---
slideOptions:
theme : white
---

<span style="font-size:0.9em;color:#3b9c60">COSCUP 2018</span>
<span style="font-size:0.7em;">分享研究 <span style="color:#550088">Mender OTA</span>
開源方案的心得</span>
===

講者 : `李東霖`

---

<!-- .slide: data-background="https://i.imgur.com/H4VYoCV.jpg" data-background-size="30%" data-background-position="left" -->

### 自我介紹

- 李東霖

- 現在是碩士 0 年級

- 第一次來到 COSCUP

<!--  -->

----

#### 為什麼來研究 Mender OTA

---

<!-- .slide: data-background="https://mender.io/user/themes/mender/images/optimized/logo400px.png" data-background-size="30%" data-background-position="left bottom" -->

### 什麼是 Mender

> "Over-the-air software updates
> for embedded Linux
> Mender is an end-to-end
> open source updater
> for connected IoT devices"
>
> [name=Mender 官網]

by Apache License 2.0

---

<!-- .slide: data-background="https://mender.io/user/themes/mender/images/optimized/logo400px.png" data-background-size="30%" data-background-position="left bottom" -->

### 架構


---

<!-- .slide: data-background="https://mender.io/user/themes/mender/images/optimized/logo400px.png" data-background-size="30%" data-background-position="left bottom" -->

### Mender client or updater

https://github.com/mendersoftware/mender

- 用 go 寫成

- 可藉由 yocto project 整合進 device

- 也能自行整合

----

#### partition layout


----

#### image-based v.s. package-based [source](https://mender.io/blog/package-vs-image)


----

| | image-based | package-based |
| -------- | :--------: | :--------: |
| 更新範圍 | 大 | 小 |
| 更新時間 | 多 | 少 |
| 測試難度 | 易 | 難 |
| atomic op | :o: | :x: |

----

### meta-mender

https://github.com/mendersoftware/meta-mender

內含有多個 yocto 層(layer)

<span>
<!-- .element: class="fragment" data-fragment-index="1" -->

- ==`meta-mender-core`==
- 佈署 mender client
- 處理 boot config 和 layout
- 有多個 bbclass 供功能整合
</span>

<span>
<!-- .element: class="fragment" data-fragment-index="2" -->

- ==`meta-mender-demo`==
- 可與 demo server 一起使用
- 示範 client 功能
</span>

----

### 官方已整合硬體

- ==`meta-mender-raspberrypi`==
- 可搭配 ==`meta-mender-raspberrypi-demo`==

- ==`meta-mender-qemu`==

- Beagle bone board

---

<!-- .slide: data-background="https://mender.io/user/themes/mender/images/optimized/logo400px.png" data-background-size="30%" data-background-position="left bottom" -->

### Mender artifact

使用在 client 進行更新的特殊格式 ==`.mender`==

- 版本名稱
- 相容設備
- 更新的 rootfs image
- 更新時的狀態腳本
- 可簽名

工具 **`mender-artifact`** 可產生與修改該檔案類型
https://github.com/mendersoftware/mender-artifact

----

Mender artifact:
  Name: release-2
  Format: mender
  Version: 2
  Signature: no signature
  Compatible devices: '[qemux86-64]'
  State scripts:

Updates:
    0:
    Type:   rootfs-image
    Files:
      name:     core-image-full-cmdline-qemux86-64.ext4
      size:     226492416
      modified: 2018-08-08 17:31:30 +0800 CST
      checksum: 03c643e2401dd3c675c29992be0d15b36f405d5fbfd4619fdff202256dcdc2b6

---

<!-- .slide: data-background="https://mender.io/user/themes/mender/images/optimized/logo400px.png" data-background-size="30%" data-background-position="left bottom" -->

### Mender server


----

#### microservices

- [Mender Device Admission Service](https://github.com/mendersoftware/deviceadm)
- [Mender Device Authentication Service](https://github.com/mendersoftware/deviceauth)
- [Mender Deployment Service](https://github.com/mendersoftware/deployments)
- [Mender Device Inventory Service](https://github.com/mendersoftware/inventory)
- [Mender User Administration Service](https://github.com/mendersoftware/useradm)
- [Mender API Gateway](https://github.com/mendersoftware/mender-api-gateway-docker)
- [Minio](https://www.minio.io/) object storage
- Storage service proxy based on [OpenResty](https://openresty.org/en/)
- [Mender Web GUI](https://github.com/mendersoftware/gui)

----


----

#### integration

https://github.com/mendersoftware/integration

- 每個 microservice 為 docker service

- 利用 docker-compose 管理

$ ./up    #開啟所有 service
$ ./stop  #關閉所有 service

---

### 使用者 流程

st=>start: 開始
make=>operation: 製作或取得映像檔(包含完整分區)
provisioning=>operation: 燒錄進設備並取得 server 授權
newversion=>condition: 有新版本？
newart=>operation: 產生新的 mender-artifact
upload=>inputoutput: 上傳 mender server
deployment=>operation: 使用 server 建立新的佈署

make->provisioning->newversion
newversion(no, )->newversion
newversion(yes, right)->newart->upload->deployment(right)->newversion

----

### 設備(Mender client) 流程


---

### state scripts 狀態腳本

- Mender client 狀態轉換間呼叫

- 方便客製化

e.g. 重開前先結束運作功能、啟用網路的時機、設備功能的驗證與啟動...

---

### 安全性

因為任何人都可以知道 mender 的行為
有什麼機制避免被白箱攻擊？

----

#### HTTPS

client 有 server 憑證
可驗證 server 來源

----

#### 設備授權

- 預先授權
- 先產生 key pair 並註冊在 server
<br>
- 請求授權
- client 自行產生 ，再對 server 請求註冊

----

#### 更新檔 artifact 簽名


---

<!-- .slide: data-background="https://mender.io/user/themes/mender/images/optimized/logo400px.png" data-background-size="30%" data-background-position="left bottom" -->

### 商業模式

- open source

- know how

- hardware & software 服務

---

### demo

---

### 心得

---

# 感謝聆聽
#### ==any question ?==

<style type="text/css">
.reveal section img {
border : 0px;
}
.reveal blockquote {
background : rgba(0, 0, 0, 0.15);
}
</style>