Country-Specific Firmware (i.e. for Giteki compliance in Japan)

[dkastl]

I’m reaching out to discuss an idea related to regulatory compliance for devices sold in Japan and other regions with strict radio compliance requirements (i.e., meeting Giteki certification requirements, which currently apply to very few devices, mainly developer boards) and how this might be addressed within the Meshtastic project.

The Challenge

In Japan, devices must meet Giteki certification, which essentially requires that the radio settings are locked to certified values and cannot be altered by users. This ensures that devices operate only within approved parameters. However, Meshtastic's current approach, which allows users to freely adjust all radio settings, makes Giteki certification nearly impossible for consumer devices. Regulatory authorities require that the manufacturer ensures compliance by preventing unauthorized changes to the certified configuration.

That said, in practice, most users do not frequently alter radio settings or change regions. Typically, users configure the settings once and then continue using the device without modifying them again. This means that a locked firmware for Japan (or other regions), enforcing compliance but otherwise functioning identically, would likely have little impact on the majority of users while ensuring legal operation.

My Proposal

Compile-Time Option for Region Locking

• Implement a compile-time option that locks the firmware to the certified radio settings for a specific region, such as Japan (JP). This would allow manufacturers to preload the firmware to comply with regulations and receive necessary certifications.
• Once compiled for a given region, the firmware should make it impossible for users to alter the settings that must remain fixed according to the settings from the region preset for regulatory compliance.
• Users still have the ability to flash alternative firmware if they choose. However, when a device is purchased in Japan for example there would be clear warnings and documentation indicating that doing so will void Giteki compliance.

Invitation for Feedback

I’d love to hear from others who have experience with similar regulatory challenges in different countries. Does this approach seem feasible? Are there technical challenges or alternative methods to achieve compliance while maintaining user flexibility? Are there other regions facing similar issues?

[fifieldt]

The https://github.com/meshtastic/firmware/blob/master/userPrefs.jsonc file is what we have in mind for OEMs making these kind of changes to firmware.

You'll see eg USERPREFS_CONFIG_LORA_REGION will be used to set the region

We can probably surface managed mode ( https://meshtastic.org/docs/configuration/radio/security/#:~:text=Managed%20Mode%E2%80%8B&text=Enabling%20Managed%20Mode%20blocks%20client,firmware%20prior%20to%20version%202.5. ) which would then prevent the user from changing the radio settings.

So this is almost doable today ...

[dkastl]

Thanks a lot!
I already knew about the userPrefs.jsonc and tried some settings, which is really useful.

I also like the idea to implement this similar to the "managed mode", but limited to radio settings.

Another idea: many (or maybe all?) Android phones have a developer mode, that can be enabled by tapping the "build number" seven times, which makes developer options available.