Class Updater

Creates an updater for a device with slotCount slots of slotCapacity bytes each, trusting anchorPublicKey as the root of every decision about who may update it.

The delegation this updater currently honours, or null when releases must be signed by the anchor itself.

The highest sequence number the device already holds.

How many slots this device has.

Adopts a delegation, so releases signed by the key it names are accepted.

Checks a manifest and opens the slot it names for a transfer in pieces.

Every check that can be made without the image runs here, so a release that is not for this device, would roll it back, or does not fit is refused before a byte of it is accepted. The envelope is remembered until finish, and each call after this one reopens the transfer from what the slot records, which is the same path a device takes after a reset.

Confirms the pending image, so it will be run from now on.

Finishes an opened image and marks the slot bootable if it matched.

Returns the slot now holding a staged image.

Decides what to run, and records that decision before returning it.

Call this once per boot, before jumping to an image. A staged image becomes pending here, so a device that resets before confirming reverts on the next call rather than trying a broken image forever.

Reports how much of an opened image has arrived.

Records that a slot already holds a confirmed image at a sequence number.

This is how a device that shipped with firmware says what it is running, so the rollback rule has something to compare against.

Fails the pending image and goes back to the confirmed one.

Reads what the device believes about one slot.

Checks a manifest and stages an image that is already held whole.

Returns the slot the image was staged into.

Takes the next piece of an image opened with begin.