Re: [RAUC] RAUC update systems with release keys

["Jan Lübbe" <jlu@pengutronix.de>]

Hi Reyhaneh,

On Mon, 2022-03-14 at 08:08 +0000, Yazdani, Reyhaneh wrote:
> Hello,
>  
> Currently we have some devices which are programmed with development keys in
> the past.
> Now, we need to use them as final devices with bundle signed with release
> keys. 
> I copied cert file manually to the certificate path in rootfs and try to use
> rauc install command to program the device with release-bundle, but it fails.

Just to avoid misunderstandings: You replaced your /etc/rauc/keyring.pem (or
another keyring path as configured in your system.com) with the release keyring?

Did you restart the rauc service?

> What would be the correct procedure to bring development-devices into final-
> devices?

Your approach should work in general, but there are others.

You could also have the release CA certificate as a second cert in the
development image keyring. In that case, you should be careful with migrations,
though, as you probably want to avoid unexpected leftovers from development
software.

Regards,
Jan
-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

_______________________________________________
RAUC mailing list