RAUC: (R)evolution of an Update Framework
summary
RAUC is an image-based update framework that replaces shell‑script updaters and now uses a new verity bundle format that stores a dm‑verity root hash in the manifest so the target verifies only the manifest (avoids TOCTOU) and mounts the squashfs on demand. It adds bundle streaming via HTTP range requests (libcurl) to write directly to the target, supports adaptive block-hash index incremental updates to copy local blocks before fetching remote ones, and adds dm‑crypt payload encryption; uses OpenSSL/CMS, glib, squashfs, fixed the TOCTOU bug in v1.5 and is used in production (e.g. Steam Deck).
AI-written summary · about
chapters (24)
- 0:00Intro
- 0:55Structure
- 4:11RAUC - Configuration Basics
- 5:29Authenticated Artifacts
- 6:15Initial Bundle Format - Generation
- 7:07Initial Bundle Format - Verification
- 7:52CVE-2020-25860
- 9:31Background: Kernel Device Mapper
- 10:26Kernel Device Mapper - dm-verity
- 12:08New verity Bundle Format - Generation
- 13:04New verity Bundle Format - Verification
- 13:55Bundle Download vs. Bundle Streaming
- 16:11Delta Updates vs. RAUC Adaptive Updates
- 18:33Adaptive: block-hash-index Updates
- 22:29Bundle Encryption
- 23:30dm-crypt - Block Device Decryption
- 25:56Bundle Decryption (Installation)
- 26:42Supported Encryption Use Cases
- 27:58Custom Meta-Data in Manifest
- 28:58Installation History / Event Logging
- 29:46Life Cycle Handling
- 32:35Ecosystem: rauc-hawkbit-updater
- 33:26Community: meta-rauc-community
- 38:10Encrypted Bundle - Generation
related talks
45mBehind the Scenes of an Update Framework: RAUC
41mDelta Updates: Making Updates Leaner
43mPractical Experience with Linux A/B Upgrades- 41mDelta Updates: Making Updates Leaner
56mComparison of Linux Software Update Technologies
45mSoftware Update for IoT: The Current State of Play
51mUsing SWUpdate to Upgrade Your System
44mUpdating an Embedded System with SWUpdate Framework