Differences

This shows you the differences between two versions of the page.

--- en:sw:04-unipi-firmware:software-update [2026/09/11 09:07] – ↷ Page name changed from en:sw:04-unipi-firmware:security-update to en:sw:04-unipi-firmware:software-update ofojt
+++ en:sw:04-unipi-firmware:software-update [2026/09/17 10:45] (current) – ofojt
@@ Line 1: / Line 1: @@
-==%hide Security updates ==
+==%hide Software updates ==
-====== How to install security updates ======
+====== How to install software updates ======
-<WRAP group center round box 95%>
+This article explains how to keep the software on your Unipi device up to date.
-{{ :files:img_warning-line_b.png?nolink |}}
+Update your device **regularly** — for example as part of routine maintenance. Most fixes, including security fixes, reach the device through an ordinary update, so keeping it up to date is the single most important thing you can do for its security.
-<WRAP half column 13%>
-{{ :en:hw:08_safety-instructions_pseudo-ISO-7010-info.png?nolink |(i)}}
-</WRAP>
-<WRAP half column 83%>
-**Note:** \\
-This article is still under development and some details can change. If you find any errors, please report them to our support team at [[[email protected]|[email protected]]]. Thank you.
-</WRAP>
-</WRAP>
-Unipi publishes [[en:sw:security|security advisories]] for vulnerabilities that affect our products. Each advisory names the affected package (for example ''unipi-firmware6'' or ''unipi-u-boot'') and the version that contains the fix. This article explains how to check which version your device runs and how to install the fixed version on Unipi Edge, Unipi Patron, Unipi Neuron, Unipi Gate and Unipi 1.1 / Unipi Lite.
-In most cases a standard system update (**Method A**) installs every published security fix. Use **Method B** or **Method C** only when an advisory specifically calls for them.
+For known vulnerabilities and the versions that fix them, see the [[en:sw:security|security advisories]].
 <WRAP group center round box 95%>
@@ Line 23: / Line 13: @@
 </WRAP>
 <WRAP half column 83%>
-**Note:** \\
+**Note for Mervis users:** \\
-Normal security updates do not affect the Mervis RT license. Only a major system upgrade (for example Debian 12 to Debian 13) can invalidate it; after such an upgrade, check the Mervis RT license and re-activate it if necessary.
+Normal software updates do not affect the Mervis RT license. Only a major system upgrade (for example Debian 12 to Debian 13) can invalidate it.
 </WRAP>
 </WRAP>
 ===== Before you start =====
   * Connect to the device over SSH — see [[en:automation:unipi-ssh-connect-hidden|How to connect via SSH]]. If you do not know the password, see [[en:sw:04-unipi-firmware:02-passwords|Passwords]].
-  * The online methods (A and B) need the device to reach the internet, including the Unipi [[en:sw:04-unipi-firmware:03-unipi-repo|APT repository]].
+  * The device needs to reach the internet, including the Unipi [[en:sw:04-unipi-firmware:03-unipi-repo|APT repository]].
   * All commands below run in the device's terminal. ''sudo'' asks for the current user's password.
-===== Check your current version =====
-Before and after updating, note your versions so you can compare them with the version named in the advisory.
+===== Updating software packages - Regular maintenance =====
-  * OS and kernel: <code>cat /etc/os-release</code> <code>uname -a</code>
+The standard update method installs the latest packages from both the Debian base system and the Unipi repository.
-  * A specific package (installed and available version): <code>apt-cache policy PACKAGE</code>
+This is the recommended method to stay up-to date with the newest features and security patches.
-  * Full details of an installed package: <code>dpkg -s PACKAGE</code>
-Replace ''PACKAGE'' with the name from the advisory, for example ''unipi-firmware6''.
-===== Method A — Update through APT (recommended) =====
-This installs all available fixes, including security updates, and is the recommended method for every product line.
   * 1. Refresh the list of available packages: <code>sudo apt update</code>
-  * 2. Install the updates — to update the whole system <code>sudo apt upgrade</code> or to update a single package named in an advisory (this may also update that package's dependencies) <code>sudo apt install --only-upgrade PACKAGE</code>
+  * 2. Install the available updates: <code>sudo apt upgrade</code>
   * 3. **Reboot** if the kernel, bootloader (u-boot) or IO-board firmware was updated, so the new version is used: <code>sudo reboot</code>
-  * 4. Check the version again and confirm it matches or is newer than the fixed version in the advisory.
 <WRAP group center round box 95%>
@@ Line 63: / Line 45: @@
 </WRAP>
 </WRAP>
-===== Method B — Install a specific package manually =====
-Use this only when an advisory asks for one exact package version, or when the device has no internet access.
 <WRAP group center round box 95%>
@@ Line 75: / Line 53: @@
 <WRAP half column 83%>
 **Attention:** \\
-This method is for experts. Installing a single package can pull in newer versions of other packages. Whenever possible, use Method A instead.
+Advanced users can install Unipi packages manually — for example to apply a fix on a device without internet access. Download the ''.deb'' from the [[en:sw:04-unipi-firmware:03-unipi-repo|Unipi pool]] at [[https://repo.unipi.technology/debian/pool/|repo.unipi.technology]] and install it. Manually installing dependencies may also be required.
 </WRAP>
 </WRAP>
-  * 1. Download the exact ''.deb'' package from the Unipi repository pool at [[https://repo.unipi.technology/debian/pool/|repo.unipi.technology]]. See the [[en:sw:04-unipi-firmware:03-unipi-repo|APT Repository]] article for details.
-  * 2. Copy the file to the device (for example into ''/tmp/'') using SCP (WinSCP, FileZilla) or a USB flash drive.
-  * 3. Install it — the recommended way also resolves dependencies <code>sudo apt install ./PACKAGE.deb</code> or install the file directly <code>sudo dpkg -i /tmp/PACKAGE.deb</code>
-  * 4. **Reboot** if a kernel, bootloader or firmware package was installed: <code>sudo reboot</code>
-  * 5. Check the version.
-<WRAP group center round box 95%>
-{{ :files:img_warning-line_b.png?nolink |}}
-<WRAP half column 13%>
-{{ :en:hw:08_safety-instructions_pseudo-ISO-7010-info.png?nolink |(i)}}
-</WRAP>
-<WRAP half column 83%>
-**Note:** \\
-Updating the ''unipi-firmware6'' package does not by itself reflash the IO-board firmware. See [[en:sw:04-unipi-firmware:05-update-firmware|Firmware]] for the full firmware-update procedure.
-</WRAP>
-</WRAP>
-===== Method C — Reflash the OS image =====
-Reflashing installs a completely new OS image. Use it when an advisory calls for it, or for a major version change that a normal update cannot cover.
 <WRAP group center round box 95%>
@@ Line 107: / Line 64: @@
 <WRAP half column 76%>
 **Attention:** \\
-Reflashing erases all data and settings on the device. Back up your configuration and data first.
+If an update is not enough — a major version change, or a corrupted system — you can reflash the whole OS image. This **erases all data and settings**, so back up first. Follow the flash / backup guide for your product: [[en:flash-os-image|Flash / backup the OS]].
 </WRAP>
 </WRAP>
-Follow the flash / backup guide for your product — see [[en:flash-os-image|Flash / backup the OS]] and select your controller (Unipi Edge has its own guide at [[en:hw:004-edge:04-image|Flash / backup the OS on Edge]]). How you write the image depends on how the device stores its system:
+===== Updating specific packages =====
+For known vulnerabilities and the versions that fix them, see the [[en:sw:security|security advisories]].
-  * **Unipi Patron, Unipi Gate and Unipi Edge** can be reflashed over the network or from a USB flash drive.
+It is recommended to install the newest version of packages with the guide about regular maintenance above.
-  * **Unipi Neuron and Unipi 1.1 / Unipi Lite** keep the system on an SD card, which you remove and write directly (for example with [[en:sw:05-tools:balenaetcher|balenaEtcher]]).
+To find out which package version you are running — for example to compare it with a version named in an advisory:
+  * A specific package (installed and available version): <code>apt-cache policy PACKAGE</code>
+  * Full details of an installed package: <code>dpkg -s PACKAGE</code>
+To install the specific version of the package:
+  * 1. Refresh the list of available packages: <code>sudo apt update</code>
+  * 2. Install the specific version of the package: <code>sudo apt install PACKAGE=VERSION</code>
+  * 3. **Reboot** if the kernel, bootloader (u-boot) or IO-board firmware was updated, so the new version is used: <code>sudo reboot</code>
-Each product's flash / backup article describes the exact procedure.
+Replace ''PACKAGE'' with the package name, for example ''unipi-altboot''.
 ===== Platform notes =====
   * **Unipi 1.1 and Unipi Lite** have no IO-board firmware, so no firmware step applies; only the OS packages are updated.
-  * **Unipi Axon** is a discontinued (legacy) product line, replaced by the Unipi Patron product line. It no longer receives security updates and is no longer actively supported; contact [[[email protected]|Unipi support]] for security questions.
+  * **Unipi Axon** is a discontinued product line, replaced by the Unipi Patron product line. It no longer receives security updates and is no longer actively supported; contact [[[email protected]|Unipi support]] for security questions.
 ===== See also =====