RAUC(1)

📦
version 1.15.2 · 10 versions
, in arch rolling

🌸 RAUC(1) — the rauc manual, but make it make sense 💅

okay bestie, so this is the manual page for rauc, aka safe and secure updating, and I'm gonna walk you through it like we're on facetime. the manual name you're looking at is RAUC — that's the program, that's the page, that's the whole vibe. ✨

💖 NAME

rauc — safe and secure updating. literally that's it, that's the whole thing, and honestly? iconic. 👑

🎀 SYNOPSIS

rauc [OPTIONS...] bundle INPUTDIR BUNDLE

rauc [OPTIONS...] resign INBUNDLE OUTBUNDLE

rauc [OPTIONS...] extract BUNDLE OUTPUTDIR

rauc [OPTIONS...] extract-signature BUNDLE OUTPUTSIG

rauc [OPTIONS...] convert INBUNDLE OUTBUNDLE

rauc [OPTIONS...] encrypt INBUNDLE OUTBUNDLE

rauc [OPTIONS...] install BUNDLE

rauc [OPTIONS...] info BUNDLE

rauc [OPTIONS...] mount BUNDLE

rauc [OPTIONS...] status [SLOTNAME | mark-{good,bad,active}
[booted|other|SLOTNAME]]

rauc [OPTIONS...] write-slot SLOTNAME IMAGEFILE

the way that last status line is doing the most with those brackets… she's complex, she's worth it, we love her. 🫶

🦋 DESCRIPTION

so RAUC is a lightweight update client that runs on an Embedded Linux device and reliably controls the procedure of updating the device with a new firmware. no cap, that's the job description.

RAUC is also the tool on the host system that is used to create, inspect and modify update files (aka "bundles") for the device. so she does both sides of the group chat, lowkey main character energy. 💅

This manual page documents briefly the rauc command line utility — like, the short version.

It was written for the Debian GNU/Linux distribution to satisfy the packaging requirements. Thus it should only serve as a summary — so ngl, reading the comprehensive online manual (https://rauc.readthedocs.io/) is recommended. that one's the full lore, this is the recap. 📖

✨ OPTIONS

The following general options can be used with most commands, however not all combinations make sense. (like, they're not all gonna slay together, y'know?)

  • -c FILENAME, --conf=FILENAME — use the given config file instead of the one at the compiled-in default path
  • -C SECTION:KEY=VALUE, --confopt=SECTION:KEY=VALUE — Override parameters from the config file with the specified configuration settings. If specified parameter is not present in the config file it will still be set by this option. (she WILL be added, periodt) 💁‍♀️
  • --keyring=PEMFILE — use specific keyring file
  • --mount=PATH — mount prefix (/mnt/rauc by default)
  • -d, --debug — enable debug output
  • --version — display version
  • -h, --help — print usage

👑 COMMANDS

🍓 bundle INPUTDIR BUNDLE

Create a bundle from a content directory. yes, we're making a bundle. yes, it's gonna be cute. ✨

Options:

  • --cert=PEMFILE|PKCS11-URL — use given certificate file or the certificate referenced by the given PKCS#11 URL
  • --key=PEMFILE|PKCS11-URL — use given private key file or the key referenced by the given PKCS#11 URL
  • --intermediate=PEMFILE|PKCS11-URL — intermediate CA file or the certificate referenced by the given PKCS#11 URL
  • --signing-keyring=PEMFILE — verification keyring file
  • --mksquashfs-args=ARGS — mksquashfs extra args

🌈 resign INBUNDLE OUTBUNDLE

Resign an already signed bundle. glow-up, but for signatures. 💅

Options:

  • --append — append instead of replace signature
  • --cert=PEMFILE|PKCS11-URL — use given certificate file or the certificate referenced by the given PKCS#11 URL
  • --key=PEMFILE|PKCS11-URL — use given private key file or the key referenced by the given PKCS#11 URL
  • --intermediate=PEMFILE|PKCS11-URL — intermediate CA file or the certificate referenced by the given PKCS#11 URL
  • --no-verify — disable bundle verification
  • --no-check-time — don't check validity period of certificates against current time
  • --signing-keyring=PEMFILE — verification keyring file

🧚 extract BUNDLE OUTPUTDIR

Extract the bundle content to a directory. unboxing video, but make it filesystem. 📦

Options:

  • --key=PEMFILE|PKCS11-URL — use given decryption key file or the decryption key referenced by the given PKCS#11 URL
  • --trust-environment — trust environment and skip bundle access checks

🌸 extract-signature BUNDLE OUTPUTSIG

Extract the bundle signature. just the signature. the ~lewk~ only. ✍️

Options:

  • --key=PEMFILE|PKCS11-URL — use given decryption key file or the decryption key referenced by the given PKCS#11 URL
  • --trust-environment — trust environment and skip bundle access checks

⭐ convert INBUNDLE OUTBUNDLE

Convert an existing bundle to casync index bundle and store. she's getting a makeover. 💫

Options:

  • --cert=PEMFILE|PKCS11-URL — use given certificate file or the certificate referenced by the given PKCS#11 URL
  • --key=PEMFILE|PKCS11-URL — use given private key file or the key referenced by the given PKCS#11 URL
  • --intermediate=PEMFILE|PKCS11-URL — intermediate CA file or the certificate referenced by the given PKCS#11 URL
  • --trust-environment — trust environment and skip bundle access checks
  • --no-verify — disable bundle verification
  • --signing-keyring=PEMFILE — verification keyring file
  • --mksquashfs-args=ARGS — mksquashfs extra args
  • --casync-args=ARGS — casync extra args
  • --ignore-image=SLOTCLASS — ignore image during conversion

💜 encrypt INBUNDLE OUTBUNDLE

Encrypt a crypt bundle. 🔐 (yes the name is like that. we don't ask, we just accept. 😭)

Options:

  • --to PEMFILE — recipient cert(s)

🔥 install BUNDLE

Install a bundle. the actual moment. the main event. 🎬

Options:

  • --ignore-compatible — disable compatible check
  • --ignore-version-limit= — disable version check
  • --transaction-id=UUID — custom transaction ID
  • --require-manifest-hash=HASH — require a specific manifest hash
  • --progress — show progress bar
  • --tls-cert=PEMFILE|PKCS11-URL — TLS client certificate file or PKCS#11 URL
  • --tls-key=PEMFILE|PKCS11-URL — TLS client key file or PKCS#11 URL
  • --tls-ca=PEMFILE — TLS CA file
  • --tls-no-verify — do not verify TLS server certificate
  • -H, --http-header='HEADER: VALUE' — HTTP request header (multiple uses supported) — yes bestie you can stack it, she said multiple uses supported 💅
  • --handler-args=ARGS — extra arguments for full custom handler
  • --override-boot-slot=BOOTNAME — overrides auto-detection of booted slot

🦄 info BUNDLE

Print bundle info. a little peek at what's inside, no commitment. 👀

Options:

  • --no-verify — disable bundle verification
  • --no-check-time — don't check validity period of certificates against current time
  • --key=PEMFILE|PKCS11-URL — use given decryption key file or the decryption key referenced by the given PKCS#11 URL
  • --output-format=[readable|shell|json|json-pretty|json-2] — select output format
  • --dump-cert — dump certificate
  • --dump-recipients — dump recipients
⚠️ okay so this part matters: the json-2 output format matches the structure of the InspectBundle D-Bus API and should be used instead of json or json-pretty. like, those two are giving deprecated cousin energy — use json-2, periodt. 💀

🎀 mount BUNDLE

Mount a bundle for development purposes to the bundle directory in RAUC's mount prefix. It must be unmounted manually by the user.

🫶 heads up bestie: manually. like, you gotta unmount it yourself, nobody's doing it for you. don't just walk away and leave her mounted, that's not the vibe. 🙈

🌟 status [SLOTNAME | mark-{good,bad,active} [booted|other|SLOTNAME]]

Without further subcommand, it simply shows the system status or status of a specific slot. vibe check on your slots, basically. ✅

The subcommands mark-good and mark-bad can be used to set the state of a slot explicitly. These subcommands usually operate on the currently booted slot if not specified per additional parameter.

The subcommand mark-active allows one to manually switch to a different slot. Here too, the desired slot can be given per parameter, otherwise the currently booted one is used.

Options:

  • --detailed — show more status details
  • --output-format=[readable|shell|json|json-pretty] — select output format
  • --override-boot-slot=BOOTNAME — overrides auto-detection of booted slot

💀 write-slot SLOTNAME IMAGEFILE

Manually write image to slot (using slot update handler). This bypasses all other update logic and is for development or special use only!

🚨 literally please read this: it bypasses all other update logic, and it is for development or special use only! not me watching you use this in production… 😭 don't. fr fr.

Options:

  • --image-type — Select explicit image type to use.

🌿 ENVIRONMENT

  • RAUC_KEY_PASSPHRASE — Passphrase to use for accessing key files (signing only)
  • RAUC_PKCS11_MODULE — Library filename for PKCS#11 module (signing only)
  • RAUC_PKCS11_PIN — PIN to use for accessing PKCS#11 keys (signing only)

(yeah they're all signing only, the trio said no entry for you otherwise 💅)

🧸 FILES

/etc/rauc/system.conf, /run/rauc/system.conf, /usr/lib/rauc/system.conf

The system configuration file is the central configuration in RAUC that abstracts the loosely coupled storage setup, partitioning and boot strategy of your board to a coherent redundancy setup world view for RAUC. (she took all the messy lil pieces and made them a coherent redundancy setup world view — that's her whole thing. 🌍)

RAUC configuration files are loaded from one of the listed directories in order of priority, only the first file found is used: /etc/rauc/, /run/rauc/, /usr/lib/rauc/. first one wins, no second chances, she doesn't do reruns. 🏁

The system.conf is expected to describe the system RAUC runs on in a way that all relevant information for performing updates and making decisions are given.

Similar to other configuration files used by RAUC, the system configuration uses a key-value syntax (similar to those known from .ini files).

💐 AUTHORS

rauc is developed by Jan Luebbe, Enrico Joerns, Juergen Borleis and contributors. 🫶 legends, all of them.

This manual page was written by Michael Heimpold <<mhei@heimpold.de>>, for the Debian GNU/Linux system (but may be used by others). ty for your service, king. 👑

🔗 SEE ALSO

casync(1), mksquashfs(1), unsquashfs(1)

Copyright — 2016-2026, Jan Luebbe, Enrico Joerns, the RAUC contributors

🎀 ok that's the whole page bestie!! this was RAUC 1.15.2, dated Mar 28, 2026, and honestly? she ate. go read the online manual for the deep lore, and remember: unmount your bundles, use json-2, and never touch write-slot in production. love u, bye!! 💖✨🦋

📦 where this page comes from