stella self update — Command Guide

Audience: Operators and air-gapped administrators who update the local Stella Ops CLI. Scope: Verifying a signed product update manifest before resolving or applying a CLI update.

stella self update --verify validates a DSSE product update manifest against a release trust root before resolving or applying a local Stella Ops CLI update. Verification fails closed: an update is never written to disk unless the manifest signature, market-availability date, and end-of-support state all pass.

Commands

stella self update --verify --dry-run --manifest product-update-manifest.dsse.json --trust-root release-trust-root.pem
stella self update --verify --dry-run --allow-eol --manifest product-update-manifest.dsse.json --trust-root release-trust-root.pem

Verification

• The command fails closed when the manifest signature cannot be verified against the supplied trust root.
• The command rejects manifests whose placedOnMarketAt is in the future.
• The command rejects end-of-support manifests unless --allow-eol is present.
• The dry-run path prints fixed CVE identifiers from fixesAdvisories[] and does not write binaries.

Offline Use

Air-gapped operators should pass an Offline Update Kit manifest and local trust root through --manifest and --trust-root. Inline --trusted-public-key-pem is supported for test harnesses and one-off recovery, but file-backed trust roots are preferred for repeatable scripts.