Designing a one-click factory provisioning station in Rust and Tauri

Provisioning a connected device by hand means flashing with one tool, fusing secure boot with another, programming a serial with a third and installing device keys with a fourth, per unit, with a human copying numbers between them. It is slow and it is where serial-number and security mistakes happen. We replaced that with a station app and a jig.

Split the line into stations

• Station 0: put the device into EDL, flash with QDL, fuse secure boot.
• Station 1: program serial numbers, four boards in parallel, from a range the station owns.
• Station 2: verify the chip-to-serial mapping, then install the keybox and request the RKP certificate, then load the customer firmware.

Let hardware do the button-pressing

An Arduino-based jig toggles the lines that put a board into emergency download mode and reports board presence, so the operator only places boards and clicks once. The app drives QDL flashing automatically and shows per-slot status and a live log.

Why Rust and Tauri

• Rust for the backend: reliable serial and USB handling, one binary, no runtime to install on factory PCs.
• Tauri with a React front end: a small desktop app with a proper UI, including an English and Simplified Chinese interface for the line.
• An axum service for the station so the mapping and serial ranges are shared and auditable.

Verify before you trust

Station 2 refuses any board that is not in the serial mapping before keys are installed. Provisioning tools should be designed to fail closed: the cheapest moment to catch a mislabelled unit is before it has a certificate.

The result

One click per station, fewer manual steps and fewer mistakes per unit. If your line still relies on a folder of vendor tools and a spreadsheet, the station is usually a few weeks of work and pays for itself in the first batch.