Firmware updates (OTA)
Firmware updates in waves, with gates between them
Upload a signed package and assign it; each device downloads, verifies and installs it by itself. Rollouts go out in waves, and a wave that fails its gate pauses the rollout before a bad image reaches the rest of the fleet.
How it works
From release to fleet
1
Register a signing key
Firmware is signed in your own release pipeline. Hermetry keeps only public keys, and only owners register or revoke them.
2
Upload the package
Your browser computes the SHA-256 while the file uploads; Hermetry checks it and the signature. The package title must match the device's model.
3
Assign it
To a device profile, a fixed group of devices or one device. The most specific assignment wins.
4
Roll out
In waves by count or percentage, with success and failure gates and a soak time between waves. Pause, resume or abort at any time.
Default plan
The default rollout
Used when you do not set your own waves. A rollout can have up to 20 waves, each with its own size, soak time and gates.
| Wave | Devices | Soak before the next wave | Gate |
|---|---|---|---|
| 1 | 1 % of the devices, at least 1 and at most 10, online devices first | 30 minutes | At least 90 % updated, at most 5 % failed |
| 2 | 10 % | 30 minutes | At least 90 % updated, at most 5 % failed |
| 3 | 50 % | 15 minutes | At least 90 % updated, at most 5 % failed |
| 4 | The rest | — | At least 90 % updated, at most 5 % failed |
Safeguards
Built so a bad image stops early
Signatures checked twice
Hermetry verifies the signature on upload, and the device must refuse an image whose signature does not verify, even when the checksum matches.
Compatibility checks
A package can name its profile, its hardware models and the oldest version it updates from. A device that does not fit is skipped, with the reason.
Never in clear
Firmware is never offered over plain MQTT. The download address is valid for 15 minutes, made fresh for each delivery, and a broken download resumes where it stopped.
Metered links wait
By default, a device on mobile data waits until you allow metered downloads. A device may also wait for its own local approval before it installs.
Rollbacks detected
If a device boots back into its old version, its update ends as rolled back, not as updated, and you can retry it.
Revoke a package
Revoking a package, or the signing key that verified it, ends the rollouts that use it. A deprecated package takes no new assignment.
Device side
What the device receives and reports
Licensed devices do this out of the box. For your own firmware, the OTA docs describe each step.
Hermetry writes fw_title, fw_version, fw_size, fw_checksum, fw_checksum_algorithm, fw_url and fw_sig as shared attributes in one message. Removing an assignment deletes them.
The device reports fw_state (DOWNLOADING, DOWNLOADED, VERIFIED, UPDATING, UPDATED or FAILED), fw_progress while it downloads, and current_fw_title and current_fw_version after every connect. A device that boots into a version other than the target reports FAILED with boot_failed.
Defaults and limits
- Packages up to 64 MiB by default
- Download timeout 60 minutes, install timeout 20 minutes, 3 attempts per device, all adjustable in the OTA settings
- Each device's update timeline kept for 180 days
- Webhooks:
ota.update.*for each device, andota.rollout.*for completed waves, pauses, resumes, completion and abort
Going back to an earlier version
There is no single button that rolls the whole fleet back. Assign the earlier package instead: it goes out like any other rollout, with the same waves and gates. Whether a device accepts an older version is decided by its firmware.
FAQ
Questions about firmware updates
Does Hermetry sign our firmware?
No. Signing happens in your release pipeline. Hermetry stores only public keys and never holds a private signing key.
What if the connection drops during a download?
The device asks for a fresh download address and resumes from where it stopped, with an HTTP range request.
Can we update devices on mobile data?
Yes, once you allow downloads on metered links in the OTA settings. Until then, a device on a metered link waits.
Who may start an update?
By default, administrators upload packages, assign them, change OTA settings and retry failed devices; owners manage signing keys; users can view packages and update states.
Can other systems follow a rollout?
Yes. Webhooks report each device's update starting, succeeding or failing, and each rollout's waves, pauses and end. See webhooks.
Updating a fleet in the field?
Tell us about your devices and how they connect. We help you plan the waves and gates for the first rollout.