{
"device_enrollment_token": "[REDACTED]",
"name": "demo_device",
"persistent_directory": "/opt/thistle",
"public_keys": ["RWRsXruIAEOcDvpml30guv+LcYbz9dANWqGpr/m3TC1ohzt+z078H91R"],
"okek": "[REDACTED]"
}
Compulsory Fields
| Name | Description |
|---|---|
| name | Name to use when registering with the server |
| persistent_directory | Location of a directory where the Thistle Client can store persistent state. Note: in the case of a bootloader setup, this field should point out the /boot directory |
| public_keys | Array of public key strings for signature verification. A signature will be checked against public keys one by one, in their order of appearance in the array. If the signature is verified by one of the public keys, the OTA manifest is accepted; otherwise, it’s rejected. A new key pair can be generated with the help of the Thistle Release Helper and external signing tools provided by Thistle |
Enrollment Fields
Depending on the device provisioning method, either thedevice_enrollment_token, or all device_id, device_token, device_certificate_pem, and device_private_key_pem will be required.
| Name | Description |
|---|---|
| device_enrollment_token | API token dedicated to enrolling a device with the Thistle backend server. Each token is specific to a given project |
| device_id | A unique identifier for a given device received from the Thistle backend server |
| device_token | A unique token for a given device received from the Thistle backend server |
| device_certificate_pem | A unique X.509 certificate in PEM format for a given device received from the Thistle backend server |
| device_private_key_pem | A unique private key associated with the above device certificate in PEM format for a given device received from the Thistle backend server |
| okek | A unique OTA Key Encryption Key used to decrypt a dek (data encryption key), which is in turn used to decrypt encrypted OTA bundle as well as per-file encrypted (PFE) content on the device |
Optional Fields
| Name | Description |
|---|---|
| network_timeout | Timeout value for network requests, in seconds. Defaults to 30 |
| polling_interval_s | Interval at which the update client will check for updates, in seconds. Defaults to 3600 |
| single_check | Only perform one single round of update check and then exit the program. Defaults to false |
| stop_after_download | This mode of operation will download an update bundle, and then exit the program. The next run of the program will install the update. This mode also enables single_check. Defaults to false |
| backup_manifest_url | Backup manifest URL to use as a fallback in the cases where the Thistle backend server could not be reachable |
| identity_path | Absolute path on the device to the identity file that is used for persisting device-unique credentials |
| metadata_path | Path on the device to the metadata file |
| mqtt_url | URL of the MQTT broker for MQTT-based device-server communications; must be mqtt://v14be8f2.ala.dedicated.gcp.emqxcloud.com to work with Thistle backend. When this field is present, MQTT will be enabled, and mqtt_ca_cert_pem must be configured |
| mqtt_ca_cert_pem | MQTT server certificate chain in PEM format. Must be configured when mqtt_url is present. The value for Thistle backend can be obtained from this page. |
Optional Bootloader Specific Fields
| Name | Description |
|---|---|
| part_a | Path to the “A” partition |
| part_b | Path to the “B” partition |
| switch_part_command | This script is used to indicate the bootloader to attempt a boot on the “other” partition at the next reboot |
| lock_part_command | This script is used to “lock in” the update once the system is restarted, and the update is deemed successful. |
| determine_boot_part_script | Optional helper script to determine currently booted partition. Auto-detection will be attempted if no script is specified. |
Example Configuration With Bootloader
{
"device_enrollment_token": "[REDACTED]",
"name": "demo_device",
"persistent_directory": "/boot",
"public_keys": ["RWRsXruIAEOcDvpml30guv+LcYbz9dANWqGpr/m3TC1ohzt+z078H91R"],
"part_a": "/dev/mmcblk0p2",
"part_b": "/dev/mmcblk0p3",
"bootloader": "raspberrypi"
}