Azure IoT FOTA cannot download update images

[srubin-ns]

I have a test application which uses the "Azure IoT Hub" library. I have set up the IoT Hub, Update Account, update instance, etc. The device does successfully connect to the IoT Hub and sends test MQTT data to the hub. My problem is that the over-the-air updates (FOTA) are not working.

Specifically, the Device Twin info about the update does in fact get to my device and my device does try to download the update binary. It's obvious that my device does not have the credential (SAS?) to download the binary from the Azure storage container.

I do not have the container setup for public access. My assumption is that it should not be public, but the access to the files uses a SAS which is provided by the update.

Here is a snippet of the log (with some specifics x'd out):

00> [00:00:22.744,262] <dbg> azure_iot_hub: device_twin_result_process: Request ID: 221
00> [00:00:22.745,513] <inf> azure_iot_hub_sample: Azure FOTA state report is created and ready to be sent
00> [00:00:22.745,574] <inf> azure_iot_hub_sample: Report: {"firmware":{"fwUpdateStatus":"current","currentFwVersion":"0.0.1"}}
00> [00:00:22.746,978] <inf> azure_fota: Attempting to download firmware (version '0.0.2') from xxxxxxxxxxxxxxxx.blob.core.windows.net/xxxxxxxxxxxxxxxxxx/xxxxxxxxxxx-update_0.1_generated.importmanifest.json
00> [00:00:22.747,100] <inf> download_client: Downloading: xxxxxxxxxxxxcontainer1/xxxxxxxxxxxx-update_0.1_generated.importmanifest.json [0]
00> [00:00:22.747,253] <inf> azure_iot_hub_sample: Azure FOTA download has started
00> [00:00:22.747,314] <inf> azure_iot_hub_sample: Report: {"firmware":{"fwUpdateStatus":"downloading","currentFwVersion":"0.0.1","pendingFwVersion":"0.0.2","jobId":"xxxxxxxxxxx-4171-4209-a49d-700c35567d1d"}}
00> [00:00:22.747,344] <dbg> azure_iot_hub: device_twin_result_process: FOTA message handled
00> [00:00:22.747,375] <inf> azure_iot_hub_sample: AZURE_IOT_HUB_EVT_TWIN_RECEIVED
00> [00:00:23.402,954] <inf> download_client: Setting up TLS credentials, sec tag count 1
00> [00:00:23.403,137] <inf> download_client: Connecting to xxxx.xxxx.xxxx.xxxx
00> [00:00:28.398,742] <err> download_client: Unexpected HTTP response: 409 public access is not permitted on this storage account.
00> [00:00:28.398,773] <err> fota_download: Download client error
00> [00:00:28.400,390] <err> azure_fota: FOTA download failed
00> [00:00:28.400,512] <inf> azure_iot_hub_sample: Azure FOTA error

Questions:

1. Am I supposed to expose the update file(s) to the public? How are they protected such that only my device(s) can download them?

2. Which update file(s) should be used? The zip (which contains the binary) or the manifest json (which would presumably instruct the code as to how to install the update)?

3. Once the update file (zip? Bin? Json?) file is downloaded, does the FOTA library know how to apply it, i.e. reflash itself?

Thank you!

[dejans]

Hi,

Which NCS version do you use?

Have you tried to use Shared Access Signatures (SAS)? You can look at granting limited access using SAS delegating access using SAS, create account SAS, create service SAS and service SAS examples, authorize with shared key, anonymous read access (for testing, presents security risk).

Best regards,
Dejan

[srubin-ns]

 dejans  I am using v2.8.0. (I have also tried v2.9.9 with the same results).

I think I understand the idea of the SAS stuff you mentioned, but what's missing is that there is no token sent in the manifest, or maybe there is, but the FOTA download is not using it.

None of the nRF documentation or examples give any hint as to how to use the tokens. It was my understanding that this was all built into the Azure FOTA library.

Will you please confirm that there is in fact working Azure IoT FOTA in the NCS? Has this actually been made to work with Azure?

Thank you!