Enrico Jörns

OTA updates should happen frequently and install quickly even with growing OS and application sizes at limited data throughput and limited on-target storage. Untrusted cloud storage or communication channels also increase the need for encryption.

This talk will give an overview of how the RAUC update framework had to overcome some limitations of the early design to address these challenges without compromising its original goals.

In 2015, the RAUC update framework was started as an Open Source project to end the era of home-grown shell-script Embedded Linux and IoT system update 'solutions'. More than seven years later, RAUC has been used in many diverse projects, of which Valve's Steam Deck is probably the most widely known.

The focus of this talk will be the introduction of the 'verity' update bundle format in RAUC that has not only improved the verification process but has also allowed extending RAUC by built-in HTTP(S) network streaming support, adaptive delta-like updates, and full bundle encryption.

Driven by the frequent demand to allow decoupling more frequent app or container updates from full A/B OS updates, the talk will give an outlook on recent developments about reconciling this with RAUC's principles.

Over the past three years, the growing zoo of Open Source update frameworks made updating an embedded Linux system much easier. But, the availability of a robust update tool solves only one step in the complex chain from a software artifact to an updated and working system on your devices.

Starting with a modern system consisting of a recent bootloader, kernel, init system and update tool, this talk ventures beyond the basic and already solved topics of A/B redundancy, atomicity, or simple update verification.

Enrico will present strategies for creating a robust update chain from automated testing up to full rollout management and show how to solve these challenges with recent Open Source software such as barebox, RAUC, systemd, hawkBit, casync and labgrid. You will learn how to deal with more modular and complex system setups, restricted systems, error recovery, product variants, resigning for deployment, updating the bootloader itself and interaction with verified boot.

Recent DDoS attacks powered by embedded devices have finally discredited the old excuse that security is not important: security support (and thus software updates) is suddenly a required feature.

Often, physical access to these devices is limited and there is no administrator who can fix issues manually. Thus, performing updates is an operation with a critical design goal: Never brick the device!

This talk gives an overview of the surprisingly complex requirements and common pitfalls for a generic update mechanism by comparing several existing approaches. Also, our reasons for implementing (yet another) tool and the reasoning behind the design choices are explained.

Using RAUC and other open source update tools as examples, requirements, limitations and possible pitfalls in the process of designing and implementing a redundancy and update infrastructure will be presented. You will also get a brief overview over RAUCs design and abstraction of the underlying system that allows to manage both simple asymmetric setups consisting of a full system and an initramfs-based recovery system as well as complex setups with multiple root filesystems, application and data storage partitions.

• How to make updates atomic?
• How to manage both simple and complex redundancy concepts?
• How to allow secure and trusted updates?
• How to schedule updates to a large number of devices?