Multiple system images for over-the-air updates
In one embodiment, a computing device may execute software from a first portion of memory of the computing device. The computing device may download from a server a new version of the software. The client computing device may receive instructions from the server to request an over-the-air (OTA) download of the new version of the software. The instructions may be an out-of-band message. The new version of the software may be installed into a second portion of memory of the computing device, and the new version of the software is executed from the second portion of memory. The download of the new version of software may be pursuant to a manifest for the download to determine whether the computing device may download the new version of software.
1. A method comprising:
by a computing device, authenticating a manifest signature with a manifest signature public key, wherein the manifest signature is used to sign a manifest;
by the computing device, reading the manifest from a manifest partition on a memory of the computing device;
by the computing device, choosing, from a plurality of system images stored in a plurality of system image partitions on the memory of the computing device, respectively, one system image to boot into based on information in the manifest;
by the computing device, verifying that a hash value of the chosen system image matches a system image hash value in the manifest; and
by the computing device, yielding a system execution control to a system kernel programmed in the chosen system image.
2. The method of claim 1 , wherein the manifest comprises a device unique signature.
3. The method of claim 2 , wherein the reading the manifest comprises
authenticating the device unique signature with a device unique public key.
4. The method of claim 3 , wherein the manifest further comprises an encrypted serial number, the serial number uniquely identifying the computing device hardware, the reading the manifest further comprises:
decrypting the serial number with a serial number public key; and
comparing the decrypted serial number to a serial number of the computing device.
5. The method of claim 1 , wherein the verifying that the hash value of the chosen system image matches the system image hash value in the manifest comprises:
calculating a first hash value of the chosen system image based on a predetermined cryptographic hash algorithm; and
comparing the first hash value to the system image hash value stored in the manifest.
6. The method of claim 1 , wherein the manifest partition comprises a plurality of manifest copies.
7. The method of claim 1 , wherein the memory of the computing device comprises a recovery system manifest partition and a recovery system image partition.
8. The method of claim 7 , further comprising:
if reading the manifest fails or verifying that the hash value of the chosen system image matches the system image hash value in the manifest fails:
reading a recovery manifest from the recovery system manifest partition;
verifying that a hash value of a recovery system image in the recovery system image partition matches a system image hash value in the recovery manifest; and
yielding a system execution control to a system kernel programmed in the recovery system image.
9. A non-transitory, computer-readable media comprising instructions operable, when executed by a computing device, to:
authenticate the manifest signature with a manifest signature public key, wherein the manifest signature is used to sign a manifest;
read the manifest from a manifest partition on a memory of the computing device;
choose, from a plurality of system images stored in a plurality of system image partitions on the memory, respectively, one system image to boot into based on information in the manifest;
verify that a hash value of the chosen system image matches a system image hash value in the manifest; and
yield a system execution control to a system kernel programmed in the chosen system image.
10. The media of claim 9 , wherein the manifest comprises a device unique signature.
11. The media of claim 10 , wherein the reading the manifest comprises
authenticating the device unique signature with a device unique public key.
12. The media of claim 11 , wherein the manifest further comprises an encrypted serial number, the serial number uniquely identifying the computing device hardware, the reading the manifest further comprises:
decrypting the serial number with a serial number public key; and
comparing the decrypted serial number to a serial number of the computing device.
13. The media of claim 9 , wherein the verifying that the hash value of the chosen system image matches the system image hash value in the manifest comprises:
calculating a first hash value of the chosen system image based on a predetermined cryptographic hash algorithm; and
comparing the first hash value to the system image hash value stored in the manifest.
14. The media of claim 9 , wherein the manifest partition comprises a plurality of manifest copies.
15. The media of claim 9 , wherein the memory of the computing device comprises a recovery system manifest partition and a recovery system image partition.
16. The media of claim 15 , wherein the instructions are further operable when executed to:
if reading the manifest fails or verifying that the hash value of the chosen system image matches the system image hash value in the manifest fails:
read a recovery manifest from the recovery system manifest partition;
verify that a hash value of a recovery system image in the recovery system image partition matches a system image hash value in the recovery manifest; and
yield a system execution control to a system kernel programmed in the recovery system image.
17. A system comprising:
one or more processors; and
a memory coupled to the processors comprising instructions executable by the processors, the processors being operable when executing the instructions to:
authenticate the manifest signature with a manifest signature public key, wherein the manifest signature is used to sign a manifest;
read the manifest from a manifest partition on the memory;
choose, from a plurality of system images stored in a plurality of system image partitions on the memory, respectively, one system image to boot into based on information in the manifest;
verify that a hash value of the chosen system image matches a system image hash value in the manifest; and
yield a system execution control to a system kernel programmed in the chosen system image.
18. The system of claim 17 , wherein the manifest comprises a device unique signature.
19. The system of claim 18 , wherein the reading the manifest comprises
authenticating the device unique signature with a device unique public key.
20. The system of claim 19 , wherein the manifest further comprises an encrypted serial number, the serial number uniquely identifying the computing device hardware, the reading the manifest further comprises:
decrypting the serial number with a serial number public key; and
comparing the decrypted serial number to a serial number of the computing device.