Class Updater

Creates an updater for a device with slotCount slots of slotCapacity bytes each, trusting anchorPublicKey as the root of every decision about who may update it.

The delegation this updater currently honors, or null when releases must be signed by the anchor itself.

The highest sequence number the device already holds.

How many slots this device has.

Adopts a delegation, so releases signed by the key it names are accepted.

Checks a manifest and opens the slot it names for a transfer in pieces.

Every check that can be made without the image runs here, so a release that is not for this device, would roll it back, or does not fit is refused before a byte of it is accepted. The envelope is remembered until finish, and every call after this one checks it again, so a release overtaken or expired while it arrives stops arriving. The hash of what has arrived is carried from one call to the next, so an image taken in many small pieces costs no more than one taken whole.

Confirms the pending image, so it will be run from now on.

Finishes an opened image and marks the slot bootable if it matched.

Returns the slot now holding a staged image.

Decides what to run, and records that decision before returning it.

Call this once per boot, before jumping to an image. A staged image becomes pending here, so a device that resets before confirming reverts on the next call rather than trying a broken image forever.

Reports how much of an opened image has arrived.

Records that a slot already holds a confirmed image at a sequence number.

This is how a device that shipped with firmware says what it is running, so the rollback rule has something to compare against.

Fails the pending image and goes back to the confirmed one.

Reads what the device believes about one slot.

Checks a manifest and stages an image that is already held whole.

Returns the slot the image was staged into.

Takes the next piece of an image opened with begin.