https://umair-as.github.io/blog/tags/ota/Recent content in Ota on Umair's Systems NotebookHugoen-usThu, 23 Apr 2026 00:00:00 +0000https://umair-as.github.io/blog/posts/rauc-streaming-key-tpm2-pkcs11/Thu, 23 Apr 2026 00:00:00 +0000https://umair-as.github.io/blog/posts/rauc-streaming-key-tpm2-pkcs11/Migrating RAUC’s mTLS client key from a file on disk to a TPM2-backed PKCS#11 URI. The recipe wiring was straightforward; the URI was not. module-path is a p11-kit URI extension that libp11 — the parser RAUC’s streaming path actually uses — rejects outright.https://umair-as.github.io/blog/posts/rauc-pkcs11-tpm-streaming-sandbox/Tue, 21 Apr 2026 00:00:00 +0000https://umair-as.github.io/blog/posts/rauc-pkcs11-tpm-streaming-sandbox/Switching RAUC’s streaming mTLS client key from a file path to a PKCS#11 URI produced a one-line error with no obvious cause. The real problem was not the module path, not the engine, and not a missing PIN — it was the sandbox user’s group membership and what tpm2-pkcs11 needs to initialise.