The software-update interface lets devices discover and subscribe to signed package metadata through an XMPP service while package bytes can travel over HTTP(S), HTTP over XMPP, FTP, or another supported URI scheme.
signature, published, created, url, and bytes are required. Signature algorithm and trust keys are manufacturer policy, not inferred from the download server.
The protocol supports querying one package, listing available packages, subscribing/unsubscribing, receiving package-change notifications, and inspecting current subscriptions. Uploading a package and the on-device installation procedure are deliberately implementation-specific.
Safe client flow
- Discover the update service with XMPP service discovery.
- Query package metadata or subscribe by stable file name.
- Compare
published with the last verified installation record.
- Apply randomized delay/backoff before download.
- Stream to a staging area while enforcing the advertised byte limit.
- Verify the complete package signature against a pinned manufacturer trust policy.
- Back up state and check disk, power, hardware, and dependency prerequisites.
- Install atomically or into an inactive slot.
- Health-check the new version and roll back on failure.
- Persist the publication timestamp and outcome for audit.
Never install a package merely because it came from an authenticated broker or HTTPS origin. The package signature and trusted manufacturer key are the authenticity boundary.
Distribution at fleet scale
Brokers can mirror packages in a hierarchy and notify their own connected devices. This prevents a release to millions of devices from becoming a coordinated load spike against one manufacturer endpoint. Clients still need jitter, bounded concurrency, resume support, and a staged rollout policy.
Version policy
Subscriptions use a stable file name, so do not encode the software version in that name. Use the broker publication timestamp for protocol ordering and keep semantic version/build compatibility inside signed package metadata. Define downgrade and rollback authorization separately from normal upgrade policy. 
