Public Access
twislaandClaude Opus 5.5
c68741cc46
There is no Debug Build any more (ADR 0010, issue #68, Q188 to Q195). The console and the test commands are compiled into every firmware. It listens only while Settings > Debug Console is on, which isn't the default; off, neither its task nor its 4 KB ring exists. The token is made by the device and shown on that page; a client proves it knows it by answering a challenge with an HMAC, so it never crosses the network, and five wrong answers close the console for a minute. DBG in the Status Bar while it listens. Over USB serial only: debug on, debug token <value>, debug token new. scripts/flash.sh --debug uses them to set a device up with the developer's token. scripts/rdbg.py takes the token from -t, $RORO_DEBUG_TOKEN or the file, answers the challenge, and fetches a release's ELF to decode a crash. Gone: the cardputer-adv-debug environment, RORO_DEBUG, the +debug version, scripts/debug_flags.py, update install ... force, and the rule that a Debug Build doesn't install releases. Old clients and old firmwares don't talk to each other. Against the builds it replaces: 30 KB more flash and 88 bytes more static RAM than the release, 4 KB less RAM than the Debug Build. 468 host tests. Checked on the device: off by default, login, the pause after wrong tokens, Safe Mode with the console, the setting surviving an update, debug off. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT
45 lines
3.4 KiB
Markdown
45 lines
3.4 KiB
Markdown
+++
|
|
title = "Updates"
|
|
description = "How the device updates itself from the project's releases, from the SD card or from a PC, and how it protects itself when an update goes wrong."
|
|
weight = 11
|
|
[extra]
|
|
tag = "Firmware"
|
|
screens = ["update.png"]
|
|
+++
|
|
|
|
Every update is one **signed file** (`.ota`). The device installs only a file signed with the project's key, so it cannot be tricked into installing anything else, whichever way the file arrives.
|
|
|
|
## Settings → Firmware
|
|
|
|
The page shows the **version** running, its **status**, the address to **push updates to** over Wi-Fi, and:
|
|
|
|
- **Latest release:** <kbd>Enter</kbd> (or <kbd>c</kbd>) asks the server and says `v0.11.0 (new)` or `(current)`. <kbd>Enter</kbd> again opens the release: its version, date, size and the tag's message, with **Install** when it is newer.
|
|
- **Older releases:** the last ten, newest first. Opening an older one offers to **go back** to it, with a different question.
|
|
- **On the SD card:** the `.ota` files found in `/updates`, ready to install. Copy one there with a computer or the [Storage App](/guide/storage/); the Storage App also opens an `.ota` file and says whether it would install.
|
|
|
|
An install needs Wi-Fi if it is a download. The new firmware is checked before anything is written (the signature after the first 160 bytes) and again at the end (the image's hash). Then the device restarts. It will **wait up to 60 seconds** if you are typing, so that a restart never eats a note.
|
|
|
|
## Check for updates
|
|
|
|
**Settings → Check for updates** is on by default. Once a day, with Wi-Fi up and the clock set, the device looks at the latest release and says `v0.11.0 is out: see Settings > Firmware`, once per version. It installs **nothing** by itself, and it does not announce a version that already failed and rolled back on this device.
|
|
|
|
## Probation and Rollback
|
|
|
|
A newly installed firmware runs on **Probation**: it must boot, draw its screen, start its services and run 30 seconds without a crash, and reconnect Wi-Fi if that is configured (within 3 minutes), before it is confirmed for good. If it crashes or restarts, or cannot get Wi-Fi back, the device **rolls back** to the previous firmware by itself and says so.
|
|
|
|
## Safe Mode
|
|
|
|
If a confirmed firmware crashes and restarts **3 times in a row**, the device starts in **Safe Mode** instead: only Wi-Fi and firmware updates, so a fix can be installed without a cable. A normal restart leaves it.
|
|
|
|
## IRC steps aside
|
|
|
|
A secure connection takes about 52 KB of memory at its peak, and IRC's own takes about 40 KB of the 107 KB there is. So a check or an install that you ask for makes IRC disconnect for the few seconds it takes, and reconnect afterwards. The **daily check never does that**: with IRC connected it waits for a moment when IRC is not, so if IRC stays connected for days the daily check does not run, and **Latest release** is the way to check.
|
|
|
|
## How the connection is trusted
|
|
|
|
The connection to the project's server is checked against the two root certificates that Let's Encrypt's chains end in, not against the usual bundle of about 130 authorities. Whatever the connection, the update file's own signature decides what gets installed.
|
|
|
|
## For developers
|
|
|
|
Updates can also be pushed from a PC over Wi-Fi, with `scripts/flash.sh --ota <ip>`, or put on the card with `scripts/sd_put.sh`: see the [README](https://git.twis.la/twisla/roro9stack#firmware-updates-over-wi-fi-ota). The firmware's console can be reached over Wi-Fi too: see [The Debug Console](/dev/debug/).
|