`iot-fleet-ota`

:::warning [UNTESTED] — v0.5 paper-correct native_sim build verified. HiL verification gates on a staged Mender server. :::

Secure OTA firmware update with rollback. The production-readiness proof for "how do we update 10 000 units in the field?". Targets every E1M-X SoM family.

Source: examples/connectivity/iot-fleet-ota/.

Trust model

Piece	Role
OPTIGA Trust M	On-SoM secure element. ECDSA-P256 private key generated inside the chip at SoM-mfg, never leaves. Without physical access to a provisioned OPTIGA, no attacker can produce a signature this device will accept.
ECDSA-P256	Signing algorithm. Public half is read out of the OPTIGA at provisioning and pinned in the host's MCUboot configuration.
MCUboot	Bootloader signature verification. Refuses to swap into a slot whose signature doesn't match the pinned key.
Mender	Update-server backend. Streams the signed image down; the device applies through MCUboot's standard slot-swap.

`board.yaml`

som:
  sku: E1M-V2N101

preset: e1m-x-evk

cores:
  a55_cluster:
    app: ./linux
    image: alp-image-edge
    peripherals: [i2c]
    libraries: [mbedtls]                # required by iot.tls: true (validator rule R3)
    iot: { wifi: true, mqtt: true, tls: true }

boot:
  method: mcuboot
  signing:
    algorithm: ecdsa_p256               # OPTIGA-rooted, validator rule R2 enforces family allow-list
    key_file:  keys/mcuboot_dev_ecdsa_p256.pem
  swap_algorithm:   scratch
  build_type:       Release

ota:
  provider:      mender                 # mender | hawkbit | mcumgr — provider-driven dispatch (ADR 0009)
  artifact_name: alp-iot-fleet-ota-1.0.0
  server:
    url:    https://hosted.mender.io
    tenant: ${MENDER_TENANT_TOKEN}      # injected at build/CI time, not committed
  poll_interval_s: 1800

chips:
  - optiga_trust_m
  - eeprom_24c128

diagnostics:
  log_level: info

:::danger boot.signing.key_file is the private signing key key_file: becomes SB_CONFIG_BOOT_SIGNATURE_KEY_FILE — the key imgtool signs with, and from which MCUboot extracts the public half at build time. It must be a private PEM. A .pub.pem there cannot sign, and because the generated overlay layers after the curated defaults, a bad value silently overrides zephyr/sysbuild/aen/sysbuild.conf.

keys/mcuboot_dev_ecdsa_p256.pem is the local development key — gitignored, generated once per clone with bash keys/generate_dev_key.sh. Production images are re-signed in the manufacturing CA's HSM; the build-time key is never the production one. :::

On AEN-family targets the MCUboot profile must be named explicitly at build time — see production-deployment → Building the MCUboot chain on AEN.

The boot: + ota: blocks land as declarative artefacts in v0.6: the loader emits the matching SB_CONFIG_* MCUboot overlay, the MENDER_* weak-assignments in the Yocto slice's local.conf, and (when targeting a Zephyr core) the CONFIG_MENDER_MCU_CLIENT=y Kconfig for the Zephyr-side dispatch — see board.yaml reference: OTA block for the full per-provider emit matrix.

Trust model​

board.yaml​

See also​

Trust model

`board.yaml`

See also