| ID | product.edge.edge_agent.ota_updater |
|---|---|
| Description | Applies signed firmware / config updates. |
| Key | ota_updater |
| Type | component |
| Team | Edge Platform |
| Owner | edge-platform@iotgateway.example |
| Status | beta |
| Technologies | Rust, TLS |
| Attributes | language: Rust, rollback: A/B, signing: Ed25519 |
| Tags |
The OTA Updater is the only component allowed to change what software runs on the gateway. The cloud never pushes bits directly; instead it announces an update, and the updater pulls it, proves it is genuine, and applies it to a spare slot it can roll back to.
Beta: A/B rollback
The A/B slot strategy is currently rolling out across hardware revisions. Older single-slot gateways fall back to a verify-then-replace path without automatic rollback, so this component is marked beta until the fleet is fully on dual-slot images.
Every artifact is checked against an Ed25519 signature over TLS-fetched bytes. A failed signature aborts the update — nothing is written to a boot slot.
The new image is written to the inactive slot. The running system is never mutated in place, so a bad flash cannot brick the box.
After booting the new slot the device runs a health check window. Only a clean pass commits the slot; a failure (or watchdog reboot) flips back to the known-good slot automatically.
This component is the device-side terminus of the firmware rollout: