RAUC(1) General Commands Manual RAUC(1)

rauc - safe and secure updating

rauc [OPTIONS...] bundle INPUTDIR BUNDLE

rauc [OPTIONS...] resign INBUNDLE OUTBUNDLE

rauc [OPTIONS...] extract BUNDLE OUTPUTDIR

rauc [OPTIONS...] extract-signature BUNDLE OUTPUTSIG

rauc [OPTIONS...] convert INBUNDLE OUTBUNDLE

rauc [OPTIONS...] encrypt INBUNDLE OUTBUNDLE

rauc [OPTIONS...] install BUNDLE

rauc [OPTIONS...] info BUNDLE

rauc [OPTIONS...] mount BUNDLE

rauc [OPTIONS...] status [SLOTNAME | mark-{good,bad,active} [booted|other|SLOTNAME]]

rauc [OPTIONS...] write-slot SLOTNAME IMAGEFILE

RAUC is a lightweight update client that runs on an Embedded Linux device and reliably controls the procedure of updating the device with a new firmware.

RAUC is also the tool on the host system that is used to create, inspect and modify update files ("bundles") for the device.

This manual page documents briefly the rauc command line utility.

It was written for the Debian GNU/Linux distribution to satisfy the packaging requirements. Thus it should only serve as a summary, reading the comprehensive online manual (https://rauc.readthedocs.io/) is recommended.

The following general options can be used with most commands, however not all combinations make sense.

use the given config file instead of the one at the compiled-in default path
use specific keyring file
mount prefix (/mnt/rauc by default)
enable debug output
display version
print usage

bundle INPUTDIR BUNDLE

Create a bundle from a content directory.

Options:

use given certificate file or the certificate referenced by the given PKCS#11 URL
use given private key file or the key referenced by the given PKCS#11 URL
intermediate CA file or the certificate referenced by the given PKCS#11 URL
verification keyring file
mksquashfs extra args

resign INBUNDLE OUTBUNDLE

Resign an already signed bundle.

Options:

use given certificate file or the certificate referenced by the given PKCS#11 URL
use given private key file or the key referenced by the given PKCS#11 URL
intermediate CA file or the certificate referenced by the given PKCS#11 URL
disable bundle verification
don't check validity period of certificates against current time
verification keyring file

extract BUNDLE OUTPUTDIR

Extract the bundle content to a directory.

Options:

use given decryption key file or the decryption key referenced by the given PKCS#11 URL
trust environment and skip bundle access checks

extract-signature BUNDLE OUTPUTSIG

Extract the bundle signature.

Options:

use given decryption key file or the decryption key referenced by the given PKCS#11 URL
trust environment and skip bundle access checks

convert INBUNDLE OUTBUNDLE

Convert an existing bundle to casync index bundle and store.

Options:

use given certificate file or the certificate referenced by the given PKCS#11 URL
use given private key file or the key referenced by the given PKCS#11 URL
intermediate CA file or the certificate referenced by the given PKCS#11 URL
trust environment and skip bundle access checks
disable bundle verification
verification keyring file
mksquashfs extra args
casync extra args
ignore image during conversion

encrypt INBUNDLE OUTBUNDLE

Encrypt a crypt bundle.

Options:

recipient cert(s)

install BUNDLE

Install a bundle.

Options:

disable compatible check
custom transaction ID
show progress bar
extra arguments for full custom handler
overrides auto-detection of booted slot

info BUNDLE

Print bundle info.

Options:

disable bundle verification
don't check validity period of certificates against current time
use given decryption key file or the decryption key referenced by the given PKCS#11 URL
select output format

The json-2 output format matches the structure of the InspectBundle D-Bus API and should be used instead of json or json-pretty.

dump certificate
dump recipients

mount BUNDLE

Mount a bundle for development purposes to the bundle directory in RAUC's mount prefix. It must be unmounted manually by the user.

status [SLOTNAME | mark-{good,bad,active} [booted|other|SLOTNAME]]

Without further subcommand, it simply shows the system status or status of a specific slot.

The subcommands mark-good and mark-bad can be used to set the state of a slot explicitly. These subcommands usually operate on the currently booted slot if not specified per additional parameter.

The subcommand mark-active allows one to manually switch to a different slot. Here too, the desired slot can be given per parameter, otherwise the currently booted one is used.

Options:

show more status details
select output format
overrides auto-detection of booted slot

write-slot SLOTNAME IMAGEFILE

Write image to slot and bypass all update logic.

Passphrase to use for accessing key files (signing only)
Library filename for PKCS#11 module (signing only)
PIN to use for accessing PKCS#11 keys (signing only)

/etc/rauc/system.conf

The system configuration file is the central configuration in RAUC that abstracts the loosely coupled storage setup, partitioning and boot strategy of your board to a coherent redundancy setup world view for RAUC.

RAUC expects its central configuration file /etc/rauc/system.conf to describe the system it runs on in a way that all relevant information for performing updates and making decisions are given.

Similar to other configuration files used by RAUC, the system configuration uses a key-value syntax (similar to those known from .ini files).

rauc is developed by Jan Luebbe, Enrico Joerns, Juergen Borleis and contributors.

This manual page was written by Michael Heimpold <mhei@heimpold.de>, for the Debian GNU/Linux system (but may be used by others).

casync(1), mksquashfs(1), unsquashfs(1)