How to install security updates

Unipi publishes security advisories for vulnerabilities that affect our products. Each advisory names the affected package (for example unipi-firmware6 or unipi-u-boot) and the version that contains the fix. This article explains how to check which version your device runs and how to install the fixed version on Unipi Edge, Unipi Patron, Unipi Neuron, Unipi Gate and Unipi 1.1 / Unipi Lite.

In most cases a standard system update (Method A) installs every published security fix. Use Method B or Method C only when an advisory specifically calls for them.

• Connect to the device over SSH — see How to connect via SSH. If you do not know the password, see Passwords.
• The online methods (A and B) need the device to reach the internet, including the Unipi APT repository.
• All commands below run in the device's terminal. sudo asks for the current user's password.

Before and after updating, note your versions so you can compare them with the version named in the advisory.

• OS and kernel:

  cat /etc/os-release

  uname -a

• A specific package (installed and available version):

  apt-cache policy PACKAGE

• Full details of an installed package:

  dpkg -s PACKAGE

Replace PACKAGE with the name from the advisory, for example unipi-firmware6.

This installs all available fixes, including security updates, and is the recommended method for every product line.

• 1. Refresh the list of available packages:

  sudo apt update

• 2. Install the updates — to update the whole system

  sudo apt upgrade

  or to update a single package named in an advisory (this may also update that package's dependencies)

  sudo apt install --only-upgrade PACKAGE

• 3. Reboot if the kernel, bootloader (u-boot) or IO-board firmware was updated, so the new version is used:

  sudo reboot

• 4. Check the version again and confirm it matches or is newer than the fixed version in the advisory.

Use this only when an advisory asks for one exact package version, or when the device has no internet access.

• 1. Download the exact .deb package from the Unipi repository pool at repo.unipi.technology. See the APT Repository article for details.
• 2. Copy the file to the device (for example into /tmp/) using SCP (WinSCP, FileZilla) or a USB flash drive.
• 3. Install it — the recommended way also resolves dependencies

  sudo apt install ./PACKAGE.deb

  or install the file directly

  sudo dpkg -i /tmp/PACKAGE.deb

• 4. Reboot if a kernel, bootloader or firmware package was installed:

  sudo reboot

• 5. Check the version.

Reflashing installs a completely new OS image. Use it when an advisory calls for it, or for a major version change that a normal update cannot cover.

Follow the flash / backup guide for your product — see Flash / backup the OS and select your controller (Unipi Edge has its own guide at Flash / backup the OS on Edge). How you write the image depends on how the device stores its system:

• Unipi Patron, Unipi Gate and Unipi Edge can be reflashed over the network or from a USB flash drive.
• Unipi Neuron and Unipi 1.1 / Unipi Lite keep the system on an SD card, which you remove and write directly (for example with balenaEtcher).

Each product's flash / backup article describes the exact procedure.

• Unipi 1.1 and Unipi Lite have no IO-board firmware, so no firmware step applies; only the OS packages are updated.
• Unipi Axon is a discontinued (legacy) product line, replaced by the Unipi Patron product line. It no longer receives security updates and is no longer actively supported; contact Unipi support for security questions.

• Security advisories
• Firmware update
• APT Repository
• Flash / backup the OS