# Software update system

Fuchsia is a project that constantly gets updates for new features, enhancements,
and security fixes. Fuchsia's software update system makes use of
[The Update Framework (TUF) version 1.0](https://github.com/theupdateframework/specification/blob/HEAD/tuf-spec.md).
However, Fuchsia does have some differences from TUF:

- [Specification version](https://fuchsia.dev/fuchsia-src/concepts/packages/software_update_system#specification-version)
- [Package organization](https://fuchsia.dev/fuchsia-src/concepts/packages/software_update_system#package-organization)
- [Merkle root](https://fuchsia.dev/fuchsia-src/concepts/packages/software_update_system#merkle-root)

## Specification version

In a Fuchsia repository, the Fuchsia repository version is listed as a
top-level attribute of the target role's signed data. This example shows
the format of the specification version:

    {
      ...

      "signed": {
        "_type": ROLE,
        "spec_version": "1",
        "custom": {
          "fuchsia_spec_version": <FUCHSIA_SPEC_VERSION>,
      }

      ...
    }

Definition of values:

- `FUCHSIA_SPEC_VERSION`. `INT`. The value of the Fuchsia repository specification version. For example, `1`.

## Package organization

TUF targets in a Fuchsia repository that address Fuchsia packages contain custom
meta data that points to the Package Metadata Archive. This example shows the
format for packages:

    {
      ...

      "targets": {
        "/PACKAGE_PATH": {
          ...
        }

      ...
      }
    }

Definition of values:

- `PACKAGE_PATH`. The relative path to the package from the repository's
  base URL.

  > [!NOTE]
  > **Note:** At the moment the only supported path is `PACKAGE/VARIANT`, where `PACKAGE` is the package name and `VARIANT` is the package version.

## Merkle root

In the Fuchsia repository, each package target includes the
[merkle root](https://fuchsia.dev/docs/concepts/security/merkleroot) of the package's meta FAR as a custom attribute.
This example shows the format for the merkle root:

    {
      ...

      "targets" : {
        PACKAGEPATH : {
          "length" : LENGTH,
          "hashes" : HASHES,
          "custom" : {
            "merkle" : <MERKLE_ROOT>,
            "size" : <BLOB_SIZE>,
          }
        }

        ...
      }
    }

Definition of values:

- `MERKLE_ROOT`. `STRING`. The hex string of the merkle root hash of the package's meta FAR.
- `BLOB_SIZE`. `INT`. The size, in bytes, of the unencrypted BLOB identified by the `MERKLE_ROOT`.

[](https://issues.fuchsia.dev/issues/new?component=1439230&template=1881640&description=Issue+on:+https://fuchsia.dev/docs/concepts/packages/software_update_system.md "Report a bug or suggest improvements on this page") [](https://cs.opensource.google/fuchsia/fuchsia/+/main:docs/concepts/packages/software_update_system.md "View the source code of this page") [](https://ci.android.com/edit?repo=fuchsia/fuchsia/main&file=docs/concepts/packages/software_update_system.md&cloneRepo=fuchsia/fuchsia:refs/heads/main&fullPath=fuchsia/docs/concepts/packages/software_update_system.md "Edit the source code of this page")