Function pamoja_updater_begin 

#[unsafe(no_mangle)]
pub unsafe extern "C" fn pamoja_updater_begin(
    updater: *mut PamojaUpdater,
    envelope: *const u8,
    envelope_len: usize,
    has_now: bool,
    now: u64,
    out_slot: *mut u8,
) -> PamojaStatus

Checks a manifest and opens the slot it names for a transfer in pieces.

Every check that can be made without the image runs here, so a release that is not for this device, would roll it back, or does not fit is refused before a byte of it is accepted.

The envelope is remembered until pamoja_updater_finish, so the calls that follow do not repeat it. Each of those checks it again, so a release overtaken or expired while it arrives stops arriving, and each carries the hash of what has arrived to the next, so an image taken in many small pieces costs no more than one taken whole.

Arguments

• updater - the updater.
• envelope - the signed manifest offered to this device.
• envelope_len - the length of envelope.
• has_now - true if the device has a clock.
• now - seconds since the Unix epoch, read only when has_now is true.
• out_slot - receives the slot the image will be written into.

Returns

PamojaStatus::Ok on success.

Safety

updater must be a live handle from pamoja_updater_new, envelope must point to at least envelope_len readable bytes or be null when it is 0, and out_slot must be writable or null.