OTA updates of executable and FATFS - securely obtaining different packages from same URL

[jcsbanks]

I have a use case where I wish to obtain OTA updates of ESP32 executable binary and FATFS partitions of several megabytes. I know I have to tweak the OTA code to do this for FATFS partitions. I want to use the OTA mechanism to make sure the update is atomic for exe and data and fast. From the start there will be about a hundred different automatically generated FATFS partitions, but apart from updates, there could easily be several different types of executable. The ESP32 firmware itself will not know what it needs, but the server side will determine this.

Is it reasonable when using https with authentication to get the ESP32 to use the same URL for updating the exe and another for updating FATFS regardless of what type of payload they need because this is determined by server side activity?

We have no experience with servers, but we are generating all the files that need to go into the FATFS parition.

When an ESP32 hits our server with the same URL request, what people or products could we be looking at for the server to deliver the correct packages for OTA updates? Please advise me of some terminology.

Could a self generated key in the ESP32 be the basis for uniquely identifying it to the server so that it can send information to the server before it then requests OTA packages, and that same key could be used for the OTA update?

We know exactly what we are doing once the partitions are generated on the ESP32, and we know how to generate what we need in those partitions, but we know nothing about servers to know how to tie these together securely.

An alternative could be that the ESP32 sends a query to the server and it responds with the URLs to use for OTA updates.