# Provisioning config for `make provision`. Copy to `provisioning.toml`
# (gitignored) and fill in your values, then `make provision` to write
# everything to the device's NVS partition over USB.

[wifi]
ssid = "your-wifi-ssid"
pass = "your-wifi-password"

[trust]
# Bundled Sigstore Fulcio root + intermediate CA PEMs. These come from
# https://github.com/sigstore/root-signing/tree/main/targets and need to
# be re-fetched + re-provisioned if Sigstore rotates them (rare).
fulcio_root_pem = "trust/fulcio_root.pem"
fulcio_intermediate_pem = "trust/fulcio_intermediate.pem"

# Allowlist of (identity, issuer) pairs the OTA verifier accepts as
# signers of incoming firmware. Identity is the SAN value in the Fulcio
# leaf cert — an rfc822Name (email) for OIDC issuers like Google, or a
# URI for workflow-based issuers like GitHub Actions.

# Manual `make publish` from a developer machine.
[[trust.identities]]
identity = "imjasonh@gmail.com"
issuer = "https://accounts.google.com"

# Automated publishes from the GHA workflow on push to main.
[[trust.identities]]
identity = "https://github.com/imjasonh/esp32/.github/workflows/publish.yml@refs/heads/main"
issuer = "https://token.actions.githubusercontent.com"