Encrypted bundle

[Louson]

Hello,

I have found this tuto about encrypted bundle generation https://www.send-patches.org/en/blog/2022-03-31-tutorial-rauc-bundle-encryption-using-meta-rauc.html

Is there any development about its autogeneration ? Is there any blocking point ?

Thanks,
Louis

[jluebbe]

What do you mean by "autogeneration"? RAUC_BUNDLE_FORMAT = "crypt" works in current meta-rauc.

[ejoerns]

If you refer to the two-step process: Only the first step of the two-step encryption process is 'automated' in meta-rauc since the expectation is that individual recipient key handling needs to be done outside a BSP (as it requires knowledge about the device fleet infrastructure, etc.)

[Louson]

Indeed, I do refer to the second step. At first sight, I thought there could be some variable with the several target certificates. But the night has passed by, and I might have a better understanding.

As I understand now, rauc expects the second step to be managed by the deployment server just before sending the image. Is that correct ?

[ejoerns]

Not necessarily by the deployment server, but by some instance that has key access and knowledge about the individual recipients.
This is normally not your build server.

A simplification as you proposed might apply only to the unrecommended case where all devices share the same crypt key.

Also, note that you can then encrypt the same bundle multiple times without the need to modify any of its content.