d, 0xe2, 0x7b, 0xab, 0x1c, 0x53, 0x35, 0xfb, 0x85, 0x76, 0x35, 0xf7, 0xfc, 0xdc,
-    0x3e, 0xc9, 0xae, 0x6a, 0x7c, 0x10, 0x44, 0xa5, 0xfb, 0xc4, 0x81, 0x9a, 0x6d, 0x9b, 0xf2, 0x87, 0x0a, 0x9e, 0xcd,
-    0x75, 0xc2, 0xd5, 0xe7, 0x0b, 0xcd, 0x5c, 0x6e, 0xf2, 0x51, 0x96, 0xa3, 0xe8, 0xd5, 0x5a, 0x17, 0xf5, 0x1a, 0x28,
-    0xff, 0xc8, 0xf0, 0xfc, 0x7e, 0x3b, 0xd3, 0xf3, 0x12, 0x61, 0xe9, 0x02, 0xfa, 0x7b, 0x8e, 0x6b, 0x34, 0x4a, 0x5a,
-    0xb6, 0xb1, 0x71, 0x7d, 0xad, 0xbc, 0x88, 0x22, 0xf6, 0x14, 0xc5, 0x57, 0x1a, 0x0b, 0xb6, 0x8b, 0xbb, 0x9a, 0x09,
-    0xf2, 0xe8, 0x8d, 0x32, 0xd1, 0x54, 0xa9, 0xd2, 0x9f, 0xc5, 0xf4, 0x12, 0xad, 0xb3, 0xfd, 0x52, 0xb7, 0xff, 0x0e,
-    0x72, 0x59, 0xcb, 0x1d, 0x8d, 0xa4, 0xf2, 0x0f, 0x39, 0x8f, 0xc9, 0x84, 0xe0, 0x5c, 0xdd, 0x9c, 0xe4, 0x42, 0x4f,
-    0xf2, 0x09, 0x1e, 0x05, 0xcc, 0x41, 0xdd, 0xbd, 0xc1, 0xed, 0xdc, 0x8e, 0x64, 0xc3, 0x67, 0x51, 0xe5, 0x8a, 0x9a,
-    0x0d, 0x09, 0xb8, 0x4b, 0xa1, 0xb2, 0xdb, 0x01, 0xde, 0xf5, 0xd1, 0x51, 0xf7, 0x9d, 0x88, 0x59, 0xfd, 0xd5, 0x13,
-    0x0d, 0x05, 0xd5, 0x5e, 0xfa, 0x63, 0x26, 0x25, 0xad, 0x01, 0x83, 0x6f, 0xf3, 0x7f, 0x56, 0x11, 0x89, 0xaa, 0xdb,
-    0x49, 0xaa, 0x8f, 0x7d, 0x10, 0x99, 0xbf, 0x8b, 0xcf, 0xf4, 0xf8, 0xc2, 0x4e, 0x36, 0xa7, 0xb1, 0xfe, 0xc5, 0xf0,
-    0x07, 0xc3, 0x57, 0xe3, 0xbd, 0x1e, 0xa1, 0x56, 0x46, 0x32, 0x43, 0x8f, 0x8d, 0xc7, 0x73, 0x0a, 0xa5, 0x35, 0xa9,
-    0x93, 0x7c, 0x53, 0x3c, 0xf2, 0x58, 0xf3, 0x6a, 0x37, 0x41, 0xb4, 0xc7, 0x9d, 0xcd, 0xb1, 0x67, 0xb7, 0xaa, 0x5f,
-    0x25, 0xb9, 0xc5, 0xb6, 0xa2, 0xdb, 0xce, 0x34, 0x2c, 0xea, 0x93, 0x45, 0x6e, 0x7b, 0x6f, 0xb6, 0xf6, 0x89, 0x83,
-    0xd1, 0x9e, 0x08, 0x4b, 0x57, 0x4e, 0xd9, 0xf3, 0xe8, 0x81, 0x03, 0x5c, 0xd6, 0x6c, 0x2c, 0xea, 0x27, 0x2d, 0xfb,
-    0x39, 0xbb, 0x25, 0x81, 0xbb, 0x1a, 0xc3, 0xcb, 0xf5, 0x5e, 0x69, 0x1c, 0xa4, 0x8a, 0x0e, 0x4a, 0x69, 0xdf, 0xcd,
-    0x6c, 0xc7, 0xce, 0x48, 0xdb, 0x7a, 0x0b, 0xcb, 0x40, 0xc8, 0x59, 0x81, 0xde, 0x71, 0x3e, 0x0d, 0x41, 0xc9, 0xa2,
-    0x57, 0xae, 0xb7, 0x3f, 0x8b, 0x4e, 0x7c, 0xcb, 0xf9, 0xa5, 0xcb, 0xf8, 0xee, 0x52, 0xbe, 0x54, 0xa8, 0xef, 0x99,
-    0xb7, 0xa1, 0x0b, 0x77, 0xa2, 0xa7, 0x89, 0x47, 0x7f, 0x48, 0xaa, 0x02, 0x36, 0xbf, 0x9d, 0x97, 0xba, 0x43, 0x5e,
-    0x39, 0xa6, 0x99, 0x81, 0xde, 0xe4, 0x98, 0x06, 0x6a, 0xc8, 0x2c, 0x96, 0xf5, 0x51, 0x8c, 0x95, 0xd3, 0xe4, 0x2b,
-    0x94, 0x9a, 0x15, 0x71, 0x9f, 0xa4, 0x24, 0xfc, 0x92, 0x97, 0x18, 0xb7, 0x56, 0xe5, 0x59, 0xe1, 0x1a, 0x79, 0x3a,
-    0x47, 0x77, 0x92, 0xf5, 0x75, 0x42, 0xbd, 0x2d, 0x55, 0x05, 0xcf, 0xe8, 0xea, 0x64, 0x8b, 0xff, 0x30, 0xa1, 0x1e,
-    0x28, 0x2c, 0xa9, 0xaa, 0xd4, 0x19, 0x1d, 0x24, 0x7a, 0xcf, 0x5d, 0x39, 0xf2, 0xe3, 0xd2, 0xab, 0x26, 0x97, 0x35,
-    0xf6, 0x70, 0x8b, 0x09, 0x8b, 0x00, 0xb9, 0xb8, 0xa8, 0xb7, 0x78, 0xf1, 0x96, 0x03, 0xd2, 0x72, 0x46, 0x26, 0x82,
-    0x41, 0xce, 0xe3, 0x73, 0xb2, 0x31, 0x4f, 0x49, 0xc8, 0xa8, 0xcf, 0xcc, 0xb8, 0xcc, 0x5d, 0xab, 0xd1, 0x1e, 0xf5,
-    0x5a, 0x9a, 0x54, 0xaf, 0x15, 0xed, 0x5f, 0x96, 0x2b, 0x62, 0x0a, 0x4c, 0x67, 0x21, 0x98, 0xfd, 0x29, 0xf8, 0x12,
-    0x9d, 0xc2, 0x34, 0x4d, 0x70, 0x0e, 0x3b, 0x5e, 0xe3, 0x91, 0x58, 0x82, 0xa8, 0x9c, 0x7d, 0x11, 0xfb, 0x5d, 0x81,
-    0x0c, 0x0f, 0x9d, 0x84, 0xbb, 0xeb, 0x65, 0x1d, 0xeb, 0x6e, 0x18, 0x8e, 0x93, 0x70, 0xbb, 0x9d, 0xed, 0x58, 0xb2,
-    0x64, 0xf2, 0x7b, 0x8f, 0x05, 0xd8, 0xfa, 0x55, 0x50, 0xef, 0x7a, 0x49, 0x0d, 0xdf, 0xca, 0x63, 0xff, 0x41, 0x1d,
-    0x89, 0x79, 0xca, 0x8c, 0x1b, 0xbe, 0x75, 0x6f, 0x0e, 0x6b, 0x68, 0x8c, 0x5c, 0x93, 0xc8, 0xf3, 0x62, 0x0b, 0x68,
-    0xb1, 0x32, 0x2f, 0x1e, 0xda, 0xe5, 0x6d, 0x45, 0xaf, 0x3d, 0xa7, 0xaf, 0x81, 0x0f, 0xda, 0x82, 0x85, 0x94, 0x06,
-    0xc5, 0x3f, 0xf5, 0x73, 0x5f, 0xa4, 0x43, 0x5f, 0xb3, 0xac, 0x3d, 0x16, 0xe8, 0x6f, 0x84, 0xb3, 0xb6, 0x75, 0xf7,
-    0x13, 0x03, 0x46, 0x67, 0x87, 0x9a, 0xf1, 0x6c, 0x2e, 0x33, 0x33, 0x14, 0x85, 0x18, 0xe9, 0xd6, 0x1b, 0xee, 0x17,
-    0xe9, 0xe7, 0x6b, 0xd4, 0x46, 0xaf, 0x26, 0x55, 0x8d, 0xfc, 0x3a, 0xb4, 0x61, 0x1a, 0x9e, 0x2d, 0x85, 0xa2, 0x86,
-    0x8c, 0x92, 0xbd, 0x8d, 0x0e, 0x4b, 0x4e, 0x0d, 0xdf, 0x4a, 0xc6, 0x66, 0xcd, 0x28, 0xff, 0xc4, 0x44, 0xba, 0x39,
-    0x4a, 0x04, 0x43, 0xce, 0x95, 0x47, 0x99, 0x8c, 0x9b, 0xb7, 0x72, 0x48, 0xdd, 0x9b, 0x98, 0x4f, 0xd5, 0x18, 0x81,
-    0xb4, 0xef, 0xfa, 0x96, 0x54, 0x9b, 0xda, 0x73, 0xe2, 0xe0, 0x27, 0x2f, 0x10, 0x0f, 0xf9, 0x0e, 0x24, 0xb4, 0xd2,
-    0x39, 0xf7, 0x49, 0x8c, 0x5c, 0x05, 0x37, 0xdd, 0xa7, 0x73, 0xac, 0x16, 0x85, 0x71, 0x46, 0xd1, 0x6f, 0x7a, 0x25,
-    0xd2, 0x5c, 0x4e, 0x70, 0x26, 0x93, 0x36, 0x22, 0x5f, 0xe5, 0x42, 0x4e, 0x89, 0xf2, 0x4c, 0x55, 0x9b, 0xd1, 0xa5,
-    0xaf, 0x87, 0xd8, 0x7e, 0xe8, 0xdd, 0xb9, 0x47, 0xb3, 0xda, 0xf7, 0x98, 0x52, 0x73, 0x8b, 0x3c, 0x0b, 0xe7, 0xfa,
-    0x14, 0x7f, 0x9a, 0xa6, 0x8e, 0xf4, 0x7c, 0xad, 0x58, 0x11, 0x73, 0xe3, 0x3a, 0x56, 0x47, 0x9b, 0x95, 0x24, 0x68,
-    0x35, 0xa9, 0xd9, 0x6e, 0x5c, 0x4d, 0xe8, 0xa4, 0xb8, 0x80, 0x0b, 0x73, 0xc4, 0x0f, 0x87, 0x0c, 0xa1, 0xf4, 0x5a,
-    0x3c, 0xce, 0x3f, 0x30, 0x3d, 0xb5, 0xc1, 0x0b, 0x43, 0x2a, 0xb1, 0xbe, 0x6b, 0x12, 0xc4, 0x4b, 0xdb, 0xcb, 0x2f,
-    0x77, 0x8a, 0x3a, 0xba, 0xf4, 0xa3, 0x9b, 0x05, 0xee, 0x98, 0x50, 0x77, 0xfe, 0x82, 0x5b, 0x29, 0x6d, 0x7c, 0x0c,
-    0x4b, 0x41, 0xa2, 0x6a, 0xb2, 0x27, 0x32, 0xf1, 0x0c, 0x1d, 0xd7, 0x6c, 0x02, 0x4d, 0xbd, 0xf2, 0x5a, 0x66, 0xd3,
-    0xb5, 0x30, 0xab, 0x4b, 0x7e, 0x72, 0x77, 0x30, 0x42, 0xd7, 0x70, 0x05, 0x9f, 0xeb, 0x2f, 0x22, 0x7f, 0x49, 0x2d,
-    0x5d, 0xcf, 0x4b, 0x84, 0x0c, 0xa5, 0xb9, 0xe5, 0x49, 0xae, 0x54, 0x2c, 0x86, 0x53, 0x4c, 0x9c, 0x42, 0x29, 0x78,
-    0xf0, 0x0a, 0x8a, 0x36, 0x53, 0x4d, 0x2b, 0xc9, 0xe2, 0x69, 0x0e, 0x9a, 0x37, 0x0c, 0x91, 0x2d, 0xac, 0x2f, 0x43,
-    0x6a, 0xf1, 0xe9, 0xfb, 0xb4, 0x68, 0xec, 0x90, 0x00, 0xff, 0x32, 0xf8, 0x58, 0xab, 0xd1, 0x73, 0x9f, 0x77, 0x72,
-    0x22, 0xed, 0x64, 0xac, 0x7d, 0xd0, 0xa8, 0x1f, 0x01, 0x99, 0x9f, 0xfd, 0xa6, 0xcb, 0x62, 0xca, 0x65, 0xd8, 0xf8,
-    0x31, 0xf0, 0xc1, 0x5e, 0xef, 0xf1, 0x4d, 0x79, 0xa9, 0xfc, 0x8f, 0x57, 0xcb, 0xc1, 0xb7, 0x03, 0x30, 0xbb, 0xad,
-    0xdb, 0x88, 0xf7, 0xcc, 0xa1, 0x25, 0xfd, 0x37, 0x03, 0xc5, 0xdb, 0x7f, 0xb4, 0xe0, 0xe6, 0xa3, 0x7e, 0xa4, 0x52,
-    0x68, 0xa7, 0x2e, 0xe6, 0x1c, 0xea, 0x91, 0x48, 0x67, 0xbd, 0x3d, 0x6d, 0xcc, 0x09, 0x49, 0x17, 0x50, 0x16, 0xb5,
-    0x65, 0x63, 0xd4, 0x84, 0x2c, 0x3a, 0x5f, 0x6a, 0x3c, 0x66, 0xfa, 0x24, 0xaf, 0xd1, 0xfd, 0x18, 0x66, 0xe4, 0xe8,
-    0x3c, 0x6c, 0x74, 0xb6, 0xc5, 0x4c, 0xf8, 0xa8, 0x15, 0x3c, 0xd0, 0xb8, 0x4a, 0x53, 0x15, 0x4b, 0x1e, 0x56, 0x7f,
-    0xd8, 0x40, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0xfe, 0xe7, 0xdc, 0x03, 0xd1, 0x0f, 0xfd, 0x7c, 0xdc, 0xa1, 0x7e, 0x41, 0x2e, 0x50, 0x37, 0x77, 0x94, 0xb7, 0x4b,
-    0x90, 0x3b, 0x14, 0x38, 0xe0, 0x80, 0x03, 0x0e, 0x38, 0xe0, 0x80, 0xfb, 0xff, 0xba, 0xff, 0x00,
-};
-
-static const uint8_t STORED[] = {
-    0x01, 0x2c, 0x01, 0xd3, 0xfe, 0x65, 0x73, 0x70, 0x68, 0x6f, 0x6d, 0x65, 0x20, 0x6f, 0x74, 0x61, 0x20, 0x64,
-    0x65, 0x66, 0x6c, 0x61, 0x74, 0x65, 0x20, 0x65, 0x73, 0x70, 0x68, 0x6f, 0x6d, 0x65, 0x20, 0x6f, 0x74, 0x61,
-    0x20, 0x64, 0x65, 0x66, 0x6c, 0x61, 0x74, 0x65, 0x20, 0x65, 0x73, 0x70, 0x68, 0x6f, 0x6d, 0x65, 0x20, 0x6f,
-    0x74, 0x61, 0x20, 0x64, 0x65, 0x66, 0x6c, 0x61, 0x74, 0x65, 0x20, 0x65, 0x73, 0x70, 0x68, 0x6f, 0x6d, 0x65,
-    0x20, 0x6f, 0x74, 0x61, 0x20, 0x64, 0x65, 0x66, 0x6c, 0x61, 0x74, 0x65, 0x20, 0x65, 0x73, 0x70, 0x68, 0x6f,
-    0x6d, 0x65, 0x20, 0x6f, 0x74, 0x61, 0x20, 0x64, 0x65, 0x66, 0x6c, 0x61, 0x74, 0x65, 0x20, 0x65, 0x73, 0x70,
-    0x68, 0x6f, 0x6d, 0x65, 0x20, 0x6f, 0x74, 0x61, 0x20, 0x64, 0x65, 0x66, 0x6c, 0x61, 0x74, 0x65, 0x20, 0x65,
-    0x73, 0x70, 0x68, 0x6f, 0x6d, 0x65, 0x20, 0x6f, 0x74, 0x61, 0x20, 0x64, 0x65, 0x66, 0x6c, 0x61, 0x74, 0x65,
-    0x20, 0x65, 0x73, 0x70, 0x68, 0x6f, 0x6d, 0x65, 0x20, 0x6f, 0x74, 0x61, 0x20, 0x64, 0x65, 0x66, 0x6c, 0x61,
-    0x74, 0x65, 0x20, 0x65, 0x73, 0x70, 0x68, 0x6f, 0x6d, 0x65, 0x20, 0x6f, 0x74, 0x61, 0x20, 0x64, 0x65, 0x66,
-    0x6c, 0x61, 0x74, 0x65, 0x20, 0x65, 0x73, 0x70, 0x68, 0x6f, 0x6d, 0x65, 0x20, 0x6f, 0x74, 0x61, 0x20, 0x64,
-    0x65, 0x66, 0x6c, 0x61, 0x74, 0x65, 0x20, 0x65, 0x73, 0x70, 0x68, 0x6f, 0x6d, 0x65, 0x20, 0x6f, 0x74, 0x61,
-    0x20, 0x64, 0x65, 0x66, 0x6c, 0x61, 0x74, 0x65, 0x20, 0x65, 0x73, 0x70, 0x68, 0x6f, 0x6d, 0x65, 0x20, 0x6f,
-    0x74, 0x61, 0x20, 0x64, 0x65, 0x66, 0x6c, 0x61, 0x74, 0x65, 0x20, 0x65, 0x73, 0x70, 0x68, 0x6f, 0x6d, 0x65,
-    0x20, 0x6f, 0x74, 0x61, 0x20, 0x64, 0x65, 0x66, 0x6c, 0x61, 0x74, 0x65, 0x20, 0x65, 0x73, 0x70, 0x68, 0x6f,
-    0x6d, 0x65, 0x20, 0x6f, 0x74, 0x61, 0x20, 0x64, 0x65, 0x66, 0x6c, 0x61, 0x74, 0x65, 0x20, 0x65, 0x73, 0x70,
-    0x68, 0x6f, 0x6d, 0x65, 0x20, 0x6f, 0x74, 0x61, 0x20, 0x64, 0x65, 0x66, 0x6c, 0x61, 0x74, 0x65, 0x20,
-};
-
-static constexpr size_t WINDOW = 4096;
-static constexpr size_t PLAIN_SIZE = 16000;
-
-static uint8_t lcg_next(uint32_t &x) {
-  x = (x * 1103515245u + 12345u) & 0x7fffffffu;
-  return (x >> 16) & 0xff;
-}
-
-static std::vector<uint8_t> build_plain() {
-  std::vector<uint8_t> plain;
-  const char *text = "esphome ota deflate ";
-  for (int i = 0; i < 300; i++)
-    plain.insert(plain.end(), text, text + strlen(text));
-  uint32_t x = 1;
-  for (int i = 0; i < 3000; i++)
-    plain.push_back(lcg_next(x));
-  plain.insert(plain.end(), 5000, 0);
-  for (int i = 0; i < 100; i++)
-    plain.insert(plain.end(), text, text + strlen(text));
-  return plain;
-}
-
-// Mirrors the OTA session: chunked input through the read callback, window as output
-struct Session : OtaInflateState {
-  const uint8_t *in;
-  size_t in_len;
-  size_t in_pos;
-  size_t chunk;
-  std::vector<uint8_t> out;
-  uint8_t window[WINDOW];
-};
-
-static int read_cb(OtaInflateState *d) {
-  auto *s = static_cast<Session *>(d);
-  if (s->in_pos >= s->in_len)
-    return -1;
-  size_t n = std::min(s->chunk, s->in_len - s->in_pos);
-  d->source = s->in + s->in_pos + 1;
-  d->source_limit = s->in + s->in_pos + n;
-  s->in_pos += n;
-  return s->in[s->in_pos - n];
-}
-
-// Inflates the whole input; returns the decoder result and fills s.out
-static int inflate_all(Session &s, const uint8_t *in, size_t in_len, size_t chunk) {
-  s.in = in;
-  s.in_len = in_len;
-  s.in_pos = 0;
-  s.chunk = chunk;
-  s.out.clear();
-  memset(s.window, 0, sizeof(s.window));
-  ota_inflate_init(&s, s.window, WINDOW);
-  s.source_read_cb = read_cb;
-  int res;
-  do {
-    s.dest = s.window;
-    s.dest_limit = s.window + WINDOW;
-    res = ota_inflate(&s);
-    if (res < 0 || s.eof)
-      return res < 0 ? res : OTA_INFLATE_DATA_ERROR;
-    s.out.insert(s.out.end(), s.window, s.dest);
-    if (s.out.size() > PLAIN_SIZE)
-      return OTA_INFLATE_DATA_ERROR;
-  } while (res != OTA_INFLATE_DONE);
-  return res;
-}
-
-TEST(OtaInflate, RoundTripThroughWindow) {
-  auto s = std::make_unique<Session>();
-  ASSERT_EQ(inflate_all(*s, DEFLATED, sizeof(DEFLATED), 1040), OTA_INFLATE_DONE);
-  EXPECT_EQ(s->out, build_plain());
-  EXPECT_EQ(s->in_pos, sizeof(DEFLATED));
-}
-
-TEST(OtaInflate, SmallReadChunks) {
-  auto s = std::make_unique<Session>();
-  ASSERT_EQ(inflate_all(*s, DEFLATED, sizeof(DEFLATED), 7), OTA_INFLATE_DONE);
-  EXPECT_EQ(s->out, build_plain());
-}
-
-TEST(OtaInflate, StoredBlock) {
-  auto s = std::make_unique<Session>();
-  ASSERT_EQ(inflate_all(*s, STORED, sizeof(STORED), 64), OTA_INFLATE_DONE);
-  auto plain = build_plain();
-  plain.resize(300);
-  EXPECT_EQ(s->out, plain);
-}
-
-TEST(OtaInflate, TruncatedStreamFails) {
-  auto s = std::make_unique<Session>();
-  for (size_t cut : {size_t{1}, size_t{100}, size_t{1000}, sizeof(DEFLATED) - 1}) {
-    EXPECT_LT(inflate_all(*s, DEFLATED, cut, 1040), 0) << "cut at " << cut;
-    EXPECT_LE(s->out.size(), PLAIN_SIZE);
-  }
-}
-
-TEST(OtaInflate, TruncatedStoredBlockFails) {
-  auto s = std::make_unique<Session>();
-  EXPECT_LT(inflate_all(*s, STORED, sizeof(STORED) - 50, 64), 0);
-}
-
-TEST(OtaInflate, CorruptStreamsNeverEscapeTheWindow) {
-  // Flipped bytes and garbage; the sanitizers check the decoder stays in bounds
-  auto s = std::make_unique<Session>();
-  std::vector<uint8_t> bad(DEFLATED, DEFLATED + sizeof(DEFLATED));
-  // A coarse, non-aligned stride: neighbouring offsets hit the same paths
-  for (size_t i = 0; i < bad.size(); i += 29) {
-    bad[i] ^= 0x5a;
-    inflate_all(*s, bad.data(), bad.size(), 1040);
-    bad[i] ^= 0x5a;
-  }
-  uint32_t x = 99;
-  std::vector<uint8_t> garbage(2000);
-  for (int round = 0; round < 50; round++) {
-    for (auto &b : garbage)
-      b = lcg_next(x);
-    inflate_all(*s, garbage.data(), garbage.size(), 1040);
-  }
-}
-
-}  // namespace esphome::testing

tests/components/noise/test_noise_resume.cpp

@@ -0,0 +1,224 @@
+#include <gtest/gtest.h>
+
+#include <cstring>
+
+#include <noise/protocol.h>
+
+#include "esphome/components/noise/noise.h"
+#include "esphome/components/noise/noise_resume.h"
+
+namespace esphome::noise::testing {
+
+// Known-answer vectors shared with the client implementation
+// (aioesphomeapi tests/test_noise_resume.py); the two must stay identical
+// byte for byte or resumed sessions cannot interoperate.
+static const uint8_t KAT_SECRET[RESUME_SECRET_SIZE] = {1,  2,  3,  4,  5,  6,  7,  8,  9,  10, 11, 12, 13, 14, 15, 16,
+                                                       17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32};
+static const uint8_t KAT_SESSION_ID[RESUME_SESSION_ID_SIZE] = {0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7};
+static const uint8_t KAT_CLIENT_NONCE[RESUME_NONCE_SIZE] = {0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+                                                            0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f};
+static const uint8_t KAT_SERVER_NONCE[RESUME_NONCE_SIZE] = {0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
+                                                            0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f};
+static const uint8_t KAT_OFFER_MAC[RESUME_MAC_SIZE] = {0xa8, 0x08, 0xea, 0xdb, 0xec, 0x81, 0xa7, 0xcb,
+                                                       0xf4, 0xca, 0xaa, 0xb8, 0x0d, 0x7f, 0x9d, 0x01};
+static const uint8_t KAT_CONFIRM_MAC[RESUME_MAC_SIZE] = {0x09, 0xa3, 0x70, 0x3e, 0xc8, 0x34, 0x77, 0xe9,
+                                                         0x45, 0xe7, 0xf1, 0x61, 0x9d, 0x4f, 0x6a, 0x76};
+static const uint8_t KAT_K_C2D[32] = {0xd6, 0x01, 0xe3, 0xc1, 0x16, 0xa1, 0x64, 0x66, 0xdb, 0xc5, 0x9e,
+                                      0xdd, 0x60, 0x2a, 0x64, 0x1e, 0xbe, 0xf5, 0x11, 0x95, 0x98, 0xd2,
+                                      0xf2, 0x47, 0x1b, 0xc6, 0x8c, 0x51, 0x8f, 0xbe, 0xb7, 0x23};
+static const uint8_t KAT_K_D2C[32] = {0x7f, 0x8d, 0x57, 0x7e, 0x9f, 0xb4, 0xbb, 0xde, 0x86, 0xcd, 0xa9,
+                                      0xf4, 0x9b, 0x42, 0xe7, 0x24, 0xc8, 0x49, 0xce, 0x89, 0xd8, 0x96,
+                                      0x3f, 0x3c, 0x4b, 0x3f, 0x8f, 0x80, 0xc2, 0x56, 0xab, 0x65};
+
+/// The one place in this file that spells the offer wire layout
+static void build_offer(uint8_t *offer, const uint8_t *session_id, const uint8_t *client_nonce, const uint8_t *mac) {
+  offer[0] = RESUME_OFFER_VERSION;
+  std::memcpy(offer + RESUME_OFFER_SESSION_ID_OFFSET, session_id, RESUME_SESSION_ID_SIZE);
+  std::memcpy(offer + RESUME_OFFER_NONCE_OFFSET, client_nonce, RESUME_NONCE_SIZE);
+  std::memcpy(offer + RESUME_OFFER_MAC_OFFSET, mac, RESUME_MAC_SIZE);
+}
+
+/// "NoiseAPIInit" || be16(len) || offer, exactly as the api frame helper mixes it
+static constexpr size_t KAT_PROLOGUE_SIZE = 12 + 2 + RESUME_OFFER_SIZE;
+static void build_prologue(uint8_t *out, const uint8_t *offer) {
+  std::memcpy(out, "NoiseAPIInit", 12);  // NOLINT(bugprone-not-null-terminated-result)
+  out[12] = 0x00;
+  out[13] = RESUME_OFFER_SIZE;
+  std::memcpy(out + 14, offer, RESUME_OFFER_SIZE);
+}
+
+static void build_offer_for_ticket(uint8_t *offer, const ResumeTicket &ticket, const uint8_t *client_nonce) {
+  uint8_t mac[RESUME_MAC_SIZE];
+  ASSERT_TRUE(resume_compute_offer_mac(ticket.secret, ticket.session_id, client_nonce, mac));
+  build_offer(offer, ticket.session_id, client_nonce, mac);
+}
+
+/// Test access to the protected slots so a test can plant the KAT ticket
+struct TestCache : ResumeTicketCache {
+  void plant(const uint8_t *session_id, const uint8_t *secret) {
+    std::memcpy(this->slots_[0].session_id, session_id, RESUME_SESSION_ID_SIZE);
+    std::memcpy(this->slots_[0].secret, secret, RESUME_SECRET_SIZE);
+    this->used_mask_ |= 1u;
+  }
+};
+
+TEST(NoiseResumeKat, ConfirmMacMatchesClientImplementation) {
+  uint8_t mac[RESUME_MAC_SIZE];
+  ASSERT_TRUE(resume_compute_confirm_mac(KAT_SECRET, KAT_CLIENT_NONCE, KAT_SERVER_NONCE, mac));
+  EXPECT_EQ(std::memcmp(mac, KAT_CONFIRM_MAC, RESUME_MAC_SIZE), 0);
+}
+
+TEST(NoiseResumeKat, OfferMacMatchesClientImplementation) {
+  uint8_t mac[RESUME_MAC_SIZE];
+  ASSERT_TRUE(resume_compute_offer_mac(KAT_SECRET, KAT_SESSION_ID, KAT_CLIENT_NONCE, mac));
+  EXPECT_EQ(std::memcmp(mac, KAT_OFFER_MAC, RESUME_MAC_SIZE), 0);
+}
+
+TEST(NoiseResumeKat, KeyDerivationMatchesClientImplementation) {
+  // Prologue used by the shared vectors: "NoiseAPIInit" + be16(41) + a
+  // 41-byte offer whose MAC field is 16 bytes of 0xEE
+  uint8_t mac_filler[RESUME_MAC_SIZE];
+  std::memset(mac_filler, 0xEE, sizeof(mac_filler));
+  uint8_t offer[RESUME_OFFER_SIZE];
+  build_offer(offer, KAT_SESSION_ID, KAT_CLIENT_NONCE, mac_filler);
+  uint8_t prologue[KAT_PROLOGUE_SIZE];
+  build_prologue(prologue, offer);
+
+  uint8_t k_c2d[32], k_d2c[32];
+  ASSERT_TRUE(
+      resume_derive_keys(KAT_SECRET, KAT_CLIENT_NONCE, KAT_SERVER_NONCE, prologue, sizeof(prologue), k_c2d, k_d2c));
+  EXPECT_EQ(std::memcmp(k_c2d, KAT_K_C2D, 32), 0);
+  EXPECT_EQ(std::memcmp(k_d2c, KAT_K_D2C, 32), 0);
+}
+
+TEST(NoiseResumeCache, TryAcceptConsumesTicketOnceAndProvesPossession) {
+  TestCache cache;
+  cache.plant(KAT_SESSION_ID, KAT_SECRET);
+
+  uint8_t offer[RESUME_OFFER_SIZE];
+  build_offer(offer, KAT_SESSION_ID, KAT_CLIENT_NONCE, KAT_OFFER_MAC);
+  uint8_t prologue[KAT_PROLOGUE_SIZE];
+  build_prologue(prologue, offer);
+
+  uint8_t ext[RESUME_ACCEPT_SIZE];
+  NoiseCipherState *send = nullptr, *recv = nullptr;
+  ASSERT_EQ(cache.try_accept(offer, sizeof(offer), prologue, sizeof(prologue), ext, sizeof(ext), send, recv),
+            RESUME_ACCEPT_SIZE);
+  ASSERT_NE(send, nullptr);
+  ASSERT_NE(recv, nullptr);
+
+  // The extension proves possession: verify like the client does
+  EXPECT_EQ(ext[0], RESUME_ACCEPT_VERSION);
+  const uint8_t *server_nonce = ext + 1;
+  uint8_t expected_confirm[RESUME_MAC_SIZE];
+  ASSERT_TRUE(resume_compute_confirm_mac(KAT_SECRET, KAT_CLIENT_NONCE, server_nonce, expected_confirm));
+  EXPECT_EQ(std::memcmp(ext + 1 + RESUME_NONCE_SIZE, expected_confirm, RESUME_MAC_SIZE), 0);
+
+  // The ciphers must interoperate with the documented key derivation
+  uint8_t k_c2d[32], k_d2c[32];
+  ASSERT_TRUE(resume_derive_keys(KAT_SECRET, KAT_CLIENT_NONCE, server_nonce, prologue, sizeof(prologue), k_c2d, k_d2c));
+  NoiseCipherState *client_send = resume_make_cipher(k_c2d);
+  ASSERT_NE(client_send, nullptr);
+  uint8_t buf[64] = "resumed";
+  NoiseBuffer nb;
+  noise_buffer_init(nb);
+  noise_buffer_set_inout(nb, buf, 7, sizeof(buf));
+  ASSERT_EQ(noise_cipherstate_encrypt(client_send, &nb), NOISE_ERROR_NONE);
+  ASSERT_EQ(noise_cipherstate_decrypt(recv, &nb), NOISE_ERROR_NONE);
+  EXPECT_EQ(std::memcmp(buf, "resumed", 7), 0);
+  noise_cipherstate_free(client_send);
+  noise_cipherstate_free(send);
+  noise_cipherstate_free(recv);
+
+  // Single use: the same offer must miss the second time
+  NoiseCipherState *send2 = nullptr, *recv2 = nullptr;
+  EXPECT_EQ(cache.try_accept(offer, sizeof(offer), prologue, sizeof(prologue), ext, sizeof(ext), send2, recv2), 0u);
+  EXPECT_EQ(send2, nullptr);
+  EXPECT_EQ(recv2, nullptr);
+}
+
+TEST(NoiseResumeCache, BadMacOrMalformedOfferLeavesTicketIntact) {
+  TestCache cache;
+  cache.plant(KAT_SESSION_ID, KAT_SECRET);
+
+  uint8_t offer[RESUME_OFFER_SIZE];
+  uint8_t bad_mac[RESUME_MAC_SIZE];
+  std::memcpy(bad_mac, KAT_OFFER_MAC, RESUME_MAC_SIZE);
+  bad_mac[0] ^= 0x01;
+  build_offer(offer, KAT_SESSION_ID, KAT_CLIENT_NONCE, bad_mac);
+
+  uint8_t prologue[1] = {0};
+  uint8_t ext[RESUME_ACCEPT_SIZE];
+  NoiseCipherState *send = nullptr, *recv = nullptr;
+  // A forged offer must not burn the ticket
+  EXPECT_EQ(cache.try_accept(offer, sizeof(offer), prologue, sizeof(prologue), ext, sizeof(ext), send, recv), 0u);
+  // Wrong size or version must be recognized as "no offer"
+  build_offer(offer, KAT_SESSION_ID, KAT_CLIENT_NONCE, KAT_OFFER_MAC);
+  EXPECT_EQ(cache.try_accept(offer, sizeof(offer) - 1, prologue, sizeof(prologue), ext, sizeof(ext), send, recv), 0u);
+  offer[0] = 0x7f;
+  EXPECT_EQ(cache.try_accept(offer, sizeof(offer), prologue, sizeof(prologue), ext, sizeof(ext), send, recv), 0u);
+  offer[0] = RESUME_OFFER_VERSION;
+  // No room for the extension must also decline without burning it
+  EXPECT_EQ(cache.try_accept(offer, sizeof(offer), prologue, sizeof(prologue), ext, sizeof(ext) - 1, send, recv), 0u);
+  // The genuine offer still redeems
+  EXPECT_EQ(cache.try_accept(offer, sizeof(offer), prologue, sizeof(prologue), ext, sizeof(ext), send, recv),
+            RESUME_ACCEPT_SIZE);
+  noise_cipherstate_free(send);
+  noise_cipherstate_free(recv);
+}
+
+TEST(NoiseResumeCache, SetPskForgetsTickets) {
+  NoiseContext ctx;
+  ResumeTicket ticket;
+  ASSERT_TRUE(ctx.resume_cache().issue(ticket));
+
+  psk_t psk{};
+  psk[0] = 1;
+  ctx.set_psk(psk.data());
+
+  uint8_t offer[RESUME_OFFER_SIZE];
+  build_offer_for_ticket(offer, ticket, KAT_CLIENT_NONCE);
+  uint8_t prologue[KAT_PROLOGUE_SIZE];
+  build_prologue(prologue, offer);
+  uint8_t ext[RESUME_ACCEPT_SIZE];
+  NoiseCipherState *send = nullptr, *recv = nullptr;
+  EXPECT_EQ(
+      ctx.resume_cache().try_accept(offer, sizeof(offer), prologue, sizeof(prologue), ext, sizeof(ext), send, recv),
+      0u);
+  EXPECT_EQ(send, nullptr);
+  EXPECT_EQ(recv, nullptr);
+}
+
+TEST(NoiseResumeCache, IssueRotatesSlotsAndClearForgetsAll) {
+  ResumeTicketCache cache;
+  ResumeTicket tickets[ResumeTicketCache::SLOTS + 1];
+  for (auto &ticket : tickets) {
+    ASSERT_TRUE(cache.issue(ticket));
+  }
+  uint8_t offer[RESUME_OFFER_SIZE];
+  uint8_t prologue[1] = {0};
+  uint8_t ext[RESUME_ACCEPT_SIZE];
+
+  // The oldest ticket was evicted by the one-past-capacity issue
+  build_offer_for_ticket(offer, tickets[0], KAT_CLIENT_NONCE);
+  NoiseCipherState *send = nullptr, *recv = nullptr;
+  EXPECT_EQ(cache.try_accept(offer, sizeof(offer), prologue, sizeof(prologue), ext, sizeof(ext), send, recv), 0u);
+  // The rest remain redeemable
+  for (int i = 1; i <= ResumeTicketCache::SLOTS; i++) {
+    build_offer_for_ticket(offer, tickets[i], KAT_CLIENT_NONCE);
+    EXPECT_EQ(cache.try_accept(offer, sizeof(offer), prologue, sizeof(prologue), ext, sizeof(ext), send, recv),
+              RESUME_ACCEPT_SIZE);
+    noise_cipherstate_free(send);
+    noise_cipherstate_free(recv);
+    send = recv = nullptr;
+  }
+
+  // clear() forgets everything
+  ResumeTicket ticket;
+  ASSERT_TRUE(cache.issue(ticket));
+  cache.clear();
+  build_offer_for_ticket(offer, ticket, KAT_CLIENT_NONCE);
+  EXPECT_EQ(cache.try_accept(offer, sizeof(offer), prologue, sizeof(prologue), ext, sizeof(ext), send, recv), 0u);
+}
+
+}  // namespace esphome::noise::testing

tests/components/ota/test.bk72xx-ard.yaml

@@ -1 +0,0 @@
-<<: !include common.yaml

tests/components/ota/test_backend_contract.cpp

@@ -14,7 +14,7 @@ struct MinimalBackend {
   OTAResponseTypes write(uint8_t *data, size_t len) { return OTA_RESPONSE_OK; }
   OTAResponseTypes end() { return OTA_RESPONSE_OK; }
   void abort() {}
-  static constexpr bool supports_compression() { return false; }
+  bool supports_compression() { return false; }
 };
 static_assert(OTABackendContract<MinimalBackend>);
 

tests/integration/fixtures/api_noise_resume.yaml

@@ -0,0 +1,9 @@
+esphome:
+  name: host-noise-resume
+host:
+api:
+  encryption:
+    key: N4Yle5YirwZhPiHHsdZLdOA73ndj/84veVaLhTvxCuU=
+# VERY_VERBOSE so the frame helper logs "Session resumed!"
+logger:
+  level: VERY_VERBOSE

tests/integration/fixtures/host_ota_deflate.yaml

@@ -1,9 +0,0 @@
-esphome:
-  name: host-ota-test
-host:
-api:
-ota:
-  - platform: esphome
-    port: __OTA_PORT__
-logger:
-  level: DEBUG

tests/integration/test_api_noise_resume.py

@@ -0,0 +1,58 @@
+"""Integration test for noise session resume."""
+
+from __future__ import annotations
+
+import asyncio
+
+import aioesphomeapi.core
+import pytest
+
+from .types import APIClientConnectedFactory, RunCompiledFunction
+
+NOISE_KEY = "N4Yle5YirwZhPiHHsdZLdOA73ndj/84veVaLhTvxCuU="
+
+
+@pytest.mark.asyncio
+async def test_api_noise_resume(
+    yaml_config: str,
+    run_compiled: RunCompiledFunction,
+    api_client_connected: APIClientConnectedFactory,
+) -> None:
+    """A reconnect with the ticket from the first connection resumes the session."""
+    if not hasattr(aioesphomeapi.core, "ResumeAPIError"):
+        pytest.skip("aioesphomeapi without noise session resume")
+
+    resumed = asyncio.Event()
+    resumed_count = 0
+
+    def on_line(line: str) -> None:
+        nonlocal resumed_count
+        if "Session resumed" in line:
+            resumed_count += 1
+            resumed.set()
+
+    async with (
+        run_compiled(yaml_config, line_callback=on_line),
+        api_client_connected(noise_psk=NOISE_KEY) as client,
+    ):
+        # First connection: full handshake, the device issues a ticket
+        info = await client.device_info()
+        assert info.name == "host-noise-resume"
+        assert resumed_count == 0
+
+        # Same client reconnects and offers the ticket
+        await client.disconnect()
+        await client.connect(login=True)
+        info = await client.device_info()
+        assert info.name == "host-noise-resume"
+        await asyncio.wait_for(resumed.wait(), timeout=10.0)
+        assert resumed_count == 1
+        resumed.clear()
+
+        # The resumed session issued a fresh ticket, so it resumes again
+        await client.disconnect()
+        await client.connect(login=True)
+        info = await client.device_info()
+        assert info.name == "host-noise-resume"
+        await asyncio.wait_for(resumed.wait(), timeout=10.0)
+        assert resumed_count == 2

tests/integration/test_host_ota.py

@@ -9,14 +9,12 @@ from __future__ import annotations
 
 import asyncio
 import base64
-from collections.abc import Callable, Generator
+from collections.abc import Generator
 from contextlib import contextmanager
 from dataclasses import dataclass
 import functools
 from pathlib import Path
 import socket
-from types import SimpleNamespace
-import zlib
 
 import pytest
 
@@ -124,7 +122,6 @@ class _Device:
     binary_path: Path
     proc: asyncio.subprocess.Process | None = None
     reboots: int = 0
-    inflates: int = 0
 
     def __post_init__(self) -> None:
         self._rebooted = asyncio.Event()
@@ -133,8 +130,6 @@ class _Device:
         if "Rebooting safely" in line:
             self.reboots += 1
             self._rebooted.set()
-        if "Inflated " in line and " bytes from " in line:
-            self.inflates += 1
 
     async def wait_reboot(self, count: int, timeout: float = 10.0) -> None:
         async with asyncio.timeout(timeout):
@@ -209,81 +204,6 @@ async def test_host_ota_self_update(
         await dev.ota(None, None, "second OTA failed -- listener leaked across execv")
 
 
-@pytest.mark.asyncio
-async def test_host_ota_deflate(
-    yaml_config: str,
-    write_yaml_config: ConfigWriter,
-    compile_esphome: CompileFunction,
-    reserved_tcp_port: tuple[int, socket.socket],
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    """Deflate is negotiated by default, an old client gets an uncompressed
-    upload, and a corrupt stream is rejected without taking the device down."""
-    dev = _Device(
-        *await _build(
-            yaml_config, write_yaml_config, compile_esphome, reserved_tcp_port
-        )
-    )
-    errors: list[str] = []
-
-    def on_log(line: str) -> None:
-        # A corrupt stream is caught by the decoder, by the size check or by
-        # the MD5 at the end, depending on where the damage lands
-        if any(
-            text in line
-            for text in ("Inflate err", "Inflate overrun", "End update err")
-        ):
-            errors.append(line)
-        dev.on_log(line)
-
-    real_compress = zlib.compress
-
-    def corrupt_compress(data: bytes, *args: object, **kwargs: object) -> bytes:
-        out = bytearray(real_compress(data, *args, **kwargs))
-        out[len(out) // 2] ^= 0x55
-        return bytes(out)
-
-    def overlong_compress(data: bytes, *args: object, **kwargs: object) -> bytes:
-        """A stream that inflates past the size the client announced."""
-        return real_compress(data + bytes(8192), *args, **kwargs)
-
-    def patch_compress(func: Callable[..., bytes]) -> None:
-        monkeypatch.setattr(espota2, "zlib", SimpleNamespace(compress=func))
-
-    async with run_binary(dev.binary_path, line_callback=on_log) as (proc, _lines):
-        dev.proc = proc
-        await _wait_for_port(LOCALHOST, dev.api_port, PORT_WAIT_TIMEOUT)
-
-        # Default: the host backend cannot store gzip, so the CLI sends deflate
-        await dev.ota(None, None, "deflate upload failed")
-        assert dev.inflates == 1, "device did not inflate the upload"
-
-        # A client that does not offer deflate is served uncompressed
-        monkeypatch.setattr(espota2, "CLIENT_FEATURE_SUPPORTS_DEFLATE", 0)
-        await dev.ota(None, None, "uncompressed upload failed")
-        assert dev.inflates == 1, "device inflated without a client offer"
-        monkeypatch.undo()
-
-        # A corrupt stream fails the upload and leaves the device running
-        patch_compress(corrupt_compress)
-        await dev.refused_ota(None, None, "corrupt deflate stream was accepted")
-        monkeypatch.undo()
-        assert errors, "device did not report the corrupt stream"
-
-        # So does a stream that inflates past the announced image size
-        errors.clear()
-        patch_compress(overlong_compress)
-        await dev.refused_ota(None, None, "overlong deflate stream was accepted")
-        monkeypatch.undo()
-        assert any("Inflate overrun" in line for line in errors), (
-            "device wrote past the announced size"
-        )
-
-        # and it still takes a good upload afterwards
-        await dev.ota(None, None, "upload after a rejected stream failed")
-        assert dev.inflates == 2
-
-
 @pytest.mark.asyncio
 async def test_host_ota_encrypted(
     yaml_config: str,

tests/script/test_platformio_install_deps.py

@@ -35,8 +35,8 @@ def _load_script():
 def test_spec_key_collapses_destinations() -> None:
     """Two specs delivering one package share a directory and one key."""
     mod = _load_script()
-    assert mod.spec_key("esphome/noise-c @ 0.1.26") == "noise-c"
-    assert mod.spec_key("esphome/noise-c@0.1.26") == "noise-c"
+    assert mod.spec_key("esphome/noise-c @ 0.1.24") == "noise-c"
+    assert mod.spec_key("esphome/noise-c@0.1.24") == "noise-c"
     assert mod.spec_key("ESP32Async/AsyncTCP @ ^3.4.10") == mod.spec_key(
         "esp32async/asynctcp @ 3.5.0"
     )
@@ -54,23 +54,23 @@ def test_parse_specs_and_cli_args(tmp_path: Path) -> None:
         "[env:a]\n"
         "platform = fake/platform@1\n"
         "lib_deps =\n"
-        "    esphome/noise-c @ 0.1.26\n"
+        "    esphome/noise-c @ 0.1.24\n"
         "    ${common.lib_deps}\n"
         "    internal_lib\n"
         "[env:b]\n"
         "lib_deps =\n"
-        "    esphome/noise-c @ 0.1.26\n"
+        "    esphome/noise-c @ 0.1.24\n"
     )
     mod = _load_script()
     args = Namespace(libraries=True, platforms=True, tools=False)
     libs, platforms, tools = mod.parse_specs(str(ini), args)
     # exact-string duplicates collapse; distinct version pins survive
-    assert libs == ["esphome/noise-c @ 0.1.26"]
+    assert libs == ["esphome/noise-c @ 0.1.24"]
     assert platforms == ["fake/platform@1"]
     assert tools == []
     assert mod.build_cli_args(libs, platforms, tools) == [
         "-l",
-        "esphome/noise-c @ 0.1.26",
+        "esphome/noise-c @ 0.1.24",
         "-p",
         "fake/platform@1",
     ]
@@ -162,13 +162,13 @@ def test_parallel_install_behavior(tmp_path: Path) -> None:
     mod.parallel_install(
         cls,
         [
-            "esphome/noise-c @ 0.1.26",
-            "esphome/noise-c @ 0.1.26",
+            "esphome/noise-c @ 0.1.24",
+            "esphome/noise-c @ 0.1.24",
             "esphome/already @ 1.0",
             "https://x/framework.tar.xz",
         ],
     )
-    assert cls.calls == ["esphome/noise-c @ 0.1.26"]
+    assert cls.calls == ["esphome/noise-c @ 0.1.24"]
     assert cls.lock_events == ["lock", "unlock"]
 
 
@@ -205,7 +205,7 @@ def test_parallel_install_runs_dependency_waves(tmp_path: Path) -> None:
     mod = _load_script()
     cls = _reset_fake(str(tmp_path))
     cls.deps = {
-        "esphome/noise-c @ 0.1.26": [
+        "esphome/noise-c @ 0.1.24": [
             {"owner": "esphome", "name": "libsodium", "version": "^1.0"},
             {"name": "SPI"},
         ],
@@ -213,12 +213,12 @@ def test_parallel_install_runs_dependency_waves(tmp_path: Path) -> None:
             {"owner": "esphome", "name": "libsodium", "version": "^1.0"},
         ],
     }
-    mod.parallel_install(cls, ["esphome/noise-c @ 0.1.26", "esphome/wg @ 1.0"])
+    mod.parallel_install(cls, ["esphome/noise-c @ 0.1.24", "esphome/wg @ 1.0"])
     assert len(cls.calls) == 3  # the shared dep installs exactly once
     assert {mod.spec_key(c) for c in cls.calls} == {"noise-c", "wg", "libsodium"}
     # Wave-1 strings carry no compatibility; the dependency wave does
     compats = dict(cls.compat_calls)
-    assert compats["esphome/noise-c @ 0.1.26"] is None
+    assert compats["esphome/noise-c @ 0.1.24"] is None
     dep_compat = next(v for k, v in cls.compat_calls if "libsodium" in k)
     assert dep_compat is not None  # mirrors pio's install_dependency
 
@@ -229,11 +229,11 @@ def test_dependency_wave_excludes_url_specs(tmp_path: Path) -> None:
     mod = _load_script()
     cls = _reset_fake(str(tmp_path))
     cls.deps = {
-        "esphome/noise-c @ 0.1.26": [
+        "esphome/noise-c @ 0.1.24": [
             {"name": "vendored", "version": "https://github.com/x/y.git"},
         ],
     }
-    mod.parallel_install(cls, ["esphome/noise-c @ 0.1.26"])
+    mod.parallel_install(cls, ["esphome/noise-c @ 0.1.24"])
     assert {mod.spec_key(c) for c in cls.calls} == {"noise-c"}
 
 
@@ -348,13 +348,13 @@ def test_warm_store_still_walks_dependencies(tmp_path: Path) -> None:
     """Already-installed top-level packages still feed the dependency
     wave; a warm store can be missing a transitive dep."""
     mod = _load_script()
-    cls = _reset_fake(str(tmp_path), installed={"esphome/noise-c @ 0.1.26"})
+    cls = _reset_fake(str(tmp_path), installed={"esphome/noise-c @ 0.1.24"})
     cls.deps = {
-        "esphome/noise-c @ 0.1.26": [
+        "esphome/noise-c @ 0.1.24": [
             {"owner": "esphome", "name": "libsodium", "version": "^1.0"},
         ],
     }
-    mod.parallel_install(cls, ["esphome/noise-c @ 0.1.26"])
+    mod.parallel_install(cls, ["esphome/noise-c @ 0.1.24"])
     assert [mod.spec_key(c) for c in cls.calls] == ["libsodium"]
 
 

tests/unit_tests/test_espota2.py

@@ -12,7 +12,6 @@ from pathlib import Path
 import socket
 import struct
 from unittest.mock import Mock, call, patch
-import zlib
 
 import pytest
 from pytest import CaptureFixture
@@ -355,7 +354,6 @@ def test_perform_ota_successful_md5_auth(
                 espota2.CLIENT_FEATURE_SUPPORTS_COMPRESSION
                 | espota2.CLIENT_FEATURE_SUPPORTS_SHA256_AUTH
                 | espota2.CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL
-                | espota2.CLIENT_FEATURE_SUPPORTS_DEFLATE
             ]
         )
     )
@@ -418,9 +416,6 @@ def test_perform_ota_no_auth(
         "Update took 14.00 seconds (prepare 2.00, upload 5.00, commit 7.00)"
         in caplog.text
     )
-    # The data phase timeout must outlast the device's 105 s data timeout
-    mock_socket.settimeout.assert_any_call(espota2.DATA_PHASE_TIMEOUT)
-    assert espota2.DATA_PHASE_TIMEOUT > 105.0
 
 
 @pytest.mark.usefixtures("mock_time")
@@ -603,16 +598,12 @@ def test_perform_ota_upload_error(mock_socket: Mock, mock_file: io.BytesIO) -> N
         espota2.perform_ota(mock_socket, None, mock_file, "test.bin")
 
 
-def _no_auth_handshake(version: int, server_features: int | None = None) -> list[bytes]:
+def _no_auth_handshake(version: int) -> list[bytes]:
     """Recv responses for a handshake without auth, up to the MD5 check."""
-    if server_features is None:
-        features = [bytes([espota2.RESPONSE_HEADER_OK])]
-    else:
-        features = [bytes([espota2.RESPONSE_FEATURE_FLAGS]), bytes([server_features])]
     return [
         bytes([espota2.RESPONSE_OK]),  # First byte of version response
         bytes([version]),  # Version number
-        *features,
+        bytes([espota2.RESPONSE_HEADER_OK]),  # Features response
         bytes([espota2.RESPONSE_AUTH_OK]),  # No auth required
         bytes([espota2.RESPONSE_UPDATE_PREPARE_OK]),  # Binary size OK
         bytes([espota2.RESPONSE_BIN_MD5_OK]),  # MD5 checksum OK
@@ -1060,7 +1051,6 @@ def test_perform_ota_successful_sha256_auth(
                 espota2.CLIENT_FEATURE_SUPPORTS_COMPRESSION
                 | espota2.CLIENT_FEATURE_SUPPORTS_SHA256_AUTH
                 | espota2.CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL
-                | espota2.CLIENT_FEATURE_SUPPORTS_DEFLATE
             ]
         )
     )
@@ -1117,7 +1107,6 @@ def test_perform_ota_sha256_fallback_to_md5(
                 espota2.CLIENT_FEATURE_SUPPORTS_COMPRESSION
                 | espota2.CLIENT_FEATURE_SUPPORTS_SHA256_AUTH
                 | espota2.CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL
-                | espota2.CLIENT_FEATURE_SUPPORTS_DEFLATE
             ]
         )
     )
@@ -1227,7 +1216,6 @@ def test_perform_ota_extended_protocol_app(
                 espota2.CLIENT_FEATURE_SUPPORTS_COMPRESSION
                 | espota2.CLIENT_FEATURE_SUPPORTS_SHA256_AUTH
                 | espota2.CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL
-                | espota2.CLIENT_FEATURE_SUPPORTS_DEFLATE
             ]
         )
     )
@@ -1288,7 +1276,6 @@ def test_perform_ota_successful_partition_table(
                 espota2.CLIENT_FEATURE_SUPPORTS_COMPRESSION
                 | espota2.CLIENT_FEATURE_SUPPORTS_SHA256_AUTH
                 | espota2.CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL
-                | espota2.CLIENT_FEATURE_SUPPORTS_DEFLATE
             ]
         )
     )
@@ -1517,40 +1504,3 @@ def test_check_error_passes_non_error_when_expect_is_none() -> None:
     espota2.check_error([espota2.RESPONSE_OK], None)
     espota2.check_error([espota2.RESPONSE_HEADER_OK], None)
     espota2.check_error([espota2.RESPONSE_FEATURE_FLAGS], None)
-
-
-# Device replies after the MD5 check for a one-chunk upload
-_UPLOAD_TAIL = [
-    bytes([espota2.RESPONSE_CHUNK_OK]),
-    bytes([espota2.RESPONSE_RECEIVE_OK]),
-    bytes([espota2.RESPONSE_UPDATE_END_OK]),
-]
-
-
-@pytest.mark.usefixtures("mock_time")
-@pytest.mark.parametrize(
-    "server_features",
-    [
-        espota2.SERVER_FEATURE_SUPPORTS_DEFLATE,
-        # Binding offer: deflate wins over gzip
-        espota2.SERVER_FEATURE_SUPPORTS_DEFLATE
-        | espota2.SERVER_FEATURE_SUPPORTS_COMPRESSION,
-    ],
-)
-def test_perform_ota_with_deflate(mock_socket: Mock, server_features: int) -> None:
-    """The device gets a raw deflate stream, both sizes and the image MD5."""
-    original_content = b"firmware" * 100
-    mock_socket.recv.side_effect = (
-        _no_auth_handshake(espota2.OTA_VERSION_2_0, server_features) + _UPLOAD_TAIL
-    )
-
-    espota2.perform_ota(mock_socket, None, io.BytesIO(original_content), "test.bin")
-
-    sent = [c[0][0] for c in mock_socket.sendall.call_args_list]
-    # magic, features, ota type, size, image size, md5, data, end ack
-    sent_size = struct.unpack(">I", sent[3])[0]
-    assert sent[4] == len(original_content).to_bytes(espota2.SIZE_FIELD_BYTES, "big")
-    payload = sent[6]
-    assert len(payload) == sent_size < len(original_content)
-    assert zlib.decompress(payload, -espota2.DEFLATE_WINDOW_BITS) == original_content
-    assert sent[5] == hashlib.md5(original_content).hexdigest().encode()

tests/unit_tests/test_platformio_prefetch.py

@@ -1663,7 +1663,7 @@ def test_preinstall_runs_dependency_waves(tmp_path: Path) -> None:
         {"name": "SPI"},
     ]
     m.dependency_to_spec.side_effect = lambda dep: _FakeSpec(name=dep["name"])
-    pf._preinstall(m, [("noise-c@0.1.26", _FakeSpec(name="noise-c"))])
+    pf._preinstall(m, [("noise-c@0.1.24", _FakeSpec(name="noise-c"))])
     assert installed == ["noise-c", "libsodium"]  # dep deduped, SPI left out
     # The dep wave carries its compatibility so _install searches qualified
     dep_call = m._install.call_args_list[-1]
@@ -1683,7 +1683,7 @@ def test_preinstall_dependency_wave_skips_seen_names(tmp_path: Path) -> None:
     m._install.side_effect = lambda spec, skip_dependencies, compatibility=None: (
         installed.append(getattr(spec, "name", str(spec)))
     )
-    pf._preinstall(m, [("noise-c@0.1.26", _FakeSpec(name="noise-c"))])
+    pf._preinstall(m, [("noise-c@0.1.24", _FakeSpec(name="noise-c"))])
     assert installed == ["noise-c"]