search

zigbee-alliance / distributed-compliance-ledger

DCL is a public permissioned ledger framework for certification of device models. The ledger is based on Cosmos SDK and CometBFT (Tendermint).
Apache License 2.0
89 stars 44 forks source link

Validate "OtaChecksum" is base64 encoded when adding a Model-Version entry #570

Closed jcps07 closed 6 months ago

jcps07 commented 7 months ago

From conversation in PR #33256:

May 1, 2024

We've seen a few cases where a software update is posted in the DCL and the OtaChecksum is not base64 encoded. What do you think about adding a test that verifies at least that all the software versions for this device model have a correctly formatted checksum? Could potentially also verify other fields as well but this one in particular feels especially important.

I'd be good to add this validation at dcld stage, as it's a requirement by the Matter Spec:

OtaChecksum OtaChecksum SHALL contain the digest of the entire contents of the associated OTA Software Update Image under the OtaUrl field, encoded in base64 string representation. The digest SHALL have been computed using the algorithm specified in OtaChecksumType. This field SHALL be provided if the OtaUrl field is populated.

akarabashov commented 6 months ago

PR: https://github.com/zigbee-alliance/distributed-compliance-ledger/pull/572