RAUC(1) RAUC RAUC(1) NAME rauc - safe and secure updating SYNOPSIS rauc [OPTIONS...] bundle INPUTDIR BUNDLE rauc [OPTIONS...] resign INBUNDLE OUTBUNDLE rauc [OPTIONS...] extract BUNDLE OUTPUTDIR rauc [OPTIONS...] extract-signature BUNDLE OUTPUTSIG rauc [OPTIONS...] convert INBUNDLE OUTBUNDLE rauc [OPTIONS...] encrypt INBUNDLE OUTBUNDLE rauc [OPTIONS...] install BUNDLE rauc [OPTIONS...] info BUNDLE rauc [OPTIONS...] mount BUNDLE rauc [OPTIONS...] status [SLOTNAME | mark-{good,bad,active} [booted|other|SLOTNAME]] rauc [OPTIONS...] write-slot SLOTNAME IMAGEFILE DESCRIPTION RAUC is a lightweight update client that runs on an Embedded Linux device and reliably controls the procedure of updating the device with a new firmware. RAUC is also the tool on the host system that is used to create, inspect and modify update files ("bundles") for the device. This manual page documents briefly the rauc command line utility. It was written for the Debian GNU/Linux distribution to satisfy the packaging requirements. Thus it should only serve as a summary, reading the comprehensive online manual (https://rauc.readthedocs.io/) is recommended. OPTIONS The following general options can be used with most commands, however not all combinations make sense. -c FILENAME, --conf=FILENAME use the given config file instead of the one at the compiled-in default path -C SECTION:KEY=VALUE, --confopt=SECTION:KEY=VALUE Override parameters from the config file with the specified configuration settings. If specified parameter is not present in the config file it will still be set by this option. --keyring=PEMFILE use specific keyring file --mount=PATH mount prefix (/mnt/rauc by default) -d, --debug enable debug output --version display version -h, --help print usage COMMANDS bundle INPUTDIR BUNDLE Create a bundle from a content directory. Options: --cert=PEMFILE|PKCS11-URL use given certificate file or the certificate referenced by the given PKCS#11 URL --key=PEMFILE|PKCS11-URL use given private key file or the key referenced by the given PKCS#11 URL --intermediate=PEMFILE|PKCS11-URL intermediate CA file or the certificate referenced by the given PKCS#11 URL --signing-keyring=PEMFILE verification keyring file --mksquashfs-args=ARGS mksquashfs extra args resign INBUNDLE OUTBUNDLE Resign an already signed bundle. Options: --append append instead of replace signature --cert=PEMFILE|PKCS11-URL use given certificate file or the certificate referenced by the given PKCS#11 URL --key=PEMFILE|PKCS11-URL use given private key file or the key referenced by the given PKCS#11 URL --intermediate=PEMFILE|PKCS11-URL intermediate CA file or the certificate referenced by the given PKCS#11 URL --no-verify disable bundle verification --no-check-time don't check validity period of certificates against current time --signing-keyring=PEMFILE verification keyring file extract BUNDLE OUTPUTDIR Extract the bundle content to a directory. Options: --key=PEMFILE|PKCS11-URL use given decryption key file or the decryption key referenced by the given PKCS#11 URL --trust-environment trust environment and skip bundle access checks extract-signature BUNDLE OUTPUTSIG Extract the bundle signature. Options: --key=PEMFILE|PKCS11-URL use given decryption key file or the decryption key referenced by the given PKCS#11 URL --trust-environment trust environment and skip bundle access checks convert INBUNDLE OUTBUNDLE Convert an existing bundle to casync index bundle and store. Options: --cert=PEMFILE|PKCS11-URL use given certificate file or the certificate referenced by the given PKCS#11 URL --key=PEMFILE|PKCS11-URL use given private key file or the key referenced by the given PKCS#11 URL --intermediate=PEMFILE|PKCS11-URL intermediate CA file or the certificate referenced by the given PKCS#11 URL --trust-environment trust environment and skip bundle access checks --no-verify disable bundle verification --signing-keyring=PEMFILE verification keyring file --mksquashfs-args=ARGS mksquashfs extra args --casync-args=ARGS casync extra args --ignore-image=SLOTCLASS ignore image during conversion encrypt INBUNDLE OUTBUNDLE Encrypt a crypt bundle. Options: --to PEMFILE recipient cert(s) install BUNDLE Install a bundle. Options: --ignore-compatible disable compatible check --ignore-version-limit= disable version check --transaction-id=UUID custom transaction ID --require-manifest-hash=HASH require a specific manifest hash --progress show progress bar --tls-cert=PEMFILE|PKCS11-URL TLS client certificate file or PKCS#11 URL --tls-key=PEMFILE|PKCS11-URL TLS client key file or PKCS#11 URL --tls-ca=PEMFILE TLS CA file --tls-no-verify do not verify TLS server certificate -H, --http-header='HEADER: VALUE' HTTP request header (multiple uses supported) --handler-args=ARGS extra arguments for full custom handler --override-boot-slot=BOOTNAME overrides auto-detection of booted slot info BUNDLE Print bundle info. Options: --no-verify disable bundle verification --no-check-time don't check validity period of certificates against current time --key=PEMFILE|PKCS11-URL use given decryption key file or the decryption key referenced by the given PKCS#11 URL --output-format=[readable|shell|json|json-pretty|json-2] select output format The json-2 output format matches the structure of the InspectBundle D-Bus API and should be used instead of json or json-pretty. --dump-cert dump certificate --dump-recipients dump recipients mount BUNDLE Mount a bundle for development purposes to the bundle directory in RAUC's mount prefix. It must be unmounted manually by the user. status [SLOTNAME | mark-{good,bad,active} [booted|other|SLOTNAME]] Without further subcommand, it simply shows the system status or status of a specific slot. The subcommands mark-good and mark-bad can be used to set the state of a slot explicitly. These subcommands usually operate on the currently booted slot if not specified per additional parameter. The subcommand mark-active allows one to manually switch to a different slot. Here too, the desired slot can be given per parameter, otherwise the currently booted one is used. Options: --detailed show more status details --output-format=[readable|shell|json|json-pretty] select output format --override-boot-slot=BOOTNAME overrides auto-detection of booted slot write-slot SLOTNAME IMAGEFILE Manually write image to slot (using slot update handler). This bypasses all other update logic and is for development or special use only! Options: --image-type Select explicit image type to use. ENVIRONMENT RAUC_KEY_PASSPHRASE Passphrase to use for accessing key files (signing only) RAUC_PKCS11_MODULE Library filename for PKCS#11 module (signing only) RAUC_PKCS11_PIN PIN to use for accessing PKCS#11 keys (signing only) FILES /etc/rauc/system.conf, /run/rauc/system.conf, /usr/lib/rauc/system.conf The system configuration file is the central configuration in RAUC that abstracts the loosely coupled storage setup, partitioning and boot strategy of your board to a coherent redundancy setup world view for RAUC. RAUC configuration files are loaded from one of the listed directories in order of priority, only the first file found is used: /etc/rauc/, /run/rauc/, /usr/lib/rauc/. The system.conf is expected to describe the system RAUC runs on in a way that all relevant information for performing updates and making decisions are given. Similar to other configuration files used by RAUC, the system configuration uses a key-value syntax (similar to those known from .ini files). AUTHORS rauc is developed by Jan Luebbe, Enrico Joerns, Juergen Borleis and contributors. This manual page was written by Michael Heimpold <>, for the Debian GNU/Linux system (but may be used by others). SEE ALSO casync(1), mksquashfs(1), unsquashfs(1) Copyright 2016-2026, Jan Luebbe, Enrico Joerns, the RAUC contributors 1.15.2 March 28, 2026 RAUC(1)