Board-level Linux integration, U-Boot, device trees, kernel drivers and peripheral bring-up. Separate power and hardware checks from software adaptation, and define a recoverable boot path.
Retire an update artifact only after a versioned dependency review shows that no supported device state, pending operation or recovery obligation still requires it. File age and low download counts are useful inventory signals, but neither proves that an offline cohort has another usable path. This is a server-side retention planning procedure. It produces a…
Keep the Boolean meaning explicit: install-same=true, the RAUC 1.14 default, does not enable same-image skipping. Setting it to false permits a slot update to be skipped when the stored status satisfies the implementation’s checks. That optimization relies on historical metadata rather than freshly reading and hashing the slot contents. This guide is pinned to RAUC…
Save the manifest hash returned by inspection and pass that exact approved value into the later installation request. RAUC 1.14’s require-manifest-hash gate can reject a different manifest even when the replacement bundle is correctly signed and appears at the same path or URL. This guide uses the 1.14 InspectBundle and InstallBundle D-Bus contract, with a…
Make the RAUC parent graph match the partitions actually used together at boot, then test target selection from every supported booted root. Matching numeric suffixes are only a naming convention. An application partition becomes part of a root filesystem’s group because of its configured parent relation, not because both names end in zero. This guide…
Retain a qualified path from every supported offline starting state to the current target, including any bridge package that upgrades the updater itself. Keeping only the newest firmware can strand a device whose old installer cannot understand the package intended to upgrade it. This guide uses RAUC 1.13’s documented intermediate-update pattern to build an original…
Admit a device to a bootloader campaign only when its recovery capability is proven for that installed unit and the campaign’s failure model. Application A/B slots, an updater reporting online, or a factory recovery success on another board do not establish that this device can recover after its loader stops working. This article defines an…
Make each hook effect repeat-safe or give it a stable deduplication identity and a reconciliation path. A local “done” file cannot, by itself, make an external action happen exactly once across power loss. If an interruption leaves the action’s outcome unknown, stop and resolve that uncertainty instead of blindly repeating irreversible work. This guide covers…
Admit an update against the peak additional allocation on each real storage pool, then reserve that budget through the stages that consume it. A bundle that fits its destination slot can still fail because staging, temporary output, recovery data or concurrent jobs exhaust another filesystem. This guide defines an original runtime admission ledger for a…
A reachable casync index bundle does not prove that the device can obtain all image data required for installation. Qualify the combination of index, actual local seed and accessible chunk stores. The decisive negative test withholds a chunk needed by the selected index and absent from every enabled local source. This guide is pinned to…
For a wrapper using RAUC 1.14’s documented D-Bus interface, promise cancellation only before the installation request is dispatched, after all application-owned work has acknowledged that it stopped. Once dispatch may have occurred, report a stop request or an unresolved result rather than claiming the installation was canceled. This is a deliberately conservative contract for one…