Firmware Trains

OpenNMC ships with RAUC verity bundles signed for one of two trains:

  • development
  • production

The active trust anchor is stored at /etc/rauc/keyring.pem. To switch trains, replace that keyring with the matching PEM file and then install a bundle from the same train.

The production keyring is available at:

The published bundles follow these patterns:

  • opennmc-production-*.raucb
  • opennmc-development-*.raucb

Switching A Train

With console or SSH access:

curl -fsSL -o /tmp/opennmc-train.pem https://dl.netcubesystems.at/products/opennmc/software/keyrings/production.pem
cp /tmp/opennmc-train.pem /etc/rauc/keyring.pem
rauc install /path/to/opennmc-production-*.raucb

Replace production with development when switching to the development train. Development keyrings are generated locally from a separate development keypair and are not published in this repository. The same pattern works for older archived bundles if you need to pin a specific version.

Practical Notes

  • Always install a bundle that matches the keyring currently on the device.
  • If a bundle from the other train is rejected, the keyring has not been switched yet or has the wrong train.
  • The web interface can also install .raucb bundles, but the keyring must still match before the install starts.