Fetching of databoxes must always use HashedURI to enforce hash checks.

sdk/src/claim.rs

@@ -733,15 +733,8 @@ impl Claim {
         &self.data_boxes
     }
 
-    pub fn find_databox(&self, uri: &str) -> Option<&DataBox> {
-        self.data_boxes
-            .iter()
-            .find(|(h, _d)| h.url() == uri)
-            .map(|(_sh, data_box)| data_box)
-    }
-
     /// Load known VC with optional salt
-    pub(crate) fn put_data_box(
+    pub(crate) fn put_databox(
         &mut self,
         label: &str,
         databox_cbor: &[u8],
@@ -765,24 +758,24 @@ impl Claim {
         Ok(())
     }
 
-    pub fn get_data_box(&self, uri: &str) -> Option<&DataBox> {
+    pub fn get_databox(&self, hr: &HashedUri) -> Option<&DataBox> {
         // normalize uri
-        let normalized_uri = if let Some(manifest) = manifest_label_from_uri(uri) {
+        let normalized_uri = if let Some(manifest) = manifest_label_from_uri(&hr.url()) {
             if manifest != self.label() {
                 return None;
             }
-            uri.to_owned()
+            hr.url()
         } else {
             // make a full path
-            if let Some(box_name) = box_name_from_uri(uri) {
+            if let Some(box_name) = box_name_from_uri(&hr.url()) {
                 to_databox_uri(self.label(), &box_name)
             } else {
                 return None;
             }
         };
 
         self.data_boxes.iter().find_map(|x| {
-            if x.0.url() == normalized_uri {
+            if x.0.url() == normalized_uri && vec_compare(&x.0.hash(), &hr.hash()) {
                 Some(&x.1)
             } else {
                 None

sdk/src/ingredient.rs

@@ -1031,7 +1031,7 @@ impl Ingredient {
                         })
                 }
                 uri if uri.contains(jumbf::labels::DATABOXES) => store
-                    .get_data_box_from_uri_and_claim(&hashed_uri.url(), &target_claim_label)
+                    .get_data_box_from_uri_and_claim(hashed_uri, &target_claim_label)
                     .map(|data_box| {
                         ingredient.resources.add_uri(
                             &hashed_uri.url(),
@@ -1057,7 +1057,7 @@ impl Ingredient {
 
         if let Some(data_uri) = ingredient_assertion.data.as_ref() {
             let data_box = store
-                .get_data_box_from_uri_and_claim(&data_uri.url(), claim_label)
+                .get_data_box_from_uri_and_claim(data_uri, claim_label)
                 .ok_or_else(|| {
                     error!("failed to get {} from {}", data_uri.url(), ingredient_uri);
                     Error::AssertionMissing {

sdk/src/resource_store.rs

@@ -74,8 +74,7 @@ impl UriOrResource {
         match self {
             UriOrResource::ResourceRef(r) => Ok(UriOrResource::ResourceRef(r.clone())),
             UriOrResource::HashedUri(h) => {
-                let uri = crate::jumbf::labels::to_absolute_uri(claim.label(), &h.url());
-                let data_box = claim.find_databox(&uri).ok_or(Error::MissingDataBox)?;
+                let data_box = claim.get_databox(h).ok_or(Error::MissingDataBox)?;
                 let resource_ref =
                     resources.add_with(&h.url(), &data_box.format, data_box.data.clone())?;
                 Ok(UriOrResource::ResourceRef(resource_ref))

sdk/src/store.rs

@@ -43,10 +43,11 @@ use crate::{
     error::{Error, Result},
     external_manifest::ManifestPatchCallback,
     hash_utils::{hash_by_alg, vec_compare, verify_by_alg},
+    hashed_uri::HashedUri,
     jumbf::{
         self,
         boxes::*,
-        labels::{to_absolute_uri, ASSERTIONS, CREDENTIALS, DATABOXES, SIGNATURE},
+        labels::{ASSERTIONS, CREDENTIALS, DATABOXES, SIGNATURE},
     },
     jumbf_io::{
         get_assetio_handler, is_bmff_format, load_jumbf_from_stream, object_locations_from_stream,
@@ -415,25 +416,14 @@ impl Store {
     /// Relative paths will use the provenance claim to resolve the DataBox.d
     pub fn get_data_box_from_uri_and_claim(
         &self,
-        uri: &str,
+        hr: &HashedUri,
         target_claim_label: &str,
     ) -> Option<&DataBox> {
-        match jumbf::labels::manifest_label_from_uri(uri) {
+        match jumbf::labels::manifest_label_from_uri(&hr.url()) {
             Some(label) => self.get_claim(&label), // use the manifest label from the thumbnail uri
             None => self.get_claim(target_claim_label), //  relative so use the target claim label
         }
-        .and_then(|claim| {
-            let uri = if target_claim_label != self.label() {
-                to_absolute_uri(target_claim_label, uri)
-            } else {
-                uri.to_owned()
-            };
-            claim
-                .databoxes()
-                .iter()
-                .find(|(h, _d)| h.url() == uri)
-                .map(|(_sh, data_box)| data_box)
-        })
+        .and_then(|claim| claim.get_databox(hr))
     }
 
     // Returns placeholder that will be searched for and replaced
@@ -1233,7 +1223,7 @@ impl Store {
 
                     let salt = db_desc_box.get_salt();
 
-                    claim.put_data_box(&label, db_cbor.cbor(), salt)?;
+                    claim.put_databox(&label, db_cbor.cbor(), salt)?;
                 }
             }
 
@@ -3420,6 +3410,7 @@ pub mod tests {
         assertion::AssertionJson,
         assertions::{labels::BOX_HASH, Action, Actions, BoxHash, Uuid},
         claim::AssertionStoreJsonFormat,
+        hashed_uri::HashedUri,
         jumbf_io::{get_assetio_handler_from_path, update_file_jumbf},
         status_tracker::*,
         utils::{
@@ -3903,14 +3894,15 @@ pub mod tests {
 
         for (uri, db) in claim1.databoxes() {
             // test full path
-            assert!(claim1.get_data_box(&uri.url()).is_some());
+            assert!(claim1.get_databox(uri).is_some());
 
             // test with relative path
             let rel_path = to_relative_uri(&uri.url());
-            assert!(claim1.get_data_box(&rel_path).is_some());
+            let rel_hr = HashedUri::new(rel_path, uri.alg(), &uri.hash());
+            assert!(claim1.get_databox(&rel_hr).is_some());
 
             // test values
-            assert_eq!(db, claim1.get_data_box(&uri.url()).unwrap());
+            assert_eq!(db, claim1.get_databox(uri).unwrap());
         }
     }
 
@@ -5622,7 +5614,7 @@ pub mod tests {
         // my manifest callback handler
         // set some data needed by callback to do what it needs to
         // for this example lets tell it which jumbf box we can to change
-        let my_assertion_path = to_normalized_uri(&to_absolute_uri(
+        let my_assertion_path = to_normalized_uri(&jumbf::labels::to_absolute_uri(
             &store.provenance_label().unwrap(),
             &my_assertion.url(),
         ));