Rollback protects you from a bad update. Signing protects you from an unauthorized one. You need both, and most industrial deployments are designed with neither.
Automation World has recently published an article on this, co-authored by Giampiero Baggiani (Sfera Labs) and Maximilian Köhl (Silitics), on how to design OTA updates for industrial Linux devices that can actually recover from failure.
The short version: keep two bootable systems, put them on physically separate storage rather than two partitions on the same card, arm a watchdog that reflects application health instead of just a successful boot, sign every bundle, and ship an SBOM with each release. When an update goes wrong, the device returns to the previous system by itself, with no network and no site visit required.
The worked example uses Strato Pi Max in its dual-SD configuration together with Rugix, with the full template available as open source.
Timing matters here too: EU Cyber Resilience Act vulnerability-reporting obligations begin this September. Teams shipping connected products in Europe are going to need a dependable way to push fixes to installed hardware for years after it leaves the factory.
Thanks to the Automation World editorial team for the publication, and to Maximilian Köhl and the Rugix team for the collaboration.
When hardware and software are designed to work together across company boundaries, the result is an ecosystem our partners can genuinely build advanced industrial applications on.
Read the full article here.
