94

Getting started

  • Signing Up
  • Creating Your Factory
    • Selecting Your Platform
    • Watching Your Build
  • Flashing Your Device
    • Prerequisites and Pre-Work
    • Downloading the System Image
    • Flashing the Image
    • Booting and Connecting to the Network
      • Logging in via SSH
        • Troubleshooting
  • Registering Your Device
  • Installing Fioctl
    • Installation
      • Manual Installation
    • Authenticating Fioctl
      • Adding Application Credentials
    • Configuring Git
      • Setting Up Git
  • Emulation With QEMU
    • Prerequisites and Pre-Work
    • Emulating Device
    • Next Step
  • Building and Deploying Application
    • Testing the Container

Tutorials

  • Getting Started With Docker
    • Learning Objectives
    • Prerequisites
    • Instructions
      • Cloning Container Repository
      • Dockerfile
      • Shell Script
      • Building Your Container
      • Extra Commands
        • Docker Process Status
        • Docker Logs
        • Docker Execute
        • Docker Remove
      • Docker Compose YAML
      • Summary
  • Creating Your First Target
    • Learning Objectives
    • Prerequisites
    • Instructions
      • Commit and Push Changes
      • Find Your Build
      • Targets
      • Summary
  • Deploying Your First Application
    • Learning Objectives
    • Prerequisites
    • Instructions
      • Configure Your Device
      • Debugging Your Device
      • Testing the Container
      • Enabling Specific Applications
      • Summary
  • Configuring and Sharing Volumes
    • Learning Objectives
    • Prerequisites
    • Instructions
      • Modify Shellhttpd
      • Copy the Configuration File with Dockerfile
      • Sharing a Folder
      • Dynamic Configuration File
      • Update Shellhttpd
      • Summary
  • Working With Compose Apps
    • Learning Objectives
    • Prerequisites
    • Instructions
      • File Structure
      • Docker Compose Apps
        • Foundries.io Hub as Source
          • Dockerfile in the Same Folder
          • Dockerfile in a Different Folder
        • External Hub as Source
        • Multiple Sources
      • Applications
      • Mosquitto Broker
      • Shellhttpd-MQTT
      • Flask-MQTT-Nginx
      • Commit and Push New Applications
      • Testing Applications
      • Checking App State
      • Summary
  • Customizing the Platform
    • Learning Objectives
    • Prerequisites
    • Instructions
      • Cloning Meta Subscriber Overrides Repository
      • Shellhttpd Recipe
      • Enabling the App
      • Commit and Push All New Applications
      • Testing Applications
      • Summary
  • Working With Tags
    • Learning Objectives
    • Prerequisites
    • Instructions
      • Inspecting Factory Targets
      • Adapting Shellhttpd
      • Following a Specific Tag
      • Creating Targets
      • Tagging a Specific Version
      • Summary

User Guide

  • Fioctl
    • Prerequisites
    • Auto Updating
    • Enabling/Disabling Apps
      • Via Fioctl
      • Via the LmP Device Register Script
    • Inspecting Targets
    • Common Commands
  • Qemu
    • x86_64
      • Booting in QEMU
      • Booting Graphically
        • QEMU CLI
    • arm
      • Booting in QEMU
      • Booting Graphically
        • QEMU CLI
    • arm64
      • Booting in QEMU
      • Booting Graphically
        • QEMU CLI
    • riscv64
      • Booting in QEMU
      • Booting Graphically
        • QEMU CLI
  • Factory & Account Management
    • Factory Account Roles
      • How it Works: Walk Through
    • Managing Your Subscription
      • Changing Your Plan
        • Factory Upgrade
      • Payment and Billing
    • Team Based Factory Access
      • How it Works: Walk Through
        • Example
      • Team Based Access to Device Groups
        • Example
      • Changes to TUF Root
    • Setting When Devices are Considered Offline
      • How It Works: Walk Through
  • Intellectual Property Protection
  • Custom CI
    • Custom CI for RootFS
      • Prerequisites
      • Bitbake
      • Push OSTree Repo To Cloud
      • Add OSTree Target
      • Check the OSTree Target
    • Custom CI To Build Compose App Targets
      • Prerequisites
      • Creating And Setting the Access Token
      • Set Token in GitHub Repo
      • Define GitHub Actions Workflow
      • Learn App Repo Structure Details
      • FoundriesFactory Utilities: Usage Details
      • Check the Workflow Result
  • Configuring Automatic Git Mirroring
    • Creating Token
    • Configuring GitHub
      • Creating Mirror Action
      • GitHub Action
    • Configuring Bitbucket
  • Working With Git Submodules
    • Create a GitHub Repository
    • Preparing the GitHub Repository
    • Adding the Submodule
    • Updating the Submodule Manually
    • Updating the Submodule Automatically
  • Remote Access
    • WireGuard VPN
      • Actions on VPN Server
      • Enabling Remote Access to a Device
      • Changing Wireguard Server Address
      • Troubleshooting
        • Method 1
        • Method 2
        • Further Debug
  • Foundries.io REST API
    • Prerequisites
    • Creating Token
    • Getting Started
    • Device List
    • Targets List
    • Configure Device
    • Enabling/Disabling Application
    • Learning More About the REST API
  • Containers and Docker
    • Containers
      • Advanced Container Usage
        • Examples
      • Passing Arguments to Build Context
        • Example
      • Advanced Container Dependencies
        • Examples
    • Docker Credential Helper
    • Compose Apps
      • Compose Apps in a Factory
      • Compose Apps Distribution
      • How Does It Fit Together?
      • Examples
        • Single Container Application
        • A Flask Web App
    • Container Preloading
      • Configure the CI
      • Getting a New Image with Preloaded Containers
      • Checking the Preloaded Image
        • Restorable Type
      • Starting Compose Apps Automatically
      • Testing Auto Start
      • Common Advanced Scenario
    • Multi-Stage Container Builds
      • Single Stage Container
      • Multi-Stage Container
  • Using Third-Party Private Container Registries
    • Configuring for CI Azure Container Registry (ACR)
      • Configuring Devices for ACR
    • Configuring CI for AWS ECR
      • Configuring Devices for AWS ECR
    • Configuring for CI Google Artifact Registry (GAR)
      • Configuring Devices for GAR
  • Customizing the LmP
    • Building From Source
      • Hardware Requirements
      • Setup the Build Environment
      • Install the LmP
        • Download the Layers
        • Setup Work Environment
        • Build the Image
        • Install the Image
      • Build and Install the LmP for your Factory
      • References
    • Extending the Linux microPlatform
      • Adding Packages to the Image
      • List of Available Recipes
      • Creating a Python3 Package from PyPi
      • Using FEATURES to Configure LmP
      • Including Private Git+ssh Repositories
    • LmP Customization
      • Customizing the Distro
      • Kernel Command Line Arguments
        • Distro: lmp
        • Distro: lmp-base
      • Automatically Loading a Kernel Module
      • Adding a new Systemd Startup Service
        • Setting a Static IP on the Device
      • LmP Users and Groups
        • Extending User Groups
        • Adding LmP Users
      • LmP Time Servers
      • Installing Files Under var
  • Auto Hostname
    • Adding the Recipe
    • LmP Auto Hostname Variables
    • Configuring the LmP Auto Hostname
    • Testing Auto Hostname
  • Auto Register
    • Prerequisites
    • Creating Token
    • Enabling Recipe
    • Configuring the LmP Auto Register
    • Additional Configuration
    • Testing Auto Register
  • Customizing Over the Air Updates
    • Callbacks
    • Custom Update Agents
      • Using The Custom SOTA Client Example
        • Forking the Custom SOTA Client
          • Custom SOTA Client Work Modes
    • Command Line Interface - CLI (Aktualizr-lite Manual Mode)
      • View Current Status
      • Fetch TUF Metadata and List Updates
      • Apply Update
      • Exit Codes
      • Automating the use of CLI Operations
  • Offline Updates
    • Prerequisites
    • Obtaining Offline Update Content
    • Signing the Offline Update Bundle
    • Performing the Offline Update
    • Usage Details
      • Post Install and Run Actions
      • Configuration Details
    • Offline Update Considerations
    • Controlling the Expiration Time of the Offline Update Bundle
      • Understanding the Math Behind the Offline Update Bundle Expiration Time
  • Disk Encryption Support
    • Prerequisites
    • Enabling Support for Disk Encryption
      • Implementation Details for OP-TEE PKCS#11 Support
      • Testing TPM 2.0 Support With Qemu (x86) and swtpm
    • Implementation Details for OP-TEE PKCS#11 Support
      • Testing PKCS#11 Support With Qemu (arm64)
  • Factory Reset
    • Full Factory Reset
    • Partial Factory Reset
      • Keep SOTA
      • Keep SOTA and Docker
      • RPMB
  • Updating the Linux microPlatform Core
    • Updating Your Factory
      • lmp-manifest
        • Common Pitfalls
      • meta-subscriber-overrides
    • Verifying Your Work
    • Merging Back to Development
    • Common Errors and Tips
  • Machines with Secure Aspects Enabled by FoundriesFactory
    • Supported Machines
    • Enabling
    • Using the Secure Machine
    • Using Custom Keys
      • Creating the Keys
      • Generate the MfgTools Scripts
    • Accessing Secure Storage
      • Writing to Secure Storage
      • Reading From Secure Storage
  • Offline Factory TUF Keys
    • How to Rotate Offline TUF Root Key
    • How to Rotate Offline TUF Targets Key
    • How to View Offline TUF Keys
    • How to Backup Offline TUF Keys
    • Expert Mode
      • How to Add More Than 1 Offline TUF Keys
      • How to Increase the TUF Signature Threshold
      • Recommended Offline TUF Keys Schema
  • Crypto Keys Used by FoundriesFactory at Build Time
    • Secure Boot Flow
      • i.MX Secure Boot Flow
      • STM32MP15 Secure Boot Flow
      • UEFI Secure Boot Flow
    • FoundriesFactory Keys
      • How to Rotate the FoundriesFactory Keys
        • U-Boot Keys
        • OP-TEE Keys
        • TrustedFirmware-A Keys
        • Linux Kernel Modules Keys
  • Software Bill of Materials
    • SBOMs and Builds
      • Yocto Project Artifacts
      • Syft Artifacts
    • Working With SBOMs
    • Going Further
  • Integrating NXP EdgeLock 2GO
    • Prerequisites
    • Enabling Auto-connect to Your Factory
    • Optional: Enabling Devices to Connect With AWS IoT
      • Manual Registration
      • JITP
    • Creating an LmP Build With EdgeLock 2GO
    • Enlisting Devices
    • Testing AWS IoT
    • EdgeLock 2GO Concepts
    • Installing Additional Secure Objects
    • Further Details
  • Production Targets
    • Performing a Production OTA
    • Advanced Usage
      • Releasing to Canary Devices
      • Releasing to Large Device Fleets
      • Integration with External Device Management Systems
      • Going Beyond Limits
  • Details Of Device Gateway PKI Settings
    • Taking Ownership of Factory PKI Using the API
      • 1. Call the API to Generate CSRs
      • 2. Generate a Private Key and Certificate for Factory Root CA
      • 3. Optionally Generate Your Local Device CA
      • 4. Sign CSRs Received from the API
      • 5. Upload Generated Certificates to the API
    • Registering Factory Devices Using the API
  • Rotating Device Certificate
    • Choosing an EST Server
      • FoundriesFactory Managed
      • User Managed
    • Performing a Certificate Rotation
      • Parameters
  • Troubleshooting and FAQ
    • Errors and Solutions
      • Fioctl™ Errors
      • Aktualizr-Lite Common Reports
      • OTA Update Fails Because of Missing SPL Keys
      • Request Entity Too Large Error
        • Solution
      • Device Registration Common Errors
    • How Tos
      • Aktualizr-Lite and Fioconfig Polling Time
        • Option A: Changing Interval in Runtime
        • Option B: Changing Interval Included in the Build
      • Re-Register a Device
      • Read Secure Variables from Containers
      • Enable U-Boot Boot Delay
    • Tips and Abouts
      • Allowed Characters for Device Names and Tags
      • Bind Mounting a File Into a Container
      • NXP SE05X Secure Element and PKCS#11 Trusted Application
      • Debugging Network Connectivity
      • Debugging User Permissions
      • Updates To etc
      • Orphan Targets

Reference Manual

  • Overview
  • Docker
    • Architecture Overview
    • Using Secret Credentials When Building Containers
      • Overview of CI Secrets
      • Defining Factory Secrets
      • Passing Secrets to Docker’s Build Context
    • Using Third-Party Private Container Registries
      • Configuring for CI Azure Container Registry (ACR)
        • Configuring Devices for ACR
      • Configuring CI for AWS ECR
        • Configuring Devices for AWS ECR
      • Configuring for CI Google Artifact Registry (GAR)
        • Configuring Devices for GAR
    • Restorable Apps
      • Employment of Restorable Apps
    • Caching
      • Cache Invalidation
  • Supported Boards
    • RB3G2
    • Beaglebone Black
      • Preparation
      • Flashing
    • Raspberry Pi 4
      • Preparation
      • Flashing
    • Arduino Portenta X8
      • Preparation
      • Hardware Preparation
      • Flashing
    • i.MX 8M Nano Evaluation Kit
      • Preparation
      • Hardware Preparation
      • Flashing
    • i.MX 8M Mini Evaluation Kit
      • Preparation
      • Hardware Preparation
      • Flashing
    • i.MX 8M Mini/Nano Evaluation Kit with SE050ARD
      • Attaching the SE050
      • Installing the FoundriesFactory Image
    • i.MX 8M Quad Evaluation Kit
      • Preparation
      • Hardware Preparation
      • Flashing
    • i.MX 8M Quad Evaluation Kit with SE050ARD
      • Attaching the SE050
      • Installing the FoundriesFactory Image
    • i.MX 8M Plus Evaluation Kit
      • Preparation
      • Hardware Preparation
      • Flashing
    • i.MX 8M Plus Evaluation Kit With SE050ARD
      • Attaching the SE050
      • Installing the FoundriesFactory Image
    • i.MX 6UL Evaluation Kit
      • Pre-Preparation
      • Preparation
      • Hardware Preparation
      • Flashing
    • i.MX 6ULL Evaluation Kit
      • Pre-Preparation
      • Preparation
      • Hardware Preparation
      • Flashing
    • i.MX 6ULL Evaluation kit With SE050ARD
      • Attaching the SE050
      • Installing the FoundriesFactory Image
    • Apalis iMX6 with the Ixora Carrier Board
      • Preparation
      • Hardware Preparation
      • Flashing
    • Apalis iMX8 with the Ixora Carrier Board
      • Preparation
      • Hardware Preparation
      • Flashing
    • NXP i.MX 8QuadMax Multisensory Enablement Kit (MEK)
      • Preparation
      • Hardware Preparation
      • Flashing
    • i.MX 8 ULP Evaluation Kit
      • Preparation
      • Hardware Preparation
      • Flashing
    • i.MX 93 Evaluation Kit
      • Preparation
      • Hardware Preparation
      • Flashing
    • Texas Instruments AM62x SKEVM
      • Building
      • Preparation
      • Hardware Preparation
      • Flashing
      • Configure eMMC UDA Boot
    • Texas Instruments AM64x SKEVM
      • Building
      • Preparation
      • Hardware Preparation
      • Flashing
    • STM32MP157 Discovery Kit
      • FoundriesFactory CI Build
      • Preparation
      • Flashing
      • Boot Mode
    • STM32MP15 EV1 Evaluation Board
      • Getting the Required Software
      • Preparation
      • Hardware Preparation
      • Flashing
    • Jetson AGX Orin Developer Kit
      • Preparation
      • Hardware Preparation
      • Flashing
    • Jetson AGX Xavier Developer Kit
      • Preparation
      • Hardware Preparation
      • Flashing
    • x86
      • Intel Core i7 CPU (and later): Booting From External Flash
        • Preparation
        • Flashing
      • Intel Core i7 CPU (and later): Installing to Internal Flash
        • Preparation
        • Flashing
        • Booting the Installer
    • Versal AI Core Series VCK190 Evaluation Kit
      • Preparation
      • Hardware Preparation: Console/JTAG
      • Console Hardware Configuration
      • JTAG Hardware Preparation
    • Avnet UltraZed SOM with UltraZed-EG IO Carrier Card
      • Preparation
      • Hardware Preparation
      • Flashing and Boot
    • Kria KV260 Vision AI Starter Kit
      • Preparation
      • Hardware Preparation
      • Flashing and Boot
        • Flashing an SD Card
        • Flashing QSPI Boot Images
      • Recovery
  • FoundriesFactory
    • Factory Sources
      • Triggering Builds
      • Configuring the CI to Build New Branches
        • Platform Branches
        • Container Branches
    • Factory Definition
      • notify
      • tuf
      • lmp
        • Variables
      • containers
      • container_registries
      • ci_scripts
        • Variables
    • Fioctl
      • fioctl
        • Synopsis
        • Options
        • SEE ALSO
      • fioctl completion
        • Synopsis
        • Examples
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl config
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl config delete
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl config device-group
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl config device-group create
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl config device-group delete
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl config device-group list
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl config device-group update
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl config log
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl config rotate-certs
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl config set
        • Synopsis
        • Examples
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl config updates
        • Synopsis
        • Examples
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl config wireguard
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl configure-docker
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl configure-git
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl devices
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl devices apps-states
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl devices chown
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl devices config
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl devices config delete
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl devices config group
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl devices config log
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl devices config rotate-certs
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl devices config set
        • Synopsis
        • Examples
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl devices config updates
        • Synopsis
        • Examples
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl devices config wireguard
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl devices delete
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl devices delete-denied
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl devices list
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl devices list-denied
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl devices rename
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl devices show
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl devices updates
        • Synopsis
        • Examples
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl el2g
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl el2g config-aws-iot
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl el2g config-device-gateway
        • Synopsis
        • Examples
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl el2g devices
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl el2g devices add
        • Synopsis
        • Examples
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl el2g devices delete
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl el2g devices list
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl el2g devices show
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl el2g status
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl event-queues
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl event-queues list
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl event-queues listen
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl event-queues mk-pull
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl event-queues mk-push
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl event-queues rm
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl keys
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl keys ca
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl keys ca add-device-ca
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl keys ca create
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl keys ca disable-device-ca
        • Synopsis
        • Examples
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl keys ca revoke-device-ca
        • Synopsis
        • Examples
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl keys ca rotate-tls
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl keys ca show
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl keys ca update
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl keys tuf
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl keys tuf rotate-all-keys
        • Synopsis
        • Examples
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl keys tuf rotate-offline-key
        • Synopsis
        • Examples
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl keys tuf show-root
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl keys tuf updates
        • Synopsis
        • Examples
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl keys tuf updates add-offline-key
        • Synopsis
        • Examples
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl keys tuf updates apply
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl keys tuf updates cancel
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl keys tuf updates delete-offline-key
        • Synopsis
        • Examples
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl keys tuf updates init
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl keys tuf updates review
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl keys tuf updates rotate-offline-key
        • Synopsis
        • Examples
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl keys tuf updates rotate-online-key
        • Synopsis
        • Examples
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl keys tuf updates set-threshold
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl keys tuf updates sign
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl keys tuf updates sign-prod-targets
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl login
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl logout
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl secrets
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl secrets list
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl secrets update
        • Synopsis
        • Examples
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl status
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl targets
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl targets add
        • Synopsis
        • Examples
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl targets artifacts
        • Synopsis
        • Examples
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl targets image
        • Synopsis
        • Examples
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl targets list
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl targets offline-update
        • Synopsis
        • Examples
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl targets offline-update show
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl targets offline-update sign
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl targets prune
        • Synopsis
        • Examples
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl targets show
        • Synopsis
        • Examples
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl targets show compose-app
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl targets show sboms
        • Synopsis
        • Examples
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl targets static-deltas
        • Synopsis
        • Examples
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl targets tag
        • Synopsis
        • Examples
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl targets tail
        • Synopsis
        • Examples
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl targets tests
        • Synopsis
        • Examples
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl teams
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl users
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl version
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl waves
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl waves cancel
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl waves complete
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl waves init
        • Synopsis
        • Examples
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl waves list
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl waves rollout
        • Synopsis
        • Examples
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl waves show
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl waves sign
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
      • fioctl waves status
        • Synopsis
        • Options
        • Options inherited from parent commands
        • SEE ALSO
    • Software Bill of Materials
      • SBOMs and Builds
        • Yocto Project Artifacts
        • Syft Artifacts
      • Working With SBOMs
      • Going Further
    • API Access
      • Common Scopes
      • Token Scopes
        • Source
        • Containers
        • CI
        • Devices
        • Targets
    • CI Webhooks
      • Prerequisites
      • Configuring Webhooks
      • Configuring the Factory
      • Example
        • Prepare the App
        • Create the Secret
        • Launch the App
        • Push a Change
    • Event Queues
      • Implementation Details
      • Creating a Pull Queue
      • Creating a Push Queue
        • Quick Start Example
        • Push Queue Payloads
        • Push Queue Security
      • Event Types
        • DEVICE_FIRST_SEEN
        • DEVICE_CONFIG_APPLIED
        • DEVICE_OTA_STARTED
        • DEVICE_OTA_COMPLETED
        • DEVICE_OTA_APPS_STATE_CHANGED
        • DEVICE_PUBKEY_CHANGE
    • Data Retention Policies
      • Customer Data
        • source.foundries.io
        • ci.foundries.io
        • CI Workers
        • api.foundries.io
        • app.foundries.io
      • Device Data
        • hub.foundries.io
        • ota-lite.foundries.io
        • ostree.foundries.io
  • Linux microPlatform
    • Board Machine Names
    • Repo Source Control Tool
    • Understanding FIO Development Tags
    • Development Container
    • Linux Kernel
      • LmP Kernel Configuration Fragments
      • LmP With Real-Time Linux Kernel
        • Building LmP with linux-lmp-rt
        • Building LmP With linux-lmp-fslc-imx-rt
      • LmP With the Real-Time Xenomai4 Core
        • Building LmP With linux-lmp-fslc-imx-xeno4
      • LmP With Linux Upstream
        • Building LmP With linux-lmp-dev
        • Specifying Linux Git Tree, Branch, and Commit Revision
    • LmP File Structure
      • OSTree File System Structure
      • Persistent Storage
      • Important Files and Folders
      • Tips and Suggestions
    • OpenEmbedded / Yocto Project Layers
      • LmP Base Layers
      • LmP BSP Layers
      • The meta-lmp Base Layer
      • The meta-lmp-bsp Layer
      • Customizing the LmP BSP Layers List
    • LmP Distros
      • lmp
      • lmp-base
      • lmp-mfgtool
      • lmp-wayland/lmp-xwayland
    • WIC Image Installer
      • Testing WIC Image Installer With QEMU (x86)
    • Persistent Log Support
      • Disable OpenEmbedded VOLATILE_LOG_DIR
      • Add systemd-journald-persistent to Your Image
      • Optional: Customize systemd-journald Options
    • Network Debugging
      • Using tcpdump
        • Capturing Bluetooth 6lo Network Traffic
        • Capturing LAN Network Traffic
        • Other Network Interfaces
        • Capturing to a File
      • External References
    • Disk Encryption Support
      • Prerequisites
      • Enabling Support for Disk Encryption
        • Implementation Details for OP-TEE PKCS#11 Support
        • Testing TPM 2.0 Support With Qemu (x86) and swtpm
      • Implementation Details for OP-TEE PKCS#11 Support
        • Testing PKCS#11 Support With Qemu (arm64)
    • Updating the Linux microPlatform Core
      • Updating Your Factory
        • lmp-manifest
          • Common Pitfalls
        • meta-subscriber-overrides
      • Verifying Your Work
      • Merging Back to Development
      • Common Errors and Tips
    • LmP Root File-System Over NFS
      • Introduction
      • NFS Use Case: Validation of eMMC Card
      • Enabling NFS Support on initramfs
      • Preparing the NFS Server
      • Preparing the TFTP Server
      • Using U-boot to Boot the NFS
    • Development Mode
    • OSS Compliance With FoundriesFactory
      • Providing Source Code and License Manifest
      • How to Avoid Using Packages Depending on the License
        • INCOMPATIBLE_LICENSE
        • IMAGE_LICENSE_CHECKER_ROOTFS_DENYLIST
      • How to Remove Packages Under GPLv3 Family License
    • Factory Reset
      • Full Factory Reset
      • Partial Factory Reset
        • Keep SOTA
        • Keep SOTA and Docker
        • RPMB
    • Building The Yocto Project Standard SDK
      • Installation
    • Toolchain
      • Changing the Toolchain
      • Customizing the Default Toolchain
  • Over the Air Updates
    • Architecture Overview
      • How A Device Uses Security Hardware
      • How A Device Finds Updates
    • Fioconfig
      • Configuration Storage
      • Implementation
      • Diagram
    • Aktualizr-Lite
      • Daemon Mode (Default)
      • Configuration
        • Configuration Update Methods
        • Parameters
    • Device Tags
      • Managing Tags
    • Advanced Tagging
      • Terminology
      • Scenario 1: A New Platform Build That Re-Uses Containers
      • Scenario 2: Multiple Container Builds Using the Same Platform
      • Scenario 3: Multiple Teams, Different Cadences
    • Configuring Devices
      • Fleet-Wide Configuration
      • Device Group Specific Configuration
      • Device Specific Configuration
      • “Raw” Configuration
    • Targets Overview
      • Visualizing a Factory
    • CI Targets
      • Condensed Targets
      • Target Pruning
    • Production Targets
      • Performing a Production OTA
      • Advanced Usage
        • Releasing to Canary Devices
        • Releasing to Large Device Fleets
        • Integration with External Device Management Systems
        • Going Beyond Limits
    • OSTree Static Deltas
      • Generating Static Deltas
        • Understanding Why Static Deltas are Needed
        • Creating Static Deltas
    • Update Rollback
      • Rollback Driven by Rootfs Update Failure
        • Rollback Driven by a Bootloader Update Failure
      • Rollback Driven by Compose Apps Update Failure
        • Apps Driven Rollback in the Case of a Composite Update
        • Apps Driven Rollback in the Case of a Just Apps Update
  • Remote Access
    • WireGuard VPN
      • Actions on VPN Server
      • Enabling Remote Access to a Device
      • Changing Wireguard Server Address
      • Troubleshooting
        • Method 1
        • Method 2
        • Further Debug
  • Security
    • Overview
    • FoundriesFactory Security Summary
      • Summary of Crypto Keys Used by FoundriesFactory
        • Secure Connection to Cloud Services
        • Secure Boot (Hardware Root of Trust)
        • Secure Online Keys for Boot Stack
        • Secure Over the Air Updates
    • Secure Connection to Cloud Services
      • Managing Factory PKI
        • Terminology
          • Root of Trust: factory_ca.key / factory_ca.pem
          • Server TLS Certificate: tls-crt
          • Device Client Certificate
          • Online Device CA: online-ca
          • Local Device CA: local-ca
          • EST Server TLS Certificate: est-tls-crt
        • Managing Your Factory PKI
          • Setting Up Your PKI
          • Rotating Server TLS Certificate
          • Adding Device CA
          • Revoking Device CA
        • Related Topics
      • Manufacturing Process for Device Registration
        • Fully Detached
        • Registering Production Device by Default
          • lmp-device-auto-register Configuration
          • Registration Reference Configuration
        • Partially Detached
          • Partially Detached lmp-device-auto-register Configuration
          • Partially Detached Registration Reference Configuration
      • Device Network Access
      • Device Certificate Rotation
        • How It Works
        • Tracking Progress
        • Next Steps
    • Secure Boot (Hardware Root of Trust)
      • Secure Boot on i.MX 6/7/8M Using HABv4
        • Our Implementation
        • HABv4 Architecture Overview
        • How to Secure the Platform
          • i.MX 7ULP Fusing
          • i.MX 8MM Fusing
        • How to Sign an SPL Image
          • How to Sign an SPL Image for SDP
          • Booting Signed Images With the Universal Update Utility
          • How to Sign an M4 Binary for HABv4 Validation
        • Booting a Closed System With a CAAM Device
      • Secure Boot on i.MX 8/8X Families Using AHAB Including 8QM
        • AHAB Architecture Overview
        • How to Secure the Platform
        • i.MX 8QM Fusing
        • How to Sign an i.MX Boot Image
        • How to Close the Board
        • How to Close the Board Using UUU Script
      • Secure Boot on STM32MP1
        • Our Implementation
        • Generate RoT ECC key Pair
        • How to Secure the Platform (Automatic Approach)
          • Automatic Signing Using LmP
          • Provision PKH, HUK and RPMB
          • Flash System Images to SD/eMMC
        • How to Secure the Platform (Manual Approach)
          • Fuse PKH Manually
          • Sign and Deploy the BL2 Image Manually
          • Booting Signed Images
          • Closing the Device
      • Secure Boot on TI AM62x
        • Secure Board Provisioning
          • Fusing Keys
          • Certificate Generation in the OTP KeyWriter
        • Installing Software on Secured Boards
      • Secure Boot on Zynq UltraScale+ MPSoC
        • Get the PMU Firmware
        • Build the Bootloader
        • Create the Primary and Secondary Keys
        • Create the Bootable Image
        • Check the Bootable Image
        • Fuse the Primary Public Key SHA-384
        • Program the Bootable Image
        • Sign the FPGA Fitstream
        • Booting SPL
        • Integrating the Signed boot.bin in LmP
        • Secure Storage (RPMB) using the PUF
      • Unified Extensible Firmware Interface (UEFI) Secure Boot
        • Our Implementation
        • Keys and Roles
        • Vendor Operating Modes for UEFI Secure Boot
        • Creating UEFI Secure Boot Keys
        • Enabling UEFI Secure Boot Usage in LmP
        • UEFI Secure Boot Provisioning
        • Testing UEFI Secure Boot Provisioning With QEMU
        • Backup Current UEFI Secure Boot Certificates
        • Enrolling Custom UEFI Secure Boot Certificates
        • Verifying the UEFI Secure Boot State
        • Additional Documentation and References
      • Machines with Secure Aspects Enabled by FoundriesFactory
        • Supported Machines
        • Enabling
        • Using the Secure Machine
        • Using Custom Keys
          • Creating the Keys
          • Generate the MfgTools Scripts
        • Accessing Secure Storage
          • Writing to Secure Storage
          • Reading From Secure Storage
      • Revoke Secure Boot Keys on i.MX
        • Revocation of a Key: Overview
        • How to Sign the Boot Image for Revoking a Key
        • How to Revoke a Key
        • How to Revoke a Key for Devices in a Fleet
      • OP-TEE on the Versal Adaptive Compute Acceleration Platform
        • Overview
        • Cryptographic driver
        • Other drivers
        • Hardware Unique Key
        • Working Effectively With the Boot Firmware
    • Secure Online Keys for Boot Stack
      • Crypto Keys Used by FoundriesFactory at Build Time
        • Secure Boot Flow
          • i.MX Secure Boot Flow
          • STM32MP15 Secure Boot Flow
          • UEFI Secure Boot Flow
        • FoundriesFactory Keys
          • How to Rotate the FoundriesFactory Keys
            • U-Boot Keys
            • OP-TEE Keys
            • TrustedFirmware-A Keys
            • Linux Kernel Modules Keys
    • Secure Over the Air Updates
      • Offline Factory TUF Keys
        • How to Rotate Offline TUF Root Key
        • How to Rotate Offline TUF Targets Key
        • How to View Offline TUF Keys
        • How to Backup Offline TUF Keys
        • Expert Mode
          • How to Add More Than 1 Offline TUF Keys
          • How to Increase the TUF Signature Threshold
          • Recommended Offline TUF Keys Schema
      • Secure Boot Firmware Updates
        • Boot Software Updates on iMX
          • Boot Artifacts
            • SPL
            • U-Boot FIT Image
          • MMC Boot Image Layout
          • Boot Flow
            • SPL
            • ATF (ARMv8)
            • OP-TEE
            • U-Boot
          • Update Procedure
            • Primary vs Secondary Boot Paths
            • libaktualizr and aktualizr-lite
            • U-Boot boot.cmd Script
          • Add a New Board
            • TF-A/OP-TEE
            • U-Boot
              • SPL: FIT Image Offset Calculation
              • Fastboot: Support of Secondary Boot Image Offsets
              • Secondary Image Table Generation
              • Watchdog
            • meta-lmp
              • MfgTool Scripts
              • lmp.cfg Files
              • Pre-Load boot.cmd by SPL
            • Test Basic API
            • boot.cmd
            • Sysroot and Signed Boot Artifacts
        • Boot Software Updates on iMX8QM
          • Boot Artifacts
            • imx-boot Image
            • U-Boot FIT Image
          • MMC Boot Image Layout
          • Update Procedure
            • Primary vs Secondary Boot Paths
            • Libaktualizr and Aktualizr-Lite
            • U-Boot boot.cmd Script
          • Add a New Board
            • meta-lmp
              • mfgtool Scripts
              • lmp.cfg Files
              • Pre-Load boot.cmd by SPL
            • Test Basic API
            • boot.cmd
            • Sysroot and Signed Boot Artifacts
        • Boot Software Updates on Zynq UltraScale+ MPSoC
          • Boot Artifacts
            • Boot Image
            • U-Boot FIT Image
          • Boot Media
            • Golden Image Search
            • MMC Boot Image Layout
            • QSPI Boot Image Layout
          • Boot Flow
            • PMU BootROM
            • CSU BootROM
            • SPL
            • ATF (ARMv8)
            • OP-TEE
            • U-Boot
          • Update Procedure
            • Primary vs Secondary Boot Paths
            • Libaktualizr and Aktualizr-lite
            • U-Boot boot.cmd Script
          • Add a New Board
            • U-Boot
              • SPL: FIT Filename Calculation During MMC Boot
              • SPL: FIT Offset Calculation During QSPI Boot
            • meta-lmp
              • The lmp.cfg File: QSPI boot
              • Pre-Load boot.cmd With SPL
            • Test Basic API
            • boot.cmd
            • Sysroot and Signed Boot Artifacts
          • Deploy Boot Images to QSPI Flash
        • Boot Software Updates on STM32MP1
          • Boot Artifacts
            • STM32 TF-A BL2 Image
            • TF-A FIP Image
          • MMC Boot Image Layout
          • Update Procedure
            • Primary vs Secondary Boot Paths
            • Libaktualizr and Aktualizr-lite
            • The U-Boot boot.cmd Script
          • Adding a New Board
            • meta-lmp
              • Flash Layout File (eMMC Boot)
              • WKS Layout (SD Boot)
            • Testing FSBL Set and Auth Status
            • boot.cmd
            • Sysroot and Signed Boot Artifacts
        • Anti-Rollback Protection
          • Introduction
          • Store Boot Firmware Version in Boot Firmware Artifacts
          • Enable U-Boot Access to Boot Firmware Metadata
          • Enable Anti-Rollback Protection
    • Secure Element as Secrets Storage
      • EdgeLock™ SE05x: Plug & Trust Secure Element
        • NXP SE05x Plug & Trust MW
        • NXP SE05x Plug & Trust TEE Integration
        • OP-TEE Integration
        • Serial Communications to the SE05x
        • Secure Communication Protocol 03
        • SE05x Non Volatile Memory
        • Importing Secure Objects to PKCS#11 Tokens
      • Enabling SE05X
        • Special Cases
      • Trusted Platform Module
        • TPM 2 Software Stack
        • TPM 2 PKCS#11 Support
        • Validating TPM 2 PKCS#11
        • Registering LmP Devices With TPM 2 PKCS#11
  • Testing
    • Test Plan
      • What to Test
        • LmP Test Plan
        • OS Features
          • Boot Test and Smoke Test
          • OSTree
          • Docker
          • Networking on Host
          • Interface Testing (Optional)
        • Device Update
          • Aktualizr (OTA API)
          • Device Config (Fioconfig)
      • How To Test
        • LmP Tests
          • Boot Testing
          • Basic Tests
      • When to Test
    • Architecture Overview
      • Workflow
    • Fiotest
      • The Model
      • The API
        • POST /tests/
        • PUT /tests/<test id>
      • Creating Custom Tests

Porting Guide

  • Factory Porting Guide
    • Introduction
      • Finding a Similar Supported Reference Board
      • Requirements Before Porting to the LmP
      • DISTRO lmp-base for Easy Kernel Image Access
      • How to Plan the Porting
      • Machine Configuration File
      • lmp-factory-custom
      • U-Boot
        • SPL
        • OP-TEE (When Applicable)
        • Creating the U-Boot Configuration Fragments
        • U-Boot Environment and Boot Script
      • Kernel and Device Tree
        • How To Configure the Linux Kernel
        • Adding a New Kernel Driver
      • MFGTool For i.MX Boards
      • Checklist

Glossary

  • Glossary

Release Notes

  • v94
  • v93
  • v92
FoundriesFactory
  • Search

Linux® is the registered trademark of Linus Torvalds in the U.S. and other countries.

Built with Sphinx using a theme provided by Read the Docs.