P1: Release Metadata TLS — Verify GitHub API response before trusting URLs

[stritti]

Background

OtaUpdater::fetchLatestRelease() uses setInsecure() to fetch GitHub API release metadata. A MITM can inject a fake release with a higher version tag and point downloadUrl_ to a malicious binary. This defeats the CA verification on the download side, since the attacker controls which URL is downloaded.

Required Changes

1. TLS for metadata: Replace setInsecure() in fetchLatestRelease() with CA bundle verification
2. URL validation: Whitelist allowed download hosts (*.github.com, objects.githubusercontent.com)
3. Semver validation: Reject non-semver tag names (tag_name must match v?MAJOR.MINOR.PATCH)
4. Fresh fetch guard: Ensure fresh metadata fetch before update (no stale cache)

Affected Files

• src/OtaUpdater.cpp — fetchLatestRelease(), startUpdate()
• src/OtaUpdater.hpp — Validation helpers and constants

OpenSpec

Full specification: openspec/specs/release-metadata-tls.spec.md
Change marker: openspec/changes/p1-release-metadata-tls/

Related

• Originally deferred from PR feat: OTA update from GitHub releases, semver release management, config safety #77 review
• Depends on: CA chain fix (shared TLS approach)
• Blocks: secure OTA update pipeline