Over-the-Air Updates¶

ToloMEO edge devices receive OTA updates via SWUpdate. Update packages are signed compound archives containing a manifest, its cryptographic signature, and the update images. Two package types are available: full updates and delta updates.

Once built Updates can be uploaded directly through the PMS following the update flow

Update control¶

An update is not a single blind operation: once a device is notified of an available update it can be told to download, install, pause, resume, or abort it, and the current stage is reported back so an operator can follow progress. These controls are available from the device detail page in Fleet Manager. Downloads are resumable: if the device loses power or connectivity mid-transfer, it picks the download back up from where it left off rather than starting over.

A/B partitioning¶

The device uses an A/B partition layout. Updates are written to the inactive partition, and the bootloader switches to it only after a successful post-boot validation. If validation fails, the device rolls back to the previously active partition automatically.

Full update¶

A full update replaces the complete root filesystem and other system components. Use it for major updates or recovery scenarios.

Delta update¶

A delta update packages only the binary differences between two versions using rdiff patches. It reduces the necessary bandwidth regular OTA releases on the field.

Signing keys¶

Update packages must be signed and the corresponding public key is embedded in the image during the build so SWUpdate can verify incoming packages. Two signing mechanisms are supported, selectable at build time: a plain RSA key pair, or CMS signing backed by an X.509 certificate. Keys for automatic builds in the Embedded Manager are handled through secure pathways. See Hardening and Secure Boot for how to generate and configure signing keys for local builds.

Encrypted packages¶

On top of signing, update artifacts can optionally be AES-encrypted so their contents are protected both in transit and at rest on the device. This is an opt-in build feature; when enabled the build produces an encrypted variant of the update package that the device decrypts with a key provisioned into the image.