Module update 

The C ABI for signed firmware updates.

These functions wrap [pamoja_update] for callers that reach the SDK through the flat C boundary. Two audiences meet here. A build server signs a manifest and a delegation, which is all value math over PamojaManifest and PamojaDelegation. A device decides what to accept, which needs the slots it keeps images in, so an updater crosses as an opaque handle.

The updater is built over the in-memory slot store. The Rust crate takes any store through a trait, and a trait cannot cross a C ABI, so a caller wiring real flash writes that in Rust; what crosses here is the whole of the decision logic, which is the part that has to be right.

Structs

PamojaBoot

The decision a device made at boot, already recorded before it was returned.

PamojaDelegation

A statement, signed by the anchor, that a second key may sign releases.

PamojaDevice

Who a device is, and whose signature it trusts.

PamojaImageVerifier

An opaque handle that hashes an image as it arrives.

PamojaManifest

What a release says about itself, and what a device checks it against.

PamojaSlotRecord

The record a device keeps about one slot, durable across a reboot.

PamojaUpdater

An opaque handle to a device slots and the rules applied to them.

Enums

PamojaBootAction

What a bootloader should do with what it found.

PamojaSlotState

What a device believes about one slot.

Constants

PAMOJA_UPDATE_DIGEST_LEN

The length in bytes of an image digest.

PAMOJA_UPDATE_FORMAT_RAW

The payload format meaning the payload is the image itself, byte for byte.

PAMOJA_UPDATE_ID_LEN

The length in bytes of a vendor or device-class identifier.

PAMOJA_UPDATE_STRUCTURE_VERSION

The manifest structure version this build writes.

Functions

pamoja_delegation_open^⚠

Opens a signed delegation against the anchor that should have signed it.

pamoja_delegation_sign^⚠

Signs a delegation, naming a release key the anchor stands behind.

pamoja_envelope_body^⚠

Copies out the signed body of an envelope, without checking the signature.

pamoja_envelope_verify^⚠

Verifies an envelope against a key and reads the manifest inside it.

pamoja_image_digest^⚠

Creates a verifier that hashes an image against what a manifest declares.

pamoja_image_verifier_finish^⚠

Settles an image against its manifest, consuming the verifier.

pamoja_image_verifier_free^⚠

Releases a verifier handle that will not be settled.

pamoja_image_verifier_new

a payload format this build cannot apply.

pamoja_image_verifier_update^⚠

Takes the next piece of the image.

pamoja_manifest_decode^⚠

Reads a manifest body back from its bytes.

pamoja_manifest_encode

Encodes the body of a manifest, which is the part a signature covers.

pamoja_manifest_sign^⚠

Signs a manifest into the envelope that is offered to a device.

pamoja_updater_adopt^⚠

Adopts a delegation, so releases signed by the key it names are accepted.

pamoja_updater_begin^⚠

Checks a manifest and opens the slot it names for a transfer in pieces.

pamoja_updater_confirm^⚠

Confirms the pending image, so it will be run from now on.

pamoja_updater_delegation^⚠

Reads the delegation an updater currently honours.

pamoja_updater_finish^⚠

Finishes an opened image and marks the slot bootable if it matched.

pamoja_updater_free^⚠

Releases an updater handle.

pamoja_updater_installed_sequence^⚠

Reads the highest sequence number the device already holds.

pamoja_updater_new

Creates an updater over a device slots.

pamoja_updater_on_boot^⚠

Decides what to run, and records that decision before returning it.

pamoja_updater_progress^⚠

Reports how much of an opened image has arrived.

pamoja_updater_provision^⚠

Records that a slot already holds a confirmed image at a sequence number.

pamoja_updater_revert^⚠

Fails the pending image and goes back to the confirmed one.

pamoja_updater_slot_count^⚠

Returns how many slots a device has.

pamoja_updater_slot_record^⚠

Reads what a device believes about one slot.

pamoja_updater_stage^⚠

Checks a manifest and stages an image that is already held whole.

pamoja_updater_write^⚠

Takes the next piece of an image opened with pamoja_updater_begin.