stella self update — Command Guide

Audience: Operators and air-gapped administrators who inspect local product update manifests. Scope: Offline DSSE manifest verification and read-only update planning.

Manifest-check source verified against commit e25dab6fa702d22df9ddcf0445310645cbbc2c11 (PCD-389); trust-root resolution re-verified 2026-10-27 for SPRINT_20261027_005 VTR-2. Re-verify with pwsh ./tools/scripts/test-targeted-xunit.ps1 -Project src/Cli/__Tests/StellaOps.Cli.Tests/StellaOps.Cli.Tests.csproj -Class '*AgentSelfUpdateVerifyTests' -BuildProjectReferences -MaxThreads 1.

self update --check and self update --dry-run verify a local DSSE product update manifest against a release trust root, enforce lifecycle policy and print the verified manifest’s version, image digests and fixed CVEs. Both modes require real manifest and trust inputs; verification always runs, whether or not --verify is supplied.

Package application is unsupported. Invocations without --check or --dry-run, including --verify alone, fail nonzero before download, package-signature, rollback, apply or health claims. --force also fails; it does not enable application or a maintenance-window override. No agent rollback command is registered.

Commands

stella self update --check --manifest product-update-manifest.dsse.json --trust-root release-trust-root.pem
stella self update --dry-run --manifest product-update-manifest.dsse.json --trust-root release-trust-root.pem
stella self update --verify --dry-run --allow-eol --manifest product-update-manifest.dsse.json --trust-root release-trust-root.pem

Verification

• The command fails closed when the manifest signature cannot be verified against the supplied trust root.
• Trust roots come from the operator (--trust-root, --trusted-public-key-pem, or the STELLAOPS_PRODUCT_UPDATE_TRUST_ROOT / STELLAOPS_RELEASE_TRUST_ROOT environment variables) or, when the operator supplies none, from the active manufacturer-release roots of the pinned vendor trust-root set. The set is read from STELLAOPS_VENDOR_TRUST_ROOTS, or from trust/vendor-roots/ beside the stella binary. Operator roots replace the pinned set; they are not merged with it. The output names the source on a Trust roots: line.
• The command never loads a root from the manifest’s directory, its trust-roots/ folder, the Offline Update Kit directory or the working directory, so a kit cannot carry the root that verifies it. With neither an operator root nor a usable pinned set, the command lists the set’s issues (for example vendor_roots_missing:manufacturer-release) and fails with trust_roots_required. A manifest signed by a root that a root update has superseded fails.
• The command rejects manifests whose placedOnMarketAt is in the future.
• The command rejects end-of-support manifests unless --allow-eol is present.
• Optional --version <manifest-version> asserts the desired version against the verified manifest; a mismatch fails before printing a plan.
• Plan output comes only from the verified manifest, including fixesAdvisories[]; it does not invent installed, available or latest release inventory.
• Check and dry-run leave binaries and local manifest/trust inputs unchanged.

Offline Use

Air-gapped operators pass an Offline Update Kit manifest through --manifest. The pinned vendor set verifies it without further input. To verify against another root, pass it through --trust-root; obtain that root independently of the kit it verifies and keep it outside the kit: a public key copied out of the same kit proves only that the kit is self-consistent, not that the vendor signed it. Inline --trusted-public-key-pem is supported for test harnesses and one-off recovery, but file-backed trust roots are preferred for repeatable scripts.