SWUpdate vs Mender vs RAUC: A Yocto OTA Comparison

Embedded Linux products need OTA (Over-The-Air) updates. Security patches, EU CRA vulnerability management mandates, field bug fixes — shipping a product you can't update is a liability.

Three OSS OTA update tools have proven track records in the Yocto ecosystem: SWUpdate, Mender, and RAUC. This guide compares them by architecture, licensing, and Yocto integration to help you pick the right one.

Why OTA Updates Are Now Mandatory

OTA updates for embedded devices shifted from "nice to have" to "required."

Security: CVEs are published daily. Without a way to patch devices in the field, vulnerabilities stay open. SBOM/CVE management detects vulnerabilities, but detection without a delivery mechanism is useless.

Regulation: The EU CRA requires security update capabilities from 2027. The FDA reviews software update plans for medical devices.

Cost: Physical recall and re-flashing costs hundreds of times more than an OTA update.

All three tools support A/B partition schemes (dual copy) with automatic rollback on update failure. That's the fundamental difference from manual flashing.

Quick Comparison

Architecture Comparison

SWUpdate — Maximum Flexibility

SWUpdate is the "do anything" option.

How it works: Streams .swu files (cpio format). The sw-description file at the head defines the update procedure, and handlers process each component.

Strengths:

• Lua scripting for custom handlers (FPGA, MCU firmware, individual files)
• Built-in hawkBit server integration (Suricatta daemon, Eclipse IoT)
• Supports both image-based and file-level updates
• Delta updates are OSS (rdiff handler)

Weaknesses:

• High flexibility means steep initial learning curve
• sw-description uses a custom format (libconfig)
• Server-side requires separate setup (hawkBit is a different project)

Mender — Integrated SaaS

Mender is designed as a client-server pair.

How it works: Uses .mender Artifact format to write images to A/B partitions. Standard layout is 4 partitions: boot / rootfs-A / rootfs-B / data.

Strengths:

• Hosted Mender (SaaS) gives you an OTA environment with zero server setup
• Web UI for device management, update deployment, and log viewing
• Update Modules support .deb/.rpm/Docker/single file updates
• Extensive documentation and tutorials

Weaknesses:

• Delta updates are Enterprise/Professional only (not available in OSS)
• 4-partition fixed layout constraint
• Go implementation results in a larger footprint than the other two
• SaaS pricing starts at $34/month (50 devices, Basic). Enterprise requires custom pricing

RAUC — Security-First, Lightest

RAUC puts cryptographic signing at the center of its design. It's used by Valve's Steam Deck.

How it works: Installs .raucb bundles (squashfs format) via D-Bus. Bundle signature verification is mandatory — unsigned bundles are rejected by design.

Strengths:

• Mandatory signing ensures security at the design level
• Smallest footprint of the three tools
• Deep D-Bus and systemd integration
• Adaptive Updates (since v1.8) provide OSS delta updates
• LGPL-2.1 makes it easier to embed in proprietary products

Weaknesses:

• No official management server — you build your own
• No web UI or device management dashboard
• File-level updates are less straightforward than image-based ones
• Smaller community compared to SWUpdate and Mender

Yocto Integration in Practice

How each tool integrates with Scarthgap.

SWUpdate + meta-swupdate

# bblayers.conf
BBLAYERS += "/path/to/meta-swupdate"

# conf/local.conf
IMAGE_INSTALL:append = " swupdate"

You define the sw-description file and update image structure yourself. Flexible but requires upfront investment.

For hawkBit server integration:

# conf/local.conf
IMAGE_INSTALL:append = " swupdate-www"
SRC_URI:append:pn-swupdate = " file://defconfig"

Mender + meta-mender

# bblayers.conf
BBLAYERS += "/path/to/meta-mender/meta-mender-core"

# conf/local.conf
INHERIT += "mender-full"
MENDER_ARTIFACT_NAME = "release-1.0"

Adding INHERIT += "mender-full" configures partition layout, bootloader integration, and client installation in one step. Connecting to Hosted Mender requires a tenant token.

RAUC + meta-rauc

# bblayers.conf
BBLAYERS += "/path/to/meta-rauc"

# conf/local.conf
IMAGE_INSTALL:append = " rauc"

In Scarthgap, platform configuration (system.conf, keyring, etc.) was separated into a rauc-conf.bb recipe. Use a bbappend to override system settings for your platform.

# system.conf example
[system]
compatible=my-product
bootloader=uboot

[slot.rootfs.0]
device=/dev/mmcblk0p2
type=ext4

[slot.rootfs.1]
device=/dev/mmcblk0p3
type=ext4

Which Tool Should You Choose

A decision flow based on project constraints.

Filter by license

SWUpdate is GPL-2.0. This typically isn't an issue unless you link against it directly, but legal review may be required.

Filter by server requirements

Filter by team and product characteristics

Wrapping Up

Each tool in one sentence:

All three are mature on Yocto Scarthgap. There's no wrong choice — the difference comes down to licensing, server requirements, and team strengths.

OTA paired with SBOM/CVE management is where the real value lies. Detect CVEs, build patches, deliver via OTA — this workflow is becoming the standard for embedded products.