This guide will show you how to get started on the Raspberry Pi 4 platform to perform a root filesystem (rootfs) update, with A/B partition support (fail safe). This guide uses an image directly generated by Thistle Yocto Build. You can follow along with our video guide as well.
Thistle Control Center

​
Tools needed

To get started you need to obtain:
Because of issues on the earlier versions of the Raspberry Pi 4, one needs to run on the latest EEPROM firmware. To perform an update, you need to run sudo rpi-eeprom-update -a using the official rpios image.

​
Raspberry Pi setup

To get started simply download and copy the full image onto the SD card - for instance using dd or using the Raspberry Pi imager tool. Once the copy is performed, insert the SD card on the Raspberry Pi and test it’s functional. The user is thistle and the password is raspberry. 
$ sudo dd if=four-v1.5.0.img of=/dev/mmcblk0 status=progress
528062464 bytes (528 MB, 504 MiB) copied, 69.4207 s, 7.6 MB/s
Verify now that your Raspberry Pi is booting up with the Thistle disk image. The username is thistle and the password is raspberry.

​
Create an update bundle

For the purpose of this example, we will release the update image as an update. This image will be deployed with the Release Helper, and will be installed on the target automatically by the Update Client. Let’s start with packaging the update: 
# Set up your project's access token - Bash, on Linux/Unix or Windows Subsystem for Linux (WSL)
$ export THISTLE_TOKEN=$(cat)
(paste access token, press enter, then ctrl-d)

# Set up your project's access token - Windows PowerShell
$ $env:THISTLE_TOKEN = "[Access Token Obtained from Thistle App's Projects Section]"

$ ./trh --signing-method="remote" init -persist="/boot"

# prepare manifest and deploy partition image
$ ./trh --signing-method="remote" prepare --target=./four-v1.5.0-updated.rootfs

$ ./trh --signing-method="remote" release
The command line option --signing-method="remote" uses a Thistle-managed, Cloud KMS-backed ECDSA-P256 key to sign OTA update bundles. For other signing methods supported by TRH, please refer to our blog post OTA Bundle Signing in Production with Thistle Release Helper.

​
Amend device configuration for bootloader

The Thistle Update Client natively supports the Raspberry Pi bootloader. The only step required is to specify the bootloader as RaspberryPi and the two partitions that will be used as root filesystem alternatively. Amend your configuration using the snippet below as the SD card partitions were specified during the image generation. 
$ cat config.json
{
    ...
    "bootloader": "RaspberryPi",
    "part_a": "/dev/mmcblk0p2",
    "part_b": "/dev/mmcblk0p3"
}
It is now required to copy config.json onto the Raspberry Pi, this can be done using scp or using a USB key. This is necessary so that we can run the update client on the Raspberry Pi with the appropriate configuration. Under normal circumstances, this operation will be performed automatically during e.g. the image personalization step of a deploy pipeline. 
# on the host machine - you likely need to amend the IP address
scp config.json thistle@192.168.1.102:~/tuc-config.json
We are now ready to run the client on the Raspberry Pi, and observe our first update cycle.

​
Test deployed release

We can now test our deployed release. Note that as the assets will be downloaded from the Thistle Backend Server, an internet connection is required. 
# on the Raspberry Pi - confirm tuc-config.json file is present
raspberrypi4-64-thistle:~$ cat ~/tuc-config.json

# `mmcblk0p2` is currently used as mountpoint for root
raspberrypi4-64-thistle:~$ mount | grep /dev/mmc
/dev/mmcblk0p2 on / type ext4 (rw,relatime)

# we copy `tuc-config.json` to the /boot directory so that it's persistent
# across updates
raspberrypi4-64-thistle:~$ sudo cp ~/tuc-config.json /boot
Let’s apply the update and see the result. 
raspberrypi4-64-thistle:~$ sudo tuc -c /boot/tuc-config.json
The Raspberry Pi will now reboot. Login again and confirm that the appropriate partition is now the root partition. 
# `mmcblk0p3` is now used as mountpoint for root
raspberrypi4-64-thistle:~$ mount | grep /dev/mmc
/dev/mmcblk0p3 on / type ext4 (rw,relatime)

# this marker file should appear in /home/thistle with the expected content
raspberrypi4-64-thistle:~$ cat message_from_thistle.txt
If you can see this message, your root filesystem has been successfully OTA
updated.

# latch in update by re-running tuc
raspberrypi4-64-thistle:~$ sudo tuc -c /boot/tuc-config.json
You just performed your first automated A/B update cycle 🎉 Have a look at the Thistle App, your device can now be monitored directly there.

​
More options

This tutorial shows how to manually perform an update on the Raspberry Pi. This process can be automated to update a fleet of devices. In this regards, we support different enrollment setups, either based on Trust On First Use (TOFU), or only accepting pre-enrolled devices.