Skip to content
ELEMENT 31

Signed update

A signed update is a software bundle for Czar that carries Element 31's signature. A node verifies the signature before accepting it, so only software Element 31 built reaches the rack.

· 2 min read

IN SHORT

A signed update is a software bundle for Czar that carries a cryptographic signature from Element 31. A node verifies the signature before it accepts the bundle, so only software Element 31 built reaches the rack, and an altered or unsigned bundle is refused. Because trust sits in the signature rather than the channel, the same bundle can be carried into an air-gapped site on media.

A signed update is a software bundle for Czar that carries a cryptographic signature from Element 31. A node verifies the signature before it accepts the bundle, so that only software Element 31 built reaches the rack.

Why it matters

The update path is the most common way an otherwise sealed system is compromised. If a node will accept any file placed in front of it, the enclosure and the read-only image protect very little.

Signing closes that path. The node checks the signature before applying anything, and an unsigned or altered bundle is refused. The operator does not need to trust the courier, the download, or the media the bundle arrived on.

It also makes updates possible on sites with no connection at all. Because trust is in the signature rather than in the channel, the same bundle can be downloaded, carried in by hand, and applied without a path out of the building.

How it works at Element 31

Element 31 publishes signed update bundles through the customer portal. Downloads are gated by each organization's entitlements, and the appliance itself never connects to the portal. An operator downloads the bundle from a workstation of its choosing.

On a connected site, the operator moves the bundle to the Grid over a route the site declared. On an air-gapped site, the operator carries it in on media. In both cases the node verifies the signature, applies the update to its signed, read-only image, and Watchman confirms the resulting state.

Updates are customer-initiated. Element 31 does not push software onto a running Grid. The operator chooses when to apply a bundle, which matters on a floor where a maintenance window has to be agreed with the integrator and the robot vendors.

The signed update, the attestation that follows it, and the provenance record together let a site state what software each node is running and how it got there, from evidence rather than from memory. Sustainment, including these updates, is part of the one subscription for the configured Grid described on How to buy.

Questions this raises

Where do signed updates come from?
Element 31 publishes them through the customer portal, gated by the organization's entitlements. The operator downloads a bundle from a workstation of its choosing; the appliance itself never connects to the portal.
How does an update reach an air-gapped Czar?
The operator carries the bundle in on media. The node verifies the signature, applies the update to its signed, read-only image, and Watchman confirms the resulting state. No path out of the building is needed.
Can Element 31 update a Grid without the operator's action?
No. Updates are always customer-initiated. The operator chooses when to apply a bundle, which lets a maintenance window be agreed with the integrator and the robot vendors before anything changes on the floor.

KEEP READING

Related.