Craton Shield

vs-ota-validator

TUF/Uptane OTA update validation with rollback protection.

Overview

This crate validates over-the-air firmware updates following TUF (The Update Framework) and Uptane principles. It performs threshold-of-N signature verification on root metadata, enforces rollback protection via monotonic version counters, and verifies firmware target hashes before installation.

Key Types

  • OtaValidator<C> — stateful validator over a [CryptoProvider], holding the trusted root and an in-memory rollback counter
  • PersistentOtaValidator<C, S> — same, but persists the rollback counter through a [StorageProvider] backend (flash/EEPROM)
  • HsmOtaValidator<C, R> — uses a [RollbackCounter] (typically backed by HSM OTP fuses) for permanently-irreversible rollback protection
  • TufRoot — trusted root metadata defining signing keys and thresholds per role
  • TufKey — a public key with fingerprint, algorithm, and key material
  • TufRole — TUF metadata roles (Root, Targets, Snapshot, Timestamp)
  • RollbackCounter — trait for monotonic version counter backends (HSM or software)

Usage

use vs_ota_validator::{OtaValidator, TufRoot};
use vs_types::VsError;

// `crypto` is any `vs_crypto::CryptoProvider`, `root` is a `TufRoot`.
fn install(crypto: impl vs_crypto::CryptoProvider, root: TufRoot) -> Result<(), VsError> {
    let validator = OtaValidator::new(crypto, root)?;

    // Verify a firmware blob against its expected SHA-256 hash and length.
    let expected_hash = [0u8; 32];
    let firmware_bytes: &[u8] = b"...";
    validator.verify_target(&expected_hash, firmware_bytes.len() as u64, firmware_bytes)?;
    Ok(())
}

Feature Flags

  • default = [] — core verification only (no_std, no allocation).
  • json — enables the json module for parsing TUF metadata from canonical JSON byte slices (parse_tuf_root_with_hash, parse_signed_metadata, parse_tuf_timestamp, parse_tuf_snapshot, parse_tuf_targets). Pulls in serde and serde-json-core.

License

Apache-2.0. See LICENSE.