Hermetry delivers firmware over the air. You upload a package, assign it, and each device downloads, verifies and installs it by itself, reporting its progress as it goes. Hermetry never signs firmware: signing happens in your release pipeline, and Hermetry keeps only your public keys.
Open Firmware in the IoT menu (“Upload firmware images, assign them to devices and follow each update.”).
Permissions
| Action | Default role |
|---|---|
| View packages, assignments and device update states | User |
| Upload, retire, revoke and delete packages | Admin |
| Assign firmware, change OTA settings, retry updates | Admin |
| Register and revoke signing public keys | Owner |
1. Turn on updates for the profile
Updates are off for a new profile. Turn them on when its devices report their update progress. Open the profile’s Firmware tab (Firmware updates):
| Setting | Default | Range |
|---|---|---|
| Allow firmware updates for this profile | Off | — |
| Allow unsigned images | Off | “Only for test devices.” |
| Allow updates over LTE (mobile data) | Off | A device can have its own setting. |
| Download may take (minutes) | 60 | 5 to 1,440 |
| Installing may take (minutes) | 20 | 2 to 240 |
| Tries per update | 3 | 1 to 10 |
The tab also shows what is Assigned to this profile and an Assign firmware button.
2. Register a signing key
- On Firmware, open Signing keys (“The public keys your firmware is signed with. Uploaded images are checked against them. Private keys never come here.”).
- Select Add key, give it a Name, choose its Kind and paste the Public key.
Two kinds of signature are supported: a detached Ed25519 signature file (.sig) made for the image, where you paste the whole public key file; and a signature inside the image made by the device’s secure-boot scheme, where you paste the 64-character key digest. Only owners can add or revoke keys.
Warning
Revoke on a key revokes every package signed with it, and stops updates with them that have not started installing.
3. Upload a package
Select Upload firmware and fill in:
| Field | Rules |
|---|---|
| Type | Firmware or Software. |
| Name | Letters, digits and . _ + - only. It must match what the device expects (its firmware title). |
| Version | 1 to 64 letters, digits or . _ + ~ -, for example 24.10.0-r1234. A name and version pair is used once; the form shows the newest version so far. |
| Firmware image | The .bin or .img file you install on the device. |
| Signed with | The key kind, or Not signed (only profiles that allow unsigned images can take it). |
| Signature file (.sig) | For detached signatures. For secure-boot images the signature is inside the image. |
| Hardware models | Optional, comma-separated: only devices that report one of these take the image. |
| Lowest version it can update from | Optional: devices on an older version are left out. |
| Only for devices of this profile | Leave it on Any profile when the image fits every profile. |
| Release notes | Optional. |
Your browser works out the file’s SHA-256 while it uploads (“Compare it with the one your build gave you.”). The server checks the SHA-256 again, verifies the signature against your registered keys, and scans the file for viruses. The package is Being checked until the scan is clean, then Ready; a file that fails is Rejected and deleted.
4. Assign it
On the package’s page select Assign, or use the Firmware tab of a profile or a device. Under Send to choose:
| Choice | Covers |
|---|---|
| Every device of a profile | “Devices added to the profile later get it too.” |
| Some devices | “A fixed list: devices added later are not included.” |
| One device | That device. |
The most specific assignment wins: a device assignment over a device list, a list over a profile. Select Check to see What happens: how many devices are covered, how many already run this version, how many are offline (they update when they come online) and which will not take it, with the reason (another hardware model, updates off for its profile, made for another profile, unsigned not allowed, current version too old or not known yet). Then select Assign and confirm.
For a profile or a device list you can turn on Send in waves. See Rolling out firmware in waves.
What the device receives
Hermetry writes these shared attributes in one message:
| Key | Example |
|---|---|
fw_title | boiler-fw |
fw_version | 26.11.0 |
fw_size | 14680064 |
fw_checksum | lower-case hex |
fw_checksum_algorithm | SHA256 |
fw_url | a short-lived HTTPS download address |
fw_sig | the detached signature, when there is one |
fw_allow_metered | whether the device may download over a metered link |
fw_urlis valid for 15 minutes and made fresh for each delivery and each attribute request. If it expired, the device asks forfw_urlagain and resumes with an HTTPRangerequest.- Firmware is never offered over plain MQTT.
- Removing an assignment deletes the keys.
What the device reports
| Client attribute | Values |
|---|---|
fw_state | DOWNLOADING, DOWNLOADED, VERIFIED, UPDATING, UPDATED, FAILED |
fw_error | an error code, only with FAILED |
fw_progress | 0 to 100, during DOWNLOADING |
fw_wait | metered, quota_exhausted or approval while the device holds the update |
current_fw_title, current_fw_version | what runs now; send after every connect |
The device must refuse an image whose signature does not verify, even when the checksum matches. After the reboot it reports current_fw_version; UPDATED without the new running version is not accepted on its own. If the old version comes back, Hermetry marks the update as gone back.
Update states
| State | Meaning |
|---|---|
| Queued | Assigned; sent when the device is online. |
| Sent to the device | The device was told and should start downloading. |
| Downloading, Downloaded, Checked, Installing | Progress the device reports. |
| Updated | The device runs the new version. |
| Waiting | The device holds the update: on a metered link, out of mobile data, or waiting for approval on the device itself. Not an error. |
| Failed | The device could not finish. |
| No answer in time | The device stopped answering within the download or install time. |
| Went back to the old version | The new version did not start properly. |
| Not for this device | The package does not fit it. |
| Cancelled | Stopped before it was installed. |
Follow the updates
- The package page shows Where it is assigned, its Devices with State, Progress, Tries and Problem, and Try again for failed, timed-out or gone-back devices.
- The device’s Firmware tab shows what it Runs, its Update, its History, and Updates over LTE for this device (Same as its profile, Allowed for this device, Not allowed for this device).
- Webhook events:
ota.update.initiated,ota.update.succeeded,ota.update.failed, and for rolloutsota.rollout.*.
Retire, revoke, delete
| Action | Effect |
|---|---|
| Retire | “It stays on record and current updates go on, but it is no longer offered for new assignments.” |
| Revoke | “Use this when the image must not be installed. Updates that have not started installing are stopped. Devices that already installed it keep it.” |
| Delete | Removes the file and its details. Refused while it is assigned or has update history: retire it instead. |