Function pamoja_updater_begin 

#[unsafe(no_mangle)]
pub unsafe extern "C" fn pamoja_updater_begin(
    updater: *mut PamojaUpdater,
    envelope: *const u8,
    envelope_len: usize,
    has_now: bool,
    now: u64,
    out_slot: *mut u8,
) -> PamojaStatus

Checks a manifest and opens the slot it names for a transfer in pieces.

Every check that can be made without the image runs here, so a release that is not for this device, would roll it back, or does not fit is refused before a byte of it is accepted.

The envelope is remembered until pamoja_updater_finish, so the calls that follow do not repeat it. Each of those reopens the transfer from what the slot records, which is the same path a device takes after a reset, and is what lets a transfer survive one.

Arguments

• updater - the updater.
• envelope - the signed manifest offered to this device.
• envelope_len - the length of envelope.
• has_now - true if the device has a clock.
• now - seconds since the Unix epoch, read only when has_now is true.
• out_slot - receives the slot the image will be written into.

Returns

PamojaStatus::Ok on success.

Safety

updater must be a live handle from pamoja_updater_new, envelope must point to at least envelope_len readable bytes or be null when it is 0, and out_slot must be writable or null.