Skip to content
This repository has been archived by the owner on May 21, 2024. It is now read-only.

OTA-2613 Clean up "aktualizr/docs/ " folder #1208

Merged
merged 1 commit into from
May 23, 2019

Conversation

merltron
Copy link
Contributor

This is part of the wider task of implementing renaming. I replace topics that I consider to be duplicates of what is in the docs repo. In such cases, I indicate the original file in a comment at the top of the file. The replacements contain the new terminology. I also updated the terminology in the "non-duplicate" files.

@merltron merltron requested review from tkfu and pattivacek May 10, 2019 14:13
@merltron merltron force-pushed the doc/OTA-2606/rename-provisioning branch 2 times, most recently from ea2f2de to 9d9ec4e Compare May 10, 2019 14:22
@codecov-io
Copy link

codecov-io commented May 10, 2019

Codecov Report

Merging #1208 into master will decrease coverage by 6.33%.
The diff coverage is n/a.

Impacted file tree graph

@@            Coverage Diff             @@
##           master    #1208      +/-   ##
==========================================
- Coverage   85.59%   79.26%   -6.34%     
==========================================
  Files         231      168      -63     
  Lines       17392    10005    -7387     
==========================================
- Hits        14886     7930    -6956     
+ Misses       2506     2075     -431
Impacted Files Coverage Δ
src/libaktualizr-posix/ipuptanesecondary.cc 82.66% <0%> (-4%) ⬇️
src/libaktualizr/uptane/directorrepository.cc 97.14% <0%> (-1.43%) ⬇️
src/libaktualizr/storage/sql_utils.h 83.09% <0%> (-1.41%) ⬇️
src/aktualizr_primary/secondary.cc 86.3% <0%> (-1.37%) ⬇️
src/libaktualizr/storage/sqlstorage.cc 75.54% <0%> (-0.26%) ⬇️
src/libaktualizr/crypto/crypto_test.cc
tests/leak_test.cc
src/sota_tools/rate_controller_test.cc
src/libaktualizr-posix/asn1/asn1_test.cc
src/libaktualizr/uptane/tuf_test.cc
... and 59 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 8c523ef...623da35. Read the comment docs.

@merltron merltron force-pushed the doc/OTA-2606/rename-provisioning branch from 15fb65e to 613e023 Compare May 10, 2019 15:16
Copy link
Collaborator

@pattivacek pattivacek left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There may also be some information from the deleted docs that may still be useful to carry over. And there's still plenty of code changes, but I assume that'll be a separate branch/PR.

docs/README.adoc Show resolved Hide resolved
docs/README.adoc Outdated Show resolved Hide resolved
docs/README.adoc Outdated Show resolved Hide resolved
docs/client-provisioning-methods.adoc Show resolved Hide resolved
docs/client-provisioning-methods.adoc Outdated Show resolved Hide resolved
docs/linux-secondaries.adoc Show resolved Hide resolved
docs/provisioning-methods-and-credentialszip.adoc Outdated Show resolved Hide resolved
docs/provisioning-methods-and-credentialszip.adoc Outdated Show resolved Hide resolved
docs/provisioning-methods-and-credentialszip.adoc Outdated Show resolved Hide resolved
@merltron
Copy link
Contributor Author

@patrickvacek Can you take another look and see if it's OK to merge?

Copy link
Collaborator

@pattivacek pattivacek left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can confirm everything you've marked as fixed, but a few issues still stand.


When you provision with device credentials, you install permanent credentials each device before the device connects to the server. Unlike shared-credential provisioning, the server doesn't issue any credentials to devices. Instead, you use a root CA certificate to sign the credentials that you install on the device. You then install the same root CA certificate on the OTA Connect server.

Every time the device attempts to connect, the server verifies that the device credentials are signed by the same CA that you originally installed on the server. The device also verifies that is communicating with a genuine {product-name} server.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Still a problem.

docs/enable-implicit-provisioning.adoc Outdated Show resolved Hide resolved

== Use a Hardware Security Module (HSM) When Provisioning with Device Credentials

As described in the link:prod-intro.html[introduction], it's a good idea to use a Hardware Security Model (HSM) to hold potentially sensitive device credentials.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Still broken.

The following procedure describes how to use QEMU and link:https://www.opendnssec.org/softhsm/[SoftHSM] to simulate a device with an HSM. However, the procedure for your HSM will probably be different. We've provided these instructions as a basic guide to how this provisioning method works but you'll need to make further changes on your own. For example, you'll probably need to adapt your BSP so that aktualizr can access the keys from your HSM.

To use an HSM when provisioning with device credentials, follow these steps: ::
. link:generate-and-install-a-root-certificate.html[Generate and install a root certificate].
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Still broken.


'''

link:./provisioning-methods-and-credentialszip.html[More information] is available on provisioning with shared credentials, device credentials (with or without an HSM), and how the various files included in `credentials.zip` are related.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Still broken.


// TODO MERLIN: Figure out if we even want to try to document this beyond what is mentioned on the introduction page. Frankly, I think I doubt it. If you're using libaktualizr, what you probably want is code, doxygen docs, and the example hmi_stub app. Anything we can add here might just be cruft.

// MC: I think we can add valuable content rather than cruft. We'll need some standard "getting started" content (For reference, see the Tracking C client library: https://docs.in.here.com/ci/location_tracking_c/hlp/1.0.0/ed15c72/html/dev_guide/#topics/getting-started.html )
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Still valid.


// MC: I think we can add valuable content rather than cruft. We'll need some standard "getting started" content (For reference, see the Tracking C client library: https://docs.in.here.com/ci/location_tracking_c/hlp/1.0.0/ed15c72/html/dev_guide/#topics/getting-started.html )

The aktualizr client is designed to be run as a standalone component on an embedded system and can manage the entire software update process. However, you might have requirements that got beyond what the standalone client can provide.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Still needs correction.

For this purpose, you can also use libaktualizr to make your own OTA update client. Typical scenarios for making your own client could be:

* You want to integrate {product-name} functionality with a third-party HMI
* You want to integrate {product-name} with a third-party interface that installs software on secondary ECUs
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Still broken.

* You want to constrain network traffic and software updates to specific vehicle states
* You want to provide motorists or service staff with progress indicators for specific software updates.

To get started with libaktualizr see the link:..src/hmi_stub[reference client] and the https://advancedtelematic.github.io/aktualizr/class_aktualizr.html[reference documentation].
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Still broken.


1. The user downloads a package that contains an initial provisioning key. This is installed on all devices and is only used to bootstrap the provisioning process.
2. When Aktualizr first runs on a device, it uses this key/certificate to make a request to the device gateway https API. The server registers the new device and returns a PKCS#12 archive containing the real credentials for the device.
3. The device unpacks the root CA certificate and client certificate from this bundle into the paths specified in the `[storage]` section of the config.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This might not be your fault, but actually they don't get unpacked anywhere except in memory. I would say instead "the device reads the root CA certificate and client certificate from this bundle".

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@patrickvacek I fixed all the issues that I understood. I fixed the broken links, the file name, and stripped out unnecessary comments.

Sorry for being a dunce, but in some instances when you say stuff is "still broken" and "still valid" I don't know what you're referring to. In many cases the content looks fine to me. Basically all the issues that don't concern broken links or comments.

@lbonn
Copy link
Contributor

lbonn commented May 20, 2019

Unrelated to the content but it would be nice to do a bit of git clean up before merging:

  • the 3 commits with same title "OTA-2613 Clean up "aktualizr/docs/ " folder" (and same issue for OTA-2606), but different complete descriptions and actually stacked on top of another. This is convenient for review but not so for browsing history.
  • the merge of master inside the branch which we also try to avoid committing as is

Recommendation: rebase everything onto master and squash the first three and the last two commits together.

@merltron merltron force-pushed the doc/OTA-2606/rename-provisioning branch 2 times, most recently from 1d206c0 to 91d13ae Compare May 22, 2019 13:41
@pattivacek pattivacek force-pushed the doc/OTA-2606/rename-provisioning branch from 91d13ae to 9b699e3 Compare May 22, 2019 13:59
This is part of the wider task of implementing renaming.
I replace topics that I consider to be duplicates of what
is in the docs repo. I indicated this in a comment at the
top of the file. The replacements contain the new
terminology. I also updated the terminology in the
"non-duplicate" files.

Signed-off-by: Merlin Carter <merlin.carter@here.com>
Signed-off-by: Patrick Vacek <patrickvacek@gmail.com>
@pattivacek pattivacek force-pushed the doc/OTA-2606/rename-provisioning branch from 9b699e3 to 623da35 Compare May 22, 2019 14:09
@pattivacek
Copy link
Collaborator

I found a couple small things that slipped through our review, so I fixed them.

A couple other things outside the scope of this PR that should still get fixed:

  1. I still think the procedure in docs/client-provisioning-methods.adoc#configure-a-device-to-provision-with-shared-credentials is not ideal, but I realize this is duplicated from https://docs.ota.here.com/client-config/client-provisioning-methods.html. I think both could be a lot clearer.
  2. The language about root vs fleet CAs is often confused. We don't consistently use fleet CA in all the places we should. This is true in both these docs and the official docs.

@merltron
Copy link
Contributor Author

@patrickvacek Thanks for helping with the stray issues. I will also address the other issues that you raised - as part of this ticket: https://saeljira.it.here.com/browse/OTA-2750.

Can the PR be approved and merged now?

Copy link
Collaborator

@pattivacek pattivacek left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yep, done!

@pattivacek pattivacek merged commit d69f4f6 into master May 23, 2019
@pattivacek pattivacek deleted the doc/OTA-2606/rename-provisioning branch May 23, 2019 11:54
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants