Offline upgrade

Every release is also published as one file, stratum-<version>-bundle.tar (about 3 GB), next to its ISO on the mirror. It carries the same signed release an online upgrade downloads. The node checks the release’s signature against the keys it already trusts before it stores anything else of it, then checks every file against the signed manifest.

On an install without internet access, turn the update check off first:

stratumctl admin upgrade mirror set --disable

1. Bring the release to the node

Upload the bundle over the API (or in the console: Admin › Substrate › Upgrades › Sources › Add a release):

curl -X POST -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/x-tar' \
  --data-binary @stratum-0.3.0-bundle.tar http://192.0.2.10:8443/v1/admin/upgrades/media

The node needs twice the bundle’s size free. The call returns once the release is verified.

Or attach a directory on the node: an unpacked bundle, or the stratum/ directory of a mounted ISO or USB stick, under /var/lib/stratum/upgrade/import/:

sudo mkdir -p /var/lib/stratum/upgrade/import/0.3.0
sudo tar -xf stratum-0.3.0-bundle.tar -C /var/lib/stratum/upgrade/import/0.3.0
curl -X POST -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -d '{"path": "/var/lib/stratum/upgrade/import/0.3.0"}' \
  http://192.0.2.10:8443/v1/admin/upgrades/media

2. Upgrade

The verified release is used like any other:

stratumctl admin upgrade plan 0.3.0
stratumctl admin upgrade start 0.3.0 --wait

See Upgrade for what happens next.

Check a bundle by hand

The bundle’s first two members are the release manifest and its minisign signature:

tar -xf stratum-0.3.0-bundle.tar payload/manifest.json payload/manifest.json.minisig
minisign -V -p /usr/share/stratum/release-keys/<key-id>.pub -m payload/manifest.json
sha256sum -c stratum-0.3.0-bundle.tar.sha256