Skip to content

The user guide says apply refuses on any slot but the committed one, and how to put that right #256

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DevomB merged 1 commit into from
Oct 9, 2026
Merged

The user guide says apply refuses on any slot but the committed one, and how to put that right #256

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 11 additions & 7 deletions docs/user-guide.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -311,9 +311,12 @@ The next boot runs the new slot; `boot-success` judges it (state partition
usable, services up, the zone supervisor healthy) and only then makes it the
committed boot file. An unhealthy trial reboots into the previous slot by
itself. Persistent zone data on `kryptik-state` is never written by any of
this. `apply` refuses while another trial is armed (reboot first) and while
the state partition is degraded; after a trial that failed to boot it
refuses that slot again until you pass `--retry`.
this. `apply` refuses while another trial is armed (reboot first), while the
state partition is degraded, and on any slot but the committed one, such as
one picked in the firmware's boot menu: the refusal says how to boot the
committed slot, or to make the running one committed from the medium. After
a trial that failed to boot it refuses that slot again until you pass
`--retry`.

```sh
kryptik-update rollback # back to the other slot, if it is intact
Expand Down Expand Up @@ -341,10 +344,11 @@ state partition.
slot, as the installer does, then commits it. Every byte comes from the
medium, and the slot is committed only once it verifies against the root
hash the medium's signed kernel carries. A medium whose root or slot kernel
is not that release's is refused with the reason, and nothing is committed. The state partition is not touched, so users
and zone volumes survive. The result is the medium's version, which may be
older than what was installed: the tool names the version it writes but does
not compare it, so read `--status` first.
is not that release's is refused with the reason, and nothing is committed.
The state partition is not touched, so users and zone volumes survive. The
result is the medium's version, which may be older than what was installed:
the tool names the version it writes but does not compare it, so read
`--status` first.

A machine that stops responding resets itself after about a minute (the
software watchdog's timeout; a hardware watchdog keeps its own): a service
Expand Down
Loading