Built with Chinaski

Offline Updates

Chinaski releases are handled as artifacts that travel on removable media inside air-gapped environments: a signed bundle, its signature, and your release public key.

The documented workflow

  1. On a connected machine — get the newest release bundle (a tar.gz) plus its .sig signature file from the release location. Signatures are hex-encoded Ed25519 signatures of the bundle's raw bytes, produced by the release signing tool against a release key.
  2. Transfer both files to the air-gapped machine (USB, one-way copy, whatever your transfer discipline is).
  3. Run the update script:
bash scripts/apply_update.sh \
    --bundle  chinaski-<version>.tar.gz \
    --sig     chinaski-<version>.tar.gz.sig \
    --pubkey  keys/chinaski_release.pub \
    [--prefix /opt/chinaski]

The script verifies the Ed25519 signature first (tampered bundles are rejected outright), backs up the current application, then applies the update — keeping the previous version recoverable if something goes wrong afterward.

The on-line variant — never automatic

The application has an update-check capability, but it only ever consults a manifest URL you set explicitly (via the CHINASKI_UPDATE_MANIFEST_URL environment variable) and only when air-gap mode is off. Nothing "phones home" for updates without both being configured. Manifest signatures are verified against the release public key when a key is available.

In-operation notes

  • Signature verification is mandatory in the update path — not just a recommendation.
  • The release public key the updater uses by default is keys/chinaski_release.pub in the installation; keep it safe and updated alongside future bundles when the project announces the new keys.
  • Bundles are founded on the same make-bundle machinery used for first installing offline; the bundle carries the CPAN tarballs, so updating to a newer release works without network access as well.
  • Before applying an update on a live system, keep a current backup and note the apply script backs up the previous application automatically — the moment to apply is maintenance window, as with any CMS.