Warning: This feature is a work in progress. The release date is estimated at the end of Q2 2022.
The Secure Offline Updates is a feature soon to be released in Torizon. It is an alternative for the already available Torizon Remote Updates, using the same technology stack: OSTree and Aktualizr. Offline Updates brings the capability to perform secure application and OS updates to TorizonCore based devices that may not be able to update remotely. For example, devices that rarely, or never, connect to the internet or devices with limited bandwidth.
With the Offline Updates feature it is possible to:
Many of the names and technologies used in Remote Updates are also used in Offline Updates. However, this feature requires some new unique terminology:
Lockbox is central to using Offline Updates. In this context, the Lockbox is the object that will contain all the required files that will be deployed to the updating device, along with the metadata necessary to make it a secure operation.
In order to perform offline updates, you should have:
The update processes of a device with Offline Updates and Remote Updates are similar since both are based on the same technology stack. You can see the workflow in the diagram below:
The first step is to bring your OS Image/Application to the Torizon Platform Services domain. To create an Application Package you should push a docker-compose file to the Torizon Platform Services with TorizonCore Builder. Note that you have to perform two actions before pushing it to Torizon Platform:
--canonicalizeargument to generate a canonical version of the docker-compose file.
Remember that you will also have to push your application to a docker registry, so TorizonCore Builder can download it when building the Lockbox.
The next step is to define the Lockbox in the Torizon Platform Web UI. The Lockbox itself will contain all of the files required for the update. It will also contain the necessary metadata to make it an easy, secure, and reliable process.
To define a Lockbox you have to:
Note: You can define a single Lockbox for updating devices with different hardware since they are capable of validating and selecting the correct OS package.
With the Lockbox defined, the next step is to create the actual Lockbox and load it into an update medium. This is a physical drive that holds the Lockbox, like an SD card or a USB drive. To create the Lockbox and load it into an update medium, you have to:
Now that you have the update medium, it becomes a matter of physically going to the device and deploying the update:
Note: The update process is fully automated and no user intervention is required at any time. If you are performing an OS or synchronous update, the board will automatically reboot once.
Toradex has presented webinars about Secure Offline and Online Updates and you can watch them on demand.
Learn more about this webinar on the landing page, or watch it below: