The update fails at the first boot of the board (time sync)

[dido18]

Motivation

When the board is booted the first time, the update always fails. After the first restart, the update works as expected.

Error in the AppLab:

Error in the Console log:

Error: {"details":"Error checking for upgradable packages: no internet connectivity"}

Root cause

Before doing a system update, Arduino App CLI checks the internet connectivity by performing a HEAD https://download.arduino.cc

The check fails with the error:

"Head \"https://downloads.arduino.cc/[\](https://downloads.arduino.cc//)": tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2025-09-09T09:03:56Z is before 2025-10-28T08:59:20Z

This TLS verification fails because the board does not have the internal clock updated. This causes the TLS verification to fail.

Possible solution

• add retries
• force the board to update the datetime (when? at first startup? every time an update check?).

[lucarin91]

With this PR #62 we are now returning a clean NO_INTERNET_CONNECTION error code in case the board is not able to connect to the internet, and also be able to verify a certificate (which needs to a valid datetime). So I think that the user/consumer of the api could just do the retry and maybe add a timeout at somepoint.

[Xayton]

A similar issue was reported: when trying to update on a new board (or recently flashed), the update fails.

• The App Lab (0.2.4) will not show the actual message from the back-end, but instead a generic Error checking for updates: Board update error (see the screenshot in this issue). This is a known issue, being fixed by the IDE team.
• The logs of the update error, returned by the back-end to the App Lab, show why the update is failing:
  Verifying signature: Not live until 2025-11-28T10:44:32Z, so again an issues of validity of certificates or signatures.

I think the only complete solution to this issue is making sure the board has synced the time, before performing the update. Checking a specific URL (like https://downloads.arduino.cc) is not enough, as its certificate might have a validity window that overlaps with the current board date, but other certificates (used during the update) might not.

Full logs:

error running apt-get update command: exit status 100:
Get:1 http://deb.debian.org/debian trixie-backports InRelease [54.0 kB]
Hit:2 http://deb.debian.org/debian trixie InRelease
Get:3 http://deb.debian.org/debian trixie-updates InRelease [47.3 kB]
Get:4 http://deb.debian.org/debian-security trixie-security InRelease [43.4 kB]
Err:1 http://deb.debian.org/debian trixie-backports InRelease
  Sub-process /usr/bin/sqv returned an error code (1), error message is:
  Verifying signature:            Not live until 2025-11-28T13:40:55Z
  Verifying signature:            Not live until 2025-11-28T13:41:30Z
Err:3 http://deb.debian.org/debian trixie-updates InRelease
  Sub-process /usr/bin/sqv returned an error code (1), error message is:
  Verifying signature:            Not live until 2025-11-28T13:40:28Z
  Verifying signature:            Not live until 2025-11-28T13:41:06Z
Err:4 http://deb.debian.org/debian-security trixie-security InRelease
  Sub-process /usr/bin/sqv returned an error code (1), error message is:
  Verifying signature:            Not live until 2025-11-28T14:43:19Z
  Verifying signature:            Not live until 2025-11-28T14:43:19Z
Get:5 https://apt-repo.arduino.cc stable InRelease [17.2 kB]
Err:5 https://apt-repo.arduino.cc stable InRelease
  Sub-process /usr/bin/sqv returned an error code (1), error message is:
  Verifying signature:            Not live until 2025-11-28T10:44:22Z
Get:6 https://apt-repo.arduino.cc unstable InRelease [17.2 kB]
Err:6 https://apt-repo.arduino.cc unstable InRelease
  Sub-process /usr/bin/sqv returned an error code (1), error message is:
  Verifying signature:            Not live until 2025-11-28T10:44:32Z
Reading package lists...
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. OpenPGP signature verification failed: http://deb.debian.org/debian trixie-backports
InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is:
Verifying signature:            Not live until 2025-11-28T13:40:55Z
Verifying signature:            Not live until 2025-11-28T13:41:30Z
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. OpenPGP signature verification failed: http://deb.debian.org/debian trixie-updates
InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is:
Verifying signature:            Not live until 2025-11-28T13:40:28Z
Verifying signature:            Not live until 2025-11-28T13:41:06Z
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. OpenPGP signature verification failed: http://deb.debian.org/debian-security trixie-security
InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is:
Verifying signature:            Not live until 2025-11-28T14:43:19Z
Verifying signature:            Not live until 2025-11-28T14:43:19Z
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. OpenPGP signature verification failed: https://apt-repo.arduino.cc stable
InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is:
Verifying signature:            Not live until 2025-11-28T10:44:22Z
W: OpenPGP signature verification failed: https://apt-repo.arduino.cc unstable InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is:
Verifying signature:            Not live until 2025-11-28T10:44:32Z
E: The repository 'https://apt-repo.arduino.cc unstable InRelease' is not signed.

[lucarin91]

I think a retry and merging this PR is as close as we get to make this more reliable #142

In particular, we cannot know before trying if we can do an update, so the user of system/update/check should retry multiple time to be sure we correctly get the information about the package to update on the board. In addition to that, we can merge the above PR, which makes apt-get update warnings as errors, and we can return better information to the user.

[lucarin91]

We don't want to manually check the time before doing an update. It seems that the above changes are sufficient. We close this for now.