<span style="font-size:0.9em;color:#3b9c60">COSCUP 2018</span> <span style="font-size:0.7em;">分享研究 <span style="color:#550088">Mender OTA</span> 開源方案的心得</span> === 講者 : `李東霖` --- <!-- .slide: data-background="https://i.imgur.com/H4VYoCV.jpg" data-background-size="30%" data-background-position="left" --> ### 自我介紹 - 李東霖 - 現在是碩士 0 年級 - 第一次來到 COSCUP <!--  --> ---- #### 為什麼來研究 Mender OTA --- <!-- .slide: data-background="https://mender.io/user/themes/mender/images/optimized/logo400px.png" data-background-size="30%" data-background-position="left bottom" --> ### 什麼是 Mender > "Over-the-air software updates > for embedded Linux > Mender is an end-to-end > open source updater > for connected IoT devices" > > [name=Mender 官網] by Apache License 2.0 --- <!-- .slide: data-background="https://mender.io/user/themes/mender/images/optimized/logo400px.png" data-background-size="30%" data-background-position="left bottom" --> ### 架構  --- <!-- .slide: data-background="https://mender.io/user/themes/mender/images/optimized/logo400px.png" data-background-size="30%" data-background-position="left bottom" --> ### Mender client or updater https://github.com/mendersoftware/mender - 用 go 寫成 - 可藉由 yocto project 整合進 device - 也能自行整合 ---- #### partition layout  ---- #### image-based v.s. package-based [source](https://mender.io/blog/package-vs-image)  ---- | | image-based | package-based | | -------- | :--------: | :--------: | | 更新範圍 | 大 | 小 | | 更新時間 | 多 | 少 | | 測試難度 | 易 | 難 | | atomic op | :o: | :x: | ---- ### meta-mender https://github.com/mendersoftware/meta-mender 內含有多個 yocto 層(layer) <span> <!-- .element: class="fragment" data-fragment-index="1" --> - ==`meta-mender-core`== - 佈署 mender client - 處理 boot config 和 layout - 有多個 bbclass 供功能整合 </span> <span> <!-- .element: class="fragment" data-fragment-index="2" --> - ==`meta-mender-demo`== - 可與 demo server 一起使用 - 示範 client 功能 </span> ---- ### 官方已整合硬體 - ==`meta-mender-raspberrypi`== - 可搭配 ==`meta-mender-raspberrypi-demo`== - ==`meta-mender-qemu`== - Beagle bone board --- <!-- .slide: data-background="https://mender.io/user/themes/mender/images/optimized/logo400px.png" data-background-size="30%" data-background-position="left bottom" --> ### Mender artifact 使用在 client 進行更新的特殊格式 ==`.mender`== - 版本名稱 - 相容設備 - 更新的 rootfs image - 更新時的狀態腳本 - 可簽名 工具 **`mender-artifact`** 可產生與修改該檔案類型 https://github.com/mendersoftware/mender-artifact ---- ```shell Mender artifact: Name: release-2 Format: mender Version: 2 Signature: no signature Compatible devices: '[qemux86-64]' State scripts: Updates: 0: Type: rootfs-image Files: name: core-image-full-cmdline-qemux86-64.ext4 size: 226492416 modified: 2018-08-08 17:31:30 +0800 CST checksum: 03c643e2401dd3c675c29992be0d15b36f405d5fbfd4619fdff202256dcdc2b6 ``` --- <!-- .slide: data-background="https://mender.io/user/themes/mender/images/optimized/logo400px.png" data-background-size="30%" data-background-position="left bottom" --> ### Mender server  ---- #### microservices - [Mender Device Admission Service](https://github.com/mendersoftware/deviceadm) - [Mender Device Authentication Service](https://github.com/mendersoftware/deviceauth) - [Mender Deployment Service](https://github.com/mendersoftware/deployments) - [Mender Device Inventory Service](https://github.com/mendersoftware/inventory) - [Mender User Administration Service](https://github.com/mendersoftware/useradm) - [Mender API Gateway](https://github.com/mendersoftware/mender-api-gateway-docker) - [Minio](https://www.minio.io/) object storage - Storage service proxy based on [OpenResty](https://openresty.org/en/) - [Mender Web GUI](https://github.com/mendersoftware/gui) ----  ---- #### integration https://github.com/mendersoftware/integration - 每個 microservice 為 docker service - 利用 docker-compose 管理 ```shell $ ./up #開啟所有 service $ ./stop #關閉所有 service ``` --- ### 使用者 流程 ```flow st=>start: 開始 make=>operation: 製作或取得映像檔(包含完整分區) provisioning=>operation: 燒錄進設備並取得 server 授權 newversion=>condition: 有新版本？ newart=>operation: 產生新的 mender-artifact upload=>inputoutput: 上傳 mender server deployment=>operation: 使用 server 建立新的佈署 make->provisioning->newversion newversion(no, )->newversion newversion(yes, right)->newart->upload->deployment(right)->newversion ``` ---- ### 設備(Mender client) 流程  --- ### state scripts 狀態腳本 - Mender client 狀態轉換間呼叫 - 方便客製化 e.g. 重開前先結束運作功能、啟用網路的時機、設備功能的驗證與啟動... --- ### 安全性 因為任何人都可以知道 mender 的行為 有什麼機制避免被白箱攻擊？ ---- #### HTTPS client 有 server 憑證 可驗證 server 來源 ---- #### 設備授權 - 預先授權 - 先產生 key pair 並註冊在 server <br> - 請求授權 - client 自行產生 ，再對 server 請求註冊 ---- #### 更新檔 artifact 簽名  --- <!-- .slide: data-background="https://mender.io/user/themes/mender/images/optimized/logo400px.png" data-background-size="30%" data-background-position="left bottom" --> ### 商業模式 - open source - know how - hardware & software 服務 --- ### demo --- ### 心得 --- # 感謝聆聽 #### ==any question ?== <style type="text/css"> .reveal section img { border : 0px; } .reveal blockquote { background : rgba(0, 0, 0, 0.15); } </style>