RAUC: Evolution of an Update Framework for Embedded Linux and IoT Systems

Explore the evolution of the RAUC update framework for Embedded Linux and IoT systems in this comprehensive conference talk. Dive deep into the project's journey from its inception in 2015 to its current status as a widely-used solution, including its implementation in Valve's Steam Deck. Learn about the challenges faced and overcome during development, focusing on maintaining the original goals of clear scope, flexibility, standard tool usage, and robust security. Discover the introduction of the 'verity' bundle format and its impact on features like HTTP(S) network streaming support, bundle encryption, and incremental updates. Gain insights into how RAUC leverages existing Linux kernel functionality, including verity and crypt device-mapper targets and network block device support. Examine current and potential future enhancements such as integrated life-cycle handling, installation history, group signatures, and rollout scheduling. Understand the technical aspects of RAUC, including configuration basics, authenticated artifacts, bundle generation and verification, kernel device mapper concepts, adaptive updates, and encryption use cases.

Intro
Structure
RAUC - Configuration Basics
Authenticated Artifacts
Initial Bundle Format - Generation
Initial Bundle Format - Verification
CVE-2020-25860
Background: Kernel Device Mapper
Kernel Device Mapper - dm-verity
New verity Bundle Format - Generation
New verity Bundle Format - Verification
Bundle Download vs. Bundle Streaming
Delta Updates vs. RAUC Adaptive Updates
Adaptive: block-hash-index Updates
Bundle Encryption
dm-crypt - Block Device Decryption
Bundle Decryption (Installation)
Supported Encryption Use Cases
Custom Meta-Data in Manifest
Installation History / Event Logging
Life Cycle Handling
Ecosystem: rauc-hawkbit-updater
Community: meta-rauc-community
Encrypted Bundle - Generation