OS updates
The Pi appliance can update its whole operating system the safe way: write the copy that isn’t running, try it once, and fall back on its own if it doesn’t boot.
A/B slots
Section titled “A/B slots”The card is laid out with two root slots (A and B) and a separate data partition that updates never touch. The running system writes the other slot, then arms the bootloader to try it once. If the new slot reaches a healthy state, it’s confirmed; if it never comes up, a power cycle returns you to the known-good slot. That rollback lives in the Pi’s own bootloader, so it survives the machine not booting at all — which nothing running on the machine could do.
Signed bundles
Section titled “Signed bundles”An OS update ships as a RAUC bundle (.raucb), signed with a key separate from the one that signs the
release manifest: the manifest says “this release exists”, the bundle says “this OS image is ours.” Your
box carries the matching certificate (baked into the image as its keyring), so it only writes a bundle it can
verify.
The manifest’s system block points at the bundle and its hash; the box downloads it, checks the signature,
writes the spare slot, and reboots.