Re: [Suit] SUIT manifest: suit-parameter-uri ... reference?

[Brendan Moran <[e-mail]>]

Hi Christian,

I understand what you’re trying to achieve here. But is it necessarily the right way to do things? SUIT has a mechanism for replacing URIs if and only if the manifest author permits it. Do you think that a URI Reference is necessarily a better choice than that here?

I have several concerns with URI References: 1) They leave the “relative to what” question very murky when a manifest is received via a push operation. 2) They could leave the recipient with no way to fetch the payload except, maybe, attempting to fetch it from the canonical manifest reference URI + URI Reference.

In the USB-Stick scenario, it seems better, but that leaves out the possibility of simply bundling the manifest with the payload in the envelope, which is preferred in filesystem-type deployments.

Best Regards,
Brendan

> On 23 Feb 2021, at 16:07, Christian M. Amsüss <[e-mail]> wrote:
>
> Hello SUIT authors,
>
> toying with the RIOT implementation of SUIT I was surprised it required
> the suit-parameter-uri that points from the manifest to the firmware to
> not support relative references, even though in their deployment the
> device obtains the manifest from the web.
>
> The current wording in suit-manifest is ambiguous to me: On the one hand
> it says "a URI" (and not "a URI reference"), on the other hand it
> compares it to Tag 32 (which is somewhat misleadingly named "URI" but
> described to match URI-reference), and makes rules about fragment-only
> references.
>
> Some clarification (saying "A URI reference from which" could suffice)
> would help here.
>
> If this is more than an editorial oversight (that is, if
> neither-full-nor-fragment references have not been considered), I hope
> that relative references stay allowed, as they are useful during ad-hoc
> network situations.
>
> Best regards
> Christian
>
> --
> To use raw power is to make yourself infinitely vulnerable to greater powers.
>  -- Bene Gesserit axiom

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.