Uninstall¶

How to remove the agent from a gateway that was set up as in Install manually, how to install it again, and what stays behind. The steps were run on the lab gateway (last on 2026-11-11, removing cproto-v0.2.0-rc.2). The paths are the ones of that page (/mnt/data/bootstrap-agent; use yours). your-software stands for the names you gave the stand-in units.

Remove the agent¶

On the gateway, as root. Stop your software first, then the agent:

systemctl disable --now your-software.path your-software.service
systemctl disable --now bootstrap-agent.service
rm -f /etc/systemd/system/bootstrap-agent.service \
  /etc/systemd/system/your-software.path /etc/systemd/system/your-software.service
rm -rf /etc/systemd/system/bootstrap-agent.service.d
rm -f /etc/tmpfiles.d/bootstrap-agent.conf
systemctl daemon-reload
rm -rf /run/bootstrap-agent /run/wlpc
rm -rf /mnt/data/bootstrap-agent /etc/bootstrap-agent

The first command may print Disabling 'your-software.service', but its triggering units are still active; the same command disables the .path unit too.

Checked on the lab gateway afterwards:

systemd answers Unit bootstrap-agent.service could not be found., and no agent process runs.
/run/bootstrap-agent, /run/wlpc, /mnt/data/bootstrap-agent and /etc/bootstrap-agent (with the saved key and agent.env) are gone.
All three transient TPM slots are free.
/etc/iot-config is kept, see What stays.

What stays¶

/etc/iot-config: the stored configuration and the agent's records, among them the record of the attestation key and the birth certificate. With it, a new install continues as the same device, see Install again.
The TPM: the attestation key and the manufacturer's objects stay in the TPM. The removal above does not touch them. How the agent's own key is removed before a factory reset is under The TPM; that was not part of this test.
The user and the groups: the user bootstrap-agent and the groups tss and wlpc were left in place on the lab gateway.
The device in the console stays as it is.

Install again¶

Run steps 1 to 7 of Install manually unchanged.

On the lab gateway the agent served the stored configuration again, without a new setup. Its log showed restored profile is fully acked; its confirmation rides on the next check-in, then on the first check-in pending confirmation delivered on check-in and check-in complete: unchanged, nothing fetched. tmpfiles --create made /run/bootstrap-agent and /run/wlpc again (the latter root:wlpc, mode 2775). The .path unit and the service from the archive's examples/ folder, renamed, worked unchanged: the service wrote the confirmation marker under its own user ID. All three transient TPM slots were free.

Remove the stored configuration too¶

For a lab gateway

Run on the lab gateway on 2026-11-11: after the commands below and a new device entry in the console, the new install set the gateway up as a new device (PROVISIONED). Use it only on a lab gateway.

To make the gateway set itself up again as a new device, remove the agent as above, then delete the stored configuration and the agent's records in /etc/iot-config:

cd /etc/iot-config && rm -rf profile profile-ready acks checkin checkin-attempt confirmed last-error

Then delete the device in the console and add it again. Keep the record of the attestation key (ak) and the birth certificate (birth-cert.pem): they identify the gateway.

On a Yocto image¶

On a product image the agent is part of the image. Uninstalling it means removing the package from your image and shipping the new image as a RAUC update. This has not been tested. The state in /etc/iot-config lies on the data partition and stays, unless your factory reset deletes it; your reset runs bootstrap-agent --release-ak first, see The TPM.