SpecsModelExploreRequirements
SpecsModelExploreRequirements
OTA Updater
Overview
Guide
Twin streams
IDproduct.edge.edge_agent.ota_updater
DescriptionApplies signed firmware / config updates.
Keyota_updater
Typecomponent
Statusactive
TeamEdge Platform
Owner
edge-platform@iotgateway.example
TechnologiesRust, TLS
Tags
Table of contents
Guide
OTA Updater
Update lifecycle
Safety properties
Stage, don't overwrite
Probation
Related workflows
Requirements

Attributes

languageRust
rollbackA/B
rolloutbeta
signingEd25519

Guide

OTA Updater

The OTA Updater is the only component allowed to change what software runs on the gateway. The cloud never pushes bits directly; instead it announces an update, and the updater pulls it, proves it is genuine, and applies it to a spare slot it can roll back to.

Beta: A/B rollback

The A/B slot strategy is currently rolling out across hardware revisions. Older single-slot gateways fall back to a verify-then-replace path without automatic rollback, so this component is marked beta until the fleet is fully on dual-slot images.

Update lifecycle

Safety properties

Verify before trust

Every artifact is checked against an Ed25519 signature over TLS-fetched bytes. A failed signature aborts the update — nothing is written to a boot slot.

Stage, don’t overwrite

The new image is written to the inactive slot. The running system is never mutated in place, so a bad flash cannot brick the box.

Probation

After booting the new slot the device runs a health check window. Only a clean pass commits the slot; a failure (or watchdog reboot) flips back to the known-good slot automatically.

Related workflows

This component is the device-side terminus of the firmware rollout:

Requirements