mail archive of the rauc mailing list
 help / color / mirror / Atom feed
From: "Yazdani, Reyhaneh" <RYazdani@data-modul.com>
To: "Jan Lübbe" <jlu@pengutronix.de>,
	"rauc@pengutronix.de" <rauc@pengutronix.de>
Subject: Re: [RAUC] RAUC update systems with release keys
Date: Mon, 14 Mar 2022 09:40:43 +0000	[thread overview]
Message-ID: <d35f4cc0d80b470a92507dda9212d27e@data-modul.com> (raw)
In-Reply-To: <795a88c90d228b8e234fbc2831daf08d050145ad.camel@pengutronix.de>

Hi Jan,

Thanks for quick response.

> -----Ursprüngliche Nachricht-----
> Von: Jan Lübbe <jlu@pengutronix.de>
> Gesendet: Montag, 14. März 2022 09:39
> An: Yazdani, Reyhaneh <RYazdani@data-modul.com>; rauc@pengutronix.de
> Betreff: Re: [RAUC] RAUC update systems with release keys
> 
> Hi Reyhaneh,
> 
> On Mon, 2022-03-14 at 08:08 +0000, Yazdani, Reyhaneh wrote:
> > Hello,
> >
> > Currently we have some devices which are programmed with development
> > keys in the past.
> > Now, we need to use them as final devices with bundle signed with
> > release keys.
> > I copied cert file manually to the certificate path in rootfs and try
> > to use rauc install command to program the device with release-bundle,
> but it fails.
> 
> Just to avoid misunderstandings: You replaced your /etc/rauc/keyring.pem
> (or another keyring path as configured in your system.com) with the release
> keyring?

[Reyhaneh] Yes, I replaced the old /etc/rauc/rauc.cert.pem (which the path is defined in system.conf) with the new one.
> 
> Did you restart the rauc service?
[Reyhaneh] Yes. I ran systemctl restart rauc
> 
> > What would be the correct procedure to bring development-devices into
> > final- devices?
> 
> Your approach should work in general, but there are others.
> 
> You could also have the release CA certificate as a second cert in the
> development image keyring. In that case, you should be careful with
> migrations, though, as you probably want to avoid unexpected leftovers
> from development software.
If I want to do resign the bundle instead of bitbaking to have new bundle with release key, then I should use 
"rauc resign" command. Yes? Is the below command correct?

rauc resign --cert=new-cert --key=new-key --keyring=old-keyring input-bundle output-bundle

Best regards,
Reyhaneh

> 
> Regards,
> Jan
> --
> Pengutronix e.K.                           |                             |
> Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
> 31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
> Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |
_______________________________________________
RAUC mailing list

  reply	other threads:[~2022-03-14  9:41 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <b098c3e50a5549f984c64e4197f80dd1@data-modul.com>
2022-03-14  8:39 ` Jan Lübbe
2022-03-14  9:40   ` Yazdani, Reyhaneh [this message]
2022-03-14 10:25     ` Jan Lübbe
2022-03-14 11:01       ` Yazdani, Reyhaneh

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=d35f4cc0d80b470a92507dda9212d27e@data-modul.com \
    --to=ryazdani@data-modul.com \
    --cc=jlu@pengutronix.de \
    --cc=rauc@pengutronix.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox