Sysupdate
A portable system updater utility designed for immutable/image based systems.
Usage
Update your system: sysupdate update
Check if there are new updates available: sysupdate status
Retrieve information about a version: sysupdate info <version>
Deployment
sysupdate has a main config file in /etc/sysupdate.conf. ` GPGKEYPATH="/usr/share/sysupdate/signingkey.gpg" # Path to the gpg key with which the manifest is signed GPGHOMEDIR= # Leave unassigned to automatically set it to a directory in /tmp TMPDIR="/tmp" # May be left unassigned to use the system default MAINCONF="/etc/sysupdate.d/meta" # If unassigned sysupdate will automatically use the first config file in /etc/sysupdate.d ”`
The field MAINCONF will only be used by the commands status and info as the "leading" config under which to check for versions. It may be a config file that does not match the pattern of regular update configs, and as such will only be used for version checking by status and info.
Sysupdate will look for update config files in /etc/sysupdate.d/.conf. A config file consists of shell assignments and is fully sourced by sysupdate.
” NAME="sysupdate_example" # Human readable name, displayed in errors URL="https://example.com/sysupdate" # Base url to the manifest, manifest.gpg and each file downloaded
Source TYPE="remotefile" # Type of source, currently remotefile is the only available option FULLSOURCE="example-root@v.img" # Matchpattern of the filename in the manifest DELTASOURCE="example-root@v.delta" # Matchpattern of the delta update in the manifest, if not specified delta updates are disabled
Target TARGET="partition" # Target for the update, option between partition and regularfile TARGETPATH="auto" # Automatically detect the unused partition, can also be a full path to a disk LABELPATTERN="root@v" # In case of automatic detection, the label of the valid partitions to consider ”
Delta Updates
Delta updates use the tool xdelta3 to apply a delta patch for an update. Patches can be generated with the command xdelta3 -e -s <previous_version> <new_version> <new_version>.delta. Sysupdate assumes that deltas act between the second latest and the latest version and will not apply a delta when the version discrepency is higher (i.e. an update from 2->3 will cause a delta update, an update from 1->3 will not).
Example configs
Following configs can be adjusted to allow updates for an A/B-root immutable system with UKIs and verity protected roots
foobar_efi.conf: ” NAME="foobar_efi" URL="https://example.com/foobar"
Source TYPE="remotefile" FULLSOURCE="foobar-efi@v.efi"
Target TARGET="regularfile" TARGETPATH="/boot/EFI/Linux/foobar-efi@v+@l-@d.efi" TRIESLEFT=3 TRIESDONE=0 KEEPVERSIONS=3 MODE=700 MATCHPATTERN="foobar-efi@v.efi foobar-efi@v+@l.efi foobar-efi@v+@l-@d.efi" ”
This will download the file foobar-efi_@v.efi from example.com/foobar, and place it in /boot/EFI/Linux/foobar-efi_@v+3-0.efi. Three versions are kept, matched under the filenames foobar-efi_@v.efi, foobar-efi_@v+@l.efi and foobar-efi_@v+@l-@d.efi.
foobar_root.conf: ” NAME="foobar_root" URL="https://example.com/foobar"
Source TYPE="remotefile" FULLSOURCE="foobar-root@v.img" DELTASOURCE="foobar-root@v.delta"
Target TARGET="partition" TARGETPATH="auto" LABELPATTERN="root@v" ”
This will download the file foobar-root_@v.img or foobar-root_@v.delta from example.com/foobar and flash it on the oldest currently unused partition matching the gpt label root_@v.
foobar_verity.conf: ” NAME="foobar_verity" URL="https://example.com/foobar"
Source TYPE="remotefile" FULLSOURCE="foobar-root@v.verity"
Target TARGET="partition" TARGETPATH="auto" LABELPATTERN="verity@v" SYNCPATLABEL="verity@v" ”
This will download the file foobar-root_@v.verity from example.com/foobar and flash it on the oldest currently unused partition matching the gpt label verity_@v and then update the partlabel to verity_@v (since verity hash trees can't set their own labels).
Source
Sysupdate can be downloaded from https://git.pinkro.se/Rose/gardenhouse/sysupdate.git/about/
It's also mirrored to Codeberg where bugtracking is done.
A sys-apps/sysupdate port is available in the Gardenhouse portage overlay