Re: [Suit] SUIT manifest: suit-parameter-uri ... reference?

[Christian Amsüss <[e-mail]>]

Hello Brendan,

> I understand what you’re trying to achieve here. But is it necessarily
> the right way to do things? SUIT has a mechanism for replacing URIs if
> and only if the manifest author permits it. Do you think that a URI
> Reference is necessarily a better choice than that here?

There's two things to this really -- a) what I've been trying to do
(which is what RIOT does right now, and, with current knwoledge, may not
be ideal), and b) the ambiguity in the specification on what is
syntactically supposed to be here.

> I have several concerns with URI References: 1) They leave the
> “relative to what” question very murky when a manifest is received via
> a push operation. 2) They could leave the recipient with no way to
> fetch the payload except, maybe, attempting to fetch it from the
> canonical manifest reference URI + URI Reference.

For the "realtive to what" in ushes, RFC3986 has the default base URI,
which I suppose SUIT could define to be unusable. For not having a way
to fetch the payload ... well, in that there's no difference to the
application between a broken (because unresolvable because baseless)
relative reference and a URI of a scheme the device simply can't use.


Nevertheless, on a syntactic level, as long as both full URIs and
fragment-only references are accepted, what's in a suit-parameter-uri is
a URI reference, and should be labelled as such.

If, then, it is useful for SUIT to limit the usable references to the
shapes URI and "#" fragment, that's a valid choice, even if I may find
it oddly limiting.

It may instead make sense to state explicitly that there is no default
base URI, and that relative references that are neither URIs nor
fragment-only are only usable for manifests obtained through URI
dereferencing.

But at least that they are relative references IMO needs to be stated
clearly, for otherwise the mentions of fragment-only references in
section 7 make no sense.

BR
c

-- 
To use raw power is to make yourself infinitely vulnerable to greater powers.
  -- Bene Gesserit axiom