Update packages

Products built with meta-rauc, meta-swupdate or meta-mender ship signed update packages. An update writes a slot: use a bench board, never a vehicle or field unit.

State: modelled with RAUC 1.11.3 (rauc bundle and rauc info; a real install through RAUC's service with file-backed slots, run locally, where the predicted slots equalled the slots written), SWUpdate 2023.12.1 (swupdate -i of a CMS-signed .swu on a BusyBox stand-in board over OpenSSH 9.6p1), the Mender client 3.4.0 (standalone install and commit on the stand-in) and mender-artifact 3.9.0; signatures checked with right, wrong and unusable trust anchors; bitbake -e with meta-rauc scarthgap; the running app. Not run on a real board with a reboot into the new slot, RAUC over SSH to a board, verity bundles, the Mender client 4, Mender rootfs-image installs, interrupted installs and rollback, PKCS#11 signing in a build, Windows, a real build server or Wind River Linux. Copy speed on localhost was about 0.5 MiB/s through the laptop and 12 MiB/s from the build host.

Open a package

Open Update Package picks a RAUC bundle, SWUpdate image or Mender artifact from the build's deploy folders. It is read on the build host with rauc info, the module's own .swu reader with openssl, or mender-artifact read, and the editor shows:

• the signature verdict, the certificates in the signature compared with the build's, and the trust anchor;
• the keys as the recipe names them (files or PKCS#11 URIs), with each variable's file and line; a private key is named, never read, and a PKCS#11 PIN is never shown;
• the images with their SHA-256; SWUpdate's software sets and what each writes; Mender's payloads, device types and provides;
• the recipe's variables from bitbake -e, and RAUC's product system.conf (slots, bootloader, compatible, keyring) at its lines.

Verify Update Package With... checks the signature against another trust anchor.

Build a package

Build Update Package builds a bundle or update image recipe you pick with BitBake; the package opens afterwards.

Install on a bench board

1. In Targets, right-click the board and run Install Update Package on Target... (or Install on Target... in the editor).
2. Pick how the package gets there: Through This Computer (in pieces over this computer's SSH sessions) or From the Build Host (with the build host's own ssh, as devtool deploy-target copies). Pick a folder on the board with enough space.
3. The installation is planned from the board's own client: rauc status, the board's SWUpdate configuration (/etc/swupdate/conf.d), or Mender's device type. The confirmation names the board, the package, its SHA-256 and the slots or devices that will be written.
4. The package is copied, checked by SHA-256 on the board, and installed with rauc install, swupdate -i, mender-update install or mender install, with progress.
5. Show Update Status of Target shows the slot states before and after; reboot from the editor to start the updated slot.
6. For Mender, Commit Mender Update on Target... keeps the update and Roll Back Mender Update on Target... returns to the previous one.

Agent tools

Packages, update recipes, a package with its signature and a board's update status are read-only tools. Installing, committing and rolling back always ask first with the board, the package and its SHA-256, and what is written.

Next: Package feeds.