[Kartikey1306]

Closes #182

Problem

core/eos/ was pinned to eos 5544c98 and missed the eos security fixes merged since then (#182):

• the device-tree parser reads out of bounds on a malformed blob;
• secure boot never loaded its public key;
• OTA accepted any update whose own SHA-256 matched.

Three files that baseline_drift counted as ebuild drift were in fact older than the pin.

Changes

One commit, 86f8c03. Pin: 5544c98 → dc13c59.

	Files	What
Updated to upstream	62	Every vendored file that still matched the old pin and changed upstream: drivers/devicetree, services/ota, services/crypto, hal, backends, core, docs and tests.
Removed	1	backends/include/eos/backend.h. Upstream moved it to include/eos/backend.h, which is among the 62.
Added as-is	21	20 files the updated CMakeLists reference (services/gps, ed25519 under services/crypto, core/src/shell_cmd.c, services/compat/src/os_adapter_posix.c, hal/src/hal_win32.c), plus tests/test_devicetree.c. Nothing else from upstream was added.
Reconciled (stale drift)	3	hal/src/hal_rtos.c, tests/test_ota.c, services/security/src/security.c take upstream. Each local copy was older than the pin; security.c lacked the public-key load that the pin already had.
Local edits to drifted files	2	Root CMakeLists.txt: upstream's HAL backend selection (EOS_HAL_BACKEND_*), which the updated hal_common.c needs to link. tests/CMakeLists.txt: registers test_devicetree.

core/UPSTREAM.yaml: baseline_drift goes 44 → 41.

Verification

Run on macOS (arm64) at 86f8c03. The local SDK 27 linker cannot read its own libSystem.tbd (ld: tapi error: malformed file, which also breaks master), so the C builds use -DCMAKE_OSX_SYSROOT=…/MacOSX26.5.sdk.

Check	master ecd7376	This PR
scripts/check_vendor_drift.py	drifted 44 / baseline 44, OK	drifted 41 / baseline 41, OK
cmake -S core/eos -DEOS_BUILD_TESTS=ON + build	OK, 3 warnings	OK, the same 3 warnings, in files this PR does not touch
ctest	19/19	20/20 (adds test_devicetree)
eos's tests/test_devicetree.c against the vendored parser, ASan+UBSan	aborts (exit 134): heap-buffer-overflow … in be32; index 4294967292 out of bounds for type 'const uint8_t[256]'; signed integer overflow: 1073741824 * 4	37/37 assertions passed
pytest (whole repo)	5 failed, all ld: tapi error from the SDK 27 linker	5 failed, the same 5, same cause
pytest with SDKROOT=…/MacOSX26.5.sdk	—	895 passed, 4 skipped, 0 failed

The intermediate states I hit along the way show why each part is needed:

• Pin bump plus the 62 updates alone: configure fails, because add_subdirectory given source "gps" doesn't exist.
• Plus the missing sources: linking fails with Undefined symbols: "_eos_hal_rtos_register". That is the bug upstream fixed in its root CMakeLists.
• Plus that fix: test_ota aborts, because the stale test applies an unsigned update. test_security segfaults, because the stale security.c has no NULL guard before strncpy.

This is a fork PR, so the workflows need a maintainer's approval to run.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[srpatcha]

Verified on WSL (Ubuntu 20.04) before merge: scripts/check_vendor_drift.py → core/eos drifted=41 baseline=41, no new drift; devicetree.c / ota.c / security.c / ed25519_verify.c / secure-ota main.c byte-identical to eos dc13c59; vendored core/eos cmake build + ctest 20/20 passed.