| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
- Makefile: every target runs in a container as your UID/GID, with no
capabilities, a read-only root filesystem, only the project folder
mounted and no network except for image builds and `make sdk`.
Serial even under `make -j`. `make nuke` removes containers, images,
the dedicated buildx builder and .cache/ after confirmation.
- sdk-setup.sh: agreement acceptance pinned to the hash you read,
password login (never stored), SDK 9.2.0 and device download, and
the login token deleted afterwards.
- gen-key.sh: RSA-4096 developer key into .cache/keys, never
overwritten, with backup instructions.
- manifest.xml: watch-app, minApiLevel 5.0.0, no permissions, and the
72 watches with API 5.0+ and at least 512 KB for apps.
- .gitignore, lint configs and CHANGELOG.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
|
garmin-otp/dev: Ubuntu 22.04 (pinned by digest; the simulator needs
WebKitGTK 4.0), apt packages from a dated snapshot.ubuntu.com mirror,
OpenJDK 17, Xvfb/openbox/noVNC for the headless simulator, the
connect-iq-sdk-manager CLI v0.8.4 checked against its release SHA-256,
and Python tools installed from a hash-locked requirements file.
garmin-otp/docs: Node 22 (pinned by digest), Debian snapshot packages,
markdownlint-cli2 and mermaid-cli from package-lock.json, and the
headless Chrome build pinned by Puppeteer.
Locks only use releases published before 2026-10-01. The Garmin SDK,
device files and the developer key are never baked into an image.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
