Two devices with the same I2C address need separate visibility, a supported address change, or separate buses. Different software names do not separate electrically connected responders. Choose the topology first, then make branch selection and target access one owned operation. Applicability: this guide uses TI TMP102 address options from SBOS397I and NXP PCA9548A switch behavior…
A register read that requires a repeated START must remain one combined I2C transaction. Write the register selector, issue the repeated START without an intervening STOP, then address the device for reading. Two independently successful API calls do not prove that the controller generated this sequence. Applicability: the concrete device is Bosch Sensortec BMI270 using…
Using a bundle’s signing time changes the time at which its certificate chain is evaluated; it does not prove when the signature was actually created. Review that distinction before treating an expired signing certificate as an operational nuisance that a configuration switch can solve. This analysis pins RAUC 1.14 and uses OpenSSL 3.0.18 source for…
Compare releases within a planned, comparable population before interpreting an aggregate canary percentage. Hardware mix, region, workload, backend changes and telemetry availability can change at the same time as firmware. A lower pooled failure rate can coexist with a worse rate in every observed hardware class. This article provides a comparison-design worksheet and a synthetic…
Retire an update artifact only after a versioned dependency review shows that no supported device state, pending operation or recovery obligation still requires it. File age and low download counts are useful inventory signals, but neither proves that an offline cohort has another usable path. This is a server-side retention planning procedure. It produces a…
Bound update notifications before allocating their full representation or following their artifact links. A small firmware downloader can still exhaust memory, stack or connection time while parsing a large or deeply nested campaign message. Authentication does not remove the need to bound the work needed to reach an authentication decision. This guide uses an application-defined…
Keep the Boolean meaning explicit: install-same=true, the RAUC 1.14 default, does not enable same-image skipping. Setting it to false permits a slot update to be skipped when the stored status satisfies the implementation’s checks. That optimization relies on historical metadata rather than freshly reading and hashing the slot contents. This guide is pinned to RAUC…
Define reset separately for campaign intent, execution authorization, transfer progress and actual installation state. A settings reset should not accidentally make an old campaign current again, while a lost local download checkpoint should not erase the management system’s knowledge that an approved update remains outstanding. This article proposes a product-level reset contract. RFC 9019 and…
Save the manifest hash returned by inspection and pass that exact approved value into the later installation request. RAUC 1.14’s require-manifest-hash gate can reject a different manifest even when the replacement bundle is correctly signed and appears at the same path or URL. This guide uses the 1.14 InspectBundle and InstallBundle D-Bus contract, with a…
Make the RAUC parent graph match the partitions actually used together at boot, then test target selection from every supported booted root. Matching numeric suffixes are only a naming convention. An application partition becomes part of a root filesystem’s group because of its configured parent relation, not because both names end in zero. This guide…