Secure Update

Status: TODO

Target properties

An update package must be:

• versioned
• integrity protected
• authenticated by manufacturer signature
• intended for the correct product/hardware revision
• rejected if verification fails
• auditable

Recommended release flow

CI build
  -> generate manifest
  -> generate SBOM
  -> vulnerability scan
  -> hash artifacts
  -> sign release
  -> publish
  -> gateway downloads
  -> gateway verifies signature/hash/version
  -> install
  -> health check
  -> rollback on failure

Required tests

• valid signed update accepted
• modified package rejected
• invalid signature rejected
• wrong hardware revision rejected
• interrupted update recovery tested
• rollback tested