OTA Update Architecture Specification | CYRONIX OS Documentation

1. System Architecture & Delivery Flow

The CYRONIX OS update pipeline consists of three coordinated tiers: the on-device client (org.cyronix.updater), the public edge proxy on Vercel, and the self-hosted release authority running on Tailscale Funnel.

OTA Discovery Protocol Sequence

CYRONIX OS Phone (CyronixUpdater)

│ GET /api/updates?device=oneplus3&channel=stable&version=1.2.1 (HTTPS)

▼

Public Edge Proxy (Vercel)

│ Proxies query to Tailscale Funnel upstream (server.taild6cc0c.ts.net)

▼

OTA Server (server.py)

│ 200 JSON {device, version, build_date, android, url, sha256, size, changelog}

│ 204 client already running newest build

▼

Download to /data/cyronix_updates/<file>.zip (HTTP 206 Resumable)

│ 1. Check SHA-256 equals metadata sha256

│ 2. RecoverySystem.verifyPackage() checks signature against /system/etc/security/otacerts.zip

▼

CYRONIX Recovery OS boots, verifies signature again, flashes system/boot, reboots

2. Update Metadata Schema

The response returned by /api/updates adheres strictly to the following verified JSON schema:

{
  "device": "oneplus3",
  "channel": "stable",
  "version": "1.5.1",
  "build_date": 20260922,
  "android": "11",
  "security_patch": "2024-02-05",
  "url": "https://cyronixos.cyronixsecurity.com/releases/CYRONIX-OS-1.5.1-20260922-user-oneplus3.zip",
  "sha256": "c0cc8310d6fd8deb6e8a2f0abfe6d960948d03dac5cd5c37cca3f8dc803fcf9e",
  "size": 809059475,
  "mandatory": false,
  "changelog": "CYRONIX OS identity: About > Build number reads CYRONIX OS 1.5.1..."
}

3. Resumable Byte-Range Streaming

Update packages are large binary files (typically 750–820 MB). Mobile connections can drop during transit. The Cyronix release proxy implements complete RFC 7233 byte-range support:

Range: bytes=START-END is supported for chunked transmission.
Responses return HTTP 206 Partial Content with matching Content-Range and Accept-Ranges: bytes headers.
The client service drops and resumes interrupted downloads without restarting from zero.

4. Cryptographic Signature Verification

Passing an SHA-256 hash check is not sufficient to authorize an OS flash. Prior to writing to recovery cache:

The client invokes android.os.RecoverySystem.verifyPackage().
The zip footer's cryptographic signature must chain to the public key stored inside /system/etc/security/otacerts.zip.
A package signed with AOSP test keys is rejected with an on-screen alert.
CYRONIX Recovery OS re-checks the signature independently inside the recovery kernel.

5. "Keep My Recovery" Protection

A common user complaint in custom Android ROMs is update scripts automatically overwriting custom recovery. In Cyronix OS 1.4.1+, the system property persist.vendor.recovery_update controls this behavior:

# Check current recovery update policy:
getprop persist.vendor.recovery_update

# If set to false, recovery partition is left untouched during OTA:
setprop persist.vendor.recovery_update false

6. Rollback Procedures

Because the OnePlus 3T is an A-only partition layout device, rolling back an update is performed by entering CYRONIX Recovery OS, selecting Apply from ADB, and sideloading the previous release zip. Userdata is preserved as long as the signing keys remain identical.

OVER-THE-AIR (OTA)UPDATE ARCHITECTURE.