Signed OTA Updates for Device Fleets

I have designed the OTA rollout plan for your ESP32 fleet. This configuration uses Secure Boot v2 and A/B partition logic to ensure that any failure during the transition from 1.4.1 to 1.5.0 triggers an automatic rollback to the inactive slot.

ESP32 Staged Rollout Configuration

Deployment Manifest (ota_manifest.json)

{
  "version": "1.5.0",
  "min_version": "1.4.0",
  "url": "https://ota.example.com/bins/esp32_v1.5.0.bin",
  "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
  "signature": "MEUCIQDW8sB7x...[truncated_base64_sig]",
  "rollout_percent": 5,
  "anti_rollback_counter": 2
}

Implementation Steps

1. Enable Rollback: Ensure CONFIG_BOOTLOADER_APP_ROLLBACK_ENABLE=y is set in your ESP-IDF project configuration.

Health Check: Call esp_ota_mark_app_valid_cancel_rollback() in your main task only after verifying Wi-Fi stability and sensor connectivity.
3.

Signature Verification: The bootloader will automatically check the signature field against the public key stored in the hardware secure element or flash.

Next steps

• Flash a single device with a corrupted signature to verify the bootloader rejects the image.
• Simulate a crash before the health check call to confirm the ESP32 rolls back to the 1.4.1 partition.
• Increase rollout_percent to 25% once the Canary device reports 24 hours of stable uptime.