OTA Connect Developer Guide

Manage metadata expiry dates

If you take the keys for signing metadata offline, you need to refresh the metadata expiry date before it is reached. Otherwise, you won’t be able to push updates. You can also define your own expiry dates when you take your keys offline.

The default expiry dates are as follows:

  • For targets.json, the expiry date is 31 days from the last time you ceated or modified metadata.

  • For root.json, the expiry date is 365 days from the last time you ceated or modified metadata.

Define your own expiry dates

Depending on how you use OTA Connect, set the expiry dates in one of the following ways:

  • If you build software images using Yocto and our meta-updater layer, update your build configuration.

  • If you use the standalone command-line tools, add extra command-line arguments.

  • Build configuration

  • Command-line arguments

If you build a software image that contains aktualizr, your configuration is the local.conf file.

You can find this file in the conf subdirectory of your build project.

For more information, see the build configuration reference and the sample build procedures.

Table 1. Build configuration parameters for metadata expiry
Configuration Description

GARAGE_TARGET_EXPIRES

Use this option to have the metadata expire after a fixed date and time.

Specify the time as a UTC instant. For example:

GARAGE_TARGET_EXPIRES = "2018-01-01T00:01:00Z"

GARAGE_TARGET_EXPIRE_AFTER

Use this option to have the metadata expire after an elapsed period of time.

Specify the number of years, months, and days. For example:

GARAGE_TARGET_EXPIRE_AFTER = "1Y3M5D"

If you use the garage-sign command to take your keys offline, you can also sign your metadata with one of the following expiry arguments.

For more information, see the garage-sign reference documentation.

Table 2. Command-line arguments for metadata expiry
Configuration Description

--expires

Use this option to have the metadata expire after a fixed date and time.

Specify the time as a UTC instant. For example:

garage-sign targets sign --expires 2018-01-01T00:01:00Z  --repo myimagerepo --key-name mytargets

--expire-after

Use this option to have the metadata expire after an elapsed period of time.

Specify the number of years, months, and days. For example:

garage-sign targets sign ----expire-after 1Y3M5D  --repo myimagerepo --key-name mytargets