Packaging and installation

Learn how VOS3 packages software, verifies updates, and installs system and application bundles.

VOS3 uses authenticated download bundles, signed manifests, and an A/B installer flow.

Use this page to understand DL files, package types, signing, and update delivery.

Update artifacts

VOS3 supports authenticated firmware and application updates.

Update artifacts are DL files.

A DL file is a tar archive that contains bundles, metadata, and signatures required for installation.

VOS3 uses a package format that is signed through the Verifone Signing Portal.

For packman commands and manifest structure, use Packaging.

Download files

DL files are the transport container for VOS3 software updates.

A DL file can contain:

• system software binaries, configuration, resources, and data
• application software binaries, configuration, resources, and data
• secure processor firmware
• radio module firmware
• VRK key loading packages

The outer DL file is an uncompressed tar archive.

This allows in-place random access during installation.

Internal content is compressed to keep the overall size small.

A DL file can contain multiple bundles.

Each bundle includes:

• change set data — a compressed TGZ archive
• bundle information — a compressed TGZ archive

The change set data archive contains the folders and files to install.

The bundle information archive contains:

• changeset JSON
• manifest JSON
• manifest signatures in CMS format

The changeset JSON describes how to transform existing device content into the target content.

The manifest JSON describes bundle content and includes hashes for all files in the bundle.

The packman tool automates DL file creation, manifests, and related content.

Differential download files

Differential DL files can be built from two release versions without resigning.

The build process computes a diff and packages only the delta plus the target manifest and signatures.

On the device, the installer applies the patch set and then verifies the final content against the target manifest.

User package types

Applications must use the correct VOS3 package type.

Supported user package types include:

• user_ro — read-only application executables, libraries, and data
• font_ro — read-only user fonts in addition to system fonts
• versioned_data — private application configuration and assets
• share_users_versioned_data — shared data between usr<X> users
• data — application runtime data
• unsigned_data — unsigned application runtime data
• user_hook — user plug-in to modify read-write user data or versioned data

Additional package types exist for system use only.

Downloads

Updates can be installed:

• manually through USB or SD
• through netloader from a connected host PC
• remotely through a terminal management system such as Verifone VHQ over TLS

DL files are device-specific. There is no generic image for all devices — choose the correct file for your device type. Example: dl.adk-VOS3_<version>-vos3-P630-dev.tgz

Update via Netloader protocol

1. Install the mxdownload Python script on your host PC (Windows and Linux). Alternatively, use mx800Downloader on Windows only.
2. On the device, open Software Management Panel → Download Netloader. The screen displays the IP address of the device.
3. From the host PC, run:

mxdownload <ip> <file>

Update via Serial ZonTalk protocol

1. Install the mxdownload Python script on your host PC (Windows and Linux). Alternatively, use mx800Downloader on Windows only.
2. On the device, open Software Management Panel → Download Zontalk and select the serial port (COMx) to use.
3. From the host PC, run mxdownload using the matching serial port at 115200 baud.

Update via USB stick

1. Connect a USB stick to your host PC and copy the DL files to the root or a subdirectory.
2. Safely eject the stick before unplugging.
3. Plug the USB stick into the device. If the USB port is not in Host mode, go to COM Control → More → Configuration → Device Settings and set it to Host.
4. On the device, open Software Management Panel → Download USB.
5. Use the file browser to select the DL files — check-mark each item and navigate into subdirectories as needed.
6. Tap Install and confirm. Installation starts and shows progress after a reboot.

Use a USB stick with a maximum capacity of 32 GB formatted as FAT32.

Check installed software

Open Software Management Panel → Software List to view all installed bundles with name and version. Selecting a bundle shows its details and provides an option to delete it.

Secure installer

The Installer component handles authenticated system and application updates.

It is responsible for:

• installing system updates and application software into the read-only filesystem
• installing low-level firmware such as boot images, Linux kernel, DTB, initramfs, radio firmware, and secure processor firmware
• exposing installation APIs to applications

Installation uses the A/B model.

Updates are written to the inactive image.

The active image changes only after the updated image boots successfully.

Authentication

Authenticity checks are performed at the bundle level.

The Installer verifies the signature attached to manifest.json.

The manifest also contains hashes for every item in the bundle.

Installation fails if signature verification or hash verification fails.

The signing flow creates two detached CMS signatures:

• manifest.json.1.cms — ECDSA P-521
• manifest.json.2.cms — PKCS #1 v1.5 RSA

The current firmware verifies the ECDSA signature.

Anti-rollback protection

The Installer supports anti-rollback protection for system bundles.

This prevents downgrades after vulnerability fixes or other protected updates.

The mechanism uses security counters on protected system bundles.

Signing

Executable files must be signed through the Verifone Signing Portal.

The portal provides user management, auditability, and dual control for sensitive signing tasks.

Each customer is assigned a sponsor identifier and one or more signing products.

Signing sponsor

A device is locked to a sponsor on the first software update signed with that sponsor.

After that, the device rejects software signed with a different sponsor.

A VOS3 device supports one application sponsor at a time.

The sponsor signing certificate is loaded onto a fresh device and binds the device to that sponsor.

The 8-digit sponsor ID is derived from the sponsor signing certificate serial number and stored on the device.

Future installations verify that the package signing certificate matches the stored sponsor ID.

Resetting the sponsor ID requires a sponsor removal package signed with the currently installed sponsor certificate.

Automated initial loading

Before the first sponsor-signed application is installed, the device automatically enables the Netloader on boot and broadcasts its serial number so the host PC can discover the device IP address and connect.

To auto-install from a USB stick on boot:

1. At the root of the USB stick, create a directory named vos3_auto_update.
2. Copy a single DL file directly into vos3_auto_update, or for multiple DL files create numbered subdirectories (1/, 2/, ...) and place one DL file per subdirectory.
3. Unpower the device, plug in the USB stick, then power the device. The installer runs automatically on boot.

Once a sponsor-signed package has been installed on the device, the automatic Netloader launch on boot is no longer available.

Changing system components

VOS3 no longer supports removing certain system components such as MAC and SDI.

VOS3 no longer supports mixing or partial updates of ADK components that would invalidate the released component set. A modified image will be rejected due to incorrect dependencies. This applies to production-signed files only.