Struct Manifest 

pub struct Manifest {
    pub structure_version: u8,
    pub sequence: u64,
    pub vendor_id: [u8; 16],
    pub class_id: [u8; 16],
    pub format: PayloadFormat,
    pub storage: u8,
    pub digest: [u8; 32],
    pub size: u32,
    pub expires: u64,
}

What an update claims about itself.

Examples

use pamoja_security::DeviceIdentity;
use pamoja_update::{Envelope, Manifest, PayloadFormat, ENVELOPE_MAX};

let author = DeviceIdentity::from_seed(&[1u8; 32]);
let manifest = Manifest {
    structure_version: pamoja_update::STRUCTURE_VERSION,
    sequence: 7,
    vendor_id: [0xab; 16],
    class_id: [0xcd; 16],
    format: PayloadFormat::Raw,
    storage: 0,
    digest: [0x11; 32],
    size: 4096,
    expires: 0,
};

let mut buf = [0u8; ENVELOPE_MAX];
let written = manifest.sign(&author, &mut buf).unwrap();

let envelope = Envelope::decode(&buf[..written]).unwrap();
let checked = envelope.verify(&author.public()).unwrap();
assert_eq!(checked.sequence, 7);

Fields

structure_version: u8

Which iteration of the manifest format this is.

sequence: u64

Rises with every release. A device refuses anything not above what it runs, which is what stops a captured older image being replayed at it.

vendor_id: [u8; 16]

Who built the image.

class_id: [u8; 16]

Which kind of device it is for.

format: PayloadFormat

How the payload is encoded.

storage: u8

Which slot the payload belongs in.

digest: [u8; 32]

The SHA-256 of the payload. Every other guarantee rests on this one.

size: u32

The payload’s length in bytes, known before a single byte is accepted.

expires: u64

When this release stops being offered, in seconds since the Unix epoch, or 0 to never expire.

A sequence number alone cannot protect a device that has been offline for a long time: an attacker can hand it a release that is genuinely newer than the one it runs, but old enough to have a known flaw, and the device has no way to know a better one exists. An expiry bounds how long such a release stays usable. Setting one requires the device to have a clock.

Implementations

impl Manifest

pub fn encode(&self, buf: &mut [u8]) -> Result<usize>

Encodes the manifest body, which is the part a signature covers.

Arguments

• buf - the destination, at least MANIFEST_MAX bytes.

Returns

How many bytes were written.

Errors

Returns Refusal::Malformed if buf is too small.

pub fn decode(bytes: &[u8]) -> Result<Self>

Decodes a manifest body.

Arguments

• bytes - an encoded manifest body.

Returns

The manifest.

Errors

Returns Refusal::Malformed if the encoding is not a well-formed manifest with its keys in order, or Refusal::UnsupportedVersion if it announces a structure version or payload format this build cannot apply.

pub fn sign(&self, author: &DeviceIdentity, buf: &mut [u8]) -> Result<usize>

Encodes the manifest and signs it, producing an envelope.

Arguments

• author - the identity releasing the update.
• buf - the destination, at least ENVELOPE_MAX bytes.

Returns

How many bytes of buf the envelope occupies.

Errors

Returns Refusal::Malformed if buf is too small.

Trait Implementations

impl Clone for Manifest

fn clone(&self) -> Manifest

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for Manifest

impl Debug for Manifest

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for Manifest

impl PartialEq for Manifest

fn eq(&self, other: &Manifest) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for Manifest