[olpc-help] Confused about updating G1G1 XO

[Richard A. Smith]

Rick Emery wrote:

> 1. I updated olpc-update to version 2.0 per instructions that I found,  
> and have tried updating from a USB thumb drive (olpc-update --usb) and  
> over the internet (olpc-update -rv 656). Both times I got the message:
> 
> New build not signed; this update won't boot without a developer key.
> Update aborted; use --force to override.

The XO laptops ship in what called secure mode.  Or "With security 
enabled"  In this mode the XO will only boot a kernel that has been 
cryptographically signed by OLPC.  The system firmware will also refuse 
to reload an OS image that has not been signed.

None of our developent or testing images are signed so olpc-update is 
telling you that you have a laptop in secure mode and you are trying to 
install an update that will render your machine unbootable until you 
reload a signed OS.

All of our developers and testers use machines that are in non-secure 
mode or "unlocked" via a developer key.  We only test the "secure" 
versions at the very last stage of OS release.

> Is there a definitive resource for keeping a G1G1 laptop up to date?  
> Again, this isn't mine (though I wish I'd gotten one for myself  ),  
> and I have no desire to experiment with my son's educational tool.

The official signed complete OS images are located here:

http://download.laptop.org/xo-1/os/official/

You would use these images via the "hold all 4 buttons down on boot" it 
will _completely_ erase the contents of your NAND flash.  So you would 
only used these for "clean" installs or recovery when the OS won't boot.

If you look at the above URL you will only see 3 images. 650, 653, and 
656.  We call these images ship.x (x = 0,1,2) because the latest of 
these are the images that the factory loads.

These are the _only_ numbers you can feed to olpc-update when your XO is 
in secure mode and have it continue to boot.

So if you wanted to manually run the latest stable image you would use 
'olpc-update 656'.  But you don't have to do that.

Periodically XO's that have internet access will phone home to the olpc 
severs and check for a signed OS update.  If they find one then they 
will prompt the user for an upgrade.  So really, to keep an XO 
up-to-date you don't actually have to do anything until asked.

The current builds that are under heavy testing are called the Update.1 
series.  Its on the path to become the next "signed" (stable) release. 
If you have a developer key and "unlock" your XO then you can see what 
the futures holds for the OS.

And finally there is the Joyride series.  Joyride is automated build 
that pulls the latest and greatest packages from the developers. 
Generally we try to keep it working but every so often we have invasive 
changes (or bugs) that totally break things.  If joyride breaks then you 
can post about it on the devel@ list but you get to keep the pieces.  If 
you are not a developer or bleeding edge tester then you probably don't 
want to live here but it represents the absolute latest in the OLPC 
software stack.

-- 
Richard Smith  <richard at laptop.org>
One Laptop Per Child