Module block 

Carrying a signed update inside one data block, for a transport that moves blocks.

A fragmented transport such as LoRaWAN’s TS004 hands a device one block of bytes and says nothing about what is in it: the specification leaves that to the vendor, and gives the server a four-byte descriptor to name whatever convention the two ends share. This is that convention for a pamoja update.

A block is the signed manifest and the image it describes, one after the other, behind a short header that says which is which:

"PJU1" | envelope length, two bytes | envelope | image

Nothing here is trusted. The header only says where the two halves are; every rule that decides whether the image runs is the manifest’s, checked by the updater as always, so a block that arrives over a broadcast nobody authenticated is no more dangerous than one fetched over a wire.

Examples

A server frames an update, and a device stages what came out of its transport:

use pamoja_update::block::{frame, split, DESCRIPTOR};

let envelope = b"a signed manifest";
let image = b"the firmware";
let mut block = [0u8; 64];
let len = frame(envelope, image, &mut block)?;

let (read_envelope, read_image) = split(&block[..len])?;
assert_eq!(read_envelope, envelope);
assert_eq!(read_image, image);
assert_eq!(&DESCRIPTOR, b"PJU1", "what the transport calls this block");

Constants

DESCRIPTOR

What a transport calls a block in this shape, for a field that names the convention.

HEADER_LEN

The bytes the header takes: the descriptor and the envelope length.

Functions

frame

Writes a signed update into one block.

split

Reads a block back into the signed manifest and the image.