Resolve layers by channel and verify the signed pointer #33

New issue

Closed

opened 2026-09-28 00:24:11 -03:00 by marcos-mendez · 0 comments

marcos-mendez commented

2026-09-28 00:24:11 -03:00

(Migrated from github.com)

An appliance follows a mutable name today. https://mirror.keellinux.org/layers/
holds one core.tar.zst and one core.manifest; publishing a new core replaces
what every instance resolves, with no pin and no rollback.

Keel-Linux/apt is changing the publishing layout to content-addressed blobs,
immutable release revisions, and signed channel pointers. This repository is the
client half.

Scope

keel pull takes a channel (stable, testing) or an explicit release
revision, resolves channel to release to blob digests, and verifies the digest
chain against the signed manifest.
The channel signature and its expiry are checked, and an expired channel is
an error, not a warning. An unchanged channel and a mirror holding a client
back must be distinguishable; that is the whole point of signing the pointer.
keel inspect reports which channel and which release revision the instance
is on, and whether newer revisions exist on that channel. "You are three
revisions behind on stable" is the question an operator actually asks.
Rollback: pulling an earlier release revision must work, because blobs are
never deleted.

Keep the current flat layout working while both exist; its removal is a
separate, later change.

Publishing side: Keel-Linux/apt. Decision note: Keel-Linux/handbook.

An appliance follows a mutable name today. `https://mirror.keellinux.org/layers/` holds one `core.tar.zst` and one `core.manifest`; publishing a new core replaces what every instance resolves, with no pin and no rollback. Keel-Linux/apt is changing the publishing layout to content-addressed blobs, immutable release revisions, and signed channel pointers. This repository is the client half. ## Scope - `keel pull` takes a **channel** (`stable`, `testing`) or an explicit release revision, resolves channel to release to blob digests, and verifies the digest chain against the signed manifest. - **The channel signature and its expiry are checked, and an expired channel is an error, not a warning.** An unchanged channel and a mirror holding a client back must be distinguishable; that is the whole point of signing the pointer. - `keel inspect` reports which channel and which release revision the instance is on, and whether newer revisions exist on that channel. "You are three revisions behind on stable" is the question an operator actually asks. - Rollback: pulling an earlier release revision must work, because blobs are never deleted. Keep the current flat layout working while both exist; its removal is a separate, later change. Publishing side: Keel-Linux/apt. Decision note: Keel-Linux/handbook.