Changing software in the field.
WHY IT IS DIFFICULT
Devices may be inaccessible, unattended, powered intermittently, and connected unreliably.
WHAT AN UPDATE MUST SURVIVE
Power loss partway Connection loss partway A corrupted image An image that boots but does not work
WHAT THE STANDARD PATTERN IS
Download and verify the full image before applying Write to an inactive location Switch on next boot Confirm success, or roll back automatically
WHAT CONFIRMATION MEANS
The new image proving it works, not merely starting.
WHAT TO VERIFY BEFORE APPLYING
A cryptographic signature.
WHY
Otherwise anyone able to deliver an image controls the device.
WHAT SECURE BOOT PROVIDES
The device refusing to run unsigned software.
WHAT THAT REQUIRES
Keys held in hardware, and careful key management.
WHAT TO PLAN
Key rotation, and what happens if a key is compromised.
WHAT TO NEVER SHIP
Devices with no update mechanism.
WHY
Vulnerabilities are found, and unpatchable devices remain exploitable permanently.
WHAT TO STAGE
Updates, across the fleet, watching for failures.
