OTA Architecture - Full vs Differential

"""UPTANE update verification (simplified reference implementation)."""
import hashlib
import json
from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.exceptions import InvalidSignature

class UptaneVerifier:
    """Verify UPTANE metadata before applying OTA update."""

    def __init__(self, root_key_path: str):
        with open(root_key_path, "rb") as f:
            self.root_key = serialization.load_pem_public_key(f.read())

    def verify_targets_metadata(self, metadata_json: str,
                                signature_bytes: bytes) -> dict:
        """Verify targets.json signature against OEM root key."""
        try:
            self.root_key.verify(
                signature_bytes,
                metadata_json.encode(),
                ec.ECDSA(hashes.SHA256())
            )
        except InvalidSignature:
            raise RuntimeError("UPTANE metadata signature invalid -- abort update")

        metadata = json.loads(metadata_json)
        return metadata

    def verify_image_hash(self, image_path: str,
                          expected_sha256: str) -> bool:
        """Verify downloaded image integrity before flash."""
        sha256 = hashlib.sha256()
        with open(image_path, "rb") as f:
            for chunk in iter(lambda: f.read(65536), b""):
                sha256.update(chunk)
        actual = sha256.hexdigest()
        if actual != expected_sha256:
            raise RuntimeError(
                f"Image hash mismatch: expected {expected_sha256}, "
                f"got {actual} -- do not flash")
        return True

    def check_anti_rollback(self, new_version: int,
                            current_version: int) -> bool:
        """Prevent downgrade attacks."""
        if new_version <= current_version:
            raise RuntimeError(
                f"Anti-rollback: version {new_version} <= "
                f"current {current_version} -- abort")
        return True