stella self update and stella verify release-manifest — Command Guide

Audience: Operators and air-gapped administrators who inspect local product update manifests. Scope: Offline DSSE manifest verification and read-only update planning.

Manifest-check source verified against commit e25dab6fa702d22df9ddcf0445310645cbbc2c11 (PCD-389); trust-root resolution re-verified 2026-10-27 for SPRINT_20261027_005 VTR-2 and 2026-10-28 for VTR-1; example output captured 2026-10-28 for VTR-5. Re-verify with pwsh ./tools/scripts/test-targeted-xunit.ps1 -Project src/Cli/__Tests/StellaOps.Cli.Tests/StellaOps.Cli.Tests.csproj -Class '*AgentSelfUpdateVerifyTests' -BuildProjectReferences -MaxThreads 1.

self update --check and self update --dry-run verify a local DSSE product update manifest against a release trust root, enforce lifecycle policy and print the verified manifest’s version, image digests and fixed CVEs. Both modes require real manifest and trust inputs; verification always runs, whether or not --verify is supplied.

Package application is unsupported. Invocations without --check or --dry-run, including --verify alone, fail nonzero before download, package-signature, rollback, apply or health claims. --force also fails; it does not enable application or a maintenance-window override. No agent rollback command is registered.

Commands

stella self update --check --manifest product-update-manifest.dsse.json --trust-root release-trust-root.pem
stella self update --dry-run --manifest product-update-manifest.dsse.json --trust-root release-trust-root.pem
stella self update --verify --dry-run --allow-eol --manifest product-update-manifest.dsse.json --trust-root release-trust-root.pem

Verification

The command fails closed when the manifest signature cannot be verified against the supplied trust root.
Trust roots come from the operator (--trust-root, --trusted-public-key-pem, or the STELLAOPS_PRODUCT_UPDATE_TRUST_ROOT / STELLAOPS_RELEASE_TRUST_ROOT environment variables) or, when the operator supplies none, from the active manufacturer-release roots of the pinned vendor trust-root set. The set is read from STELLAOPS_VENDOR_TRUST_ROOTS, or from trust/vendor-roots/ beside the stella binary. Operator roots replace the pinned set; they are not merged with it. The output names the source on a Trust roots: line.
The command never loads a root from the manifest’s directory, its trust-roots/ folder, the Offline Update Kit directory or the working directory, so a kit cannot carry the root that verifies it. With neither an operator root nor a usable pinned set, the command lists the set’s issues (for example vendor_roots_missing:manufacturer-release) and fails with trust_roots_required. A manifest signed by a root that a root update has superseded fails.
The command rejects manifests whose placedOnMarketAt is in the future.
The command rejects end-of-support manifests unless --allow-eol is present.
Optional --version <manifest-version> asserts the desired version against the verified manifest; a mismatch fails before printing a plan.
Plan output comes only from the verified manifest, including fixesAdvisories[]; it does not invent installed, available or latest release inventory.
Check and dry-run leave binaries and local manifest/trust inputs unchanged.

Offline Use

Air-gapped operators pass an Offline Update Kit manifest through --manifest. The pinned vendor set verifies it without further input. To verify against another root, pass it through --trust-root; obtain that root independently of the kit it verifies and keep it outside the kit: a public key copied out of the same kit proves only that the kit is self-consistent, not that the vendor signed it. Inline --trusted-public-key-pem is supported for test harnesses and one-off recovery, but file-backed trust roots are preferred for repeatable scripts.

Example output

Captured against a TEST manifest signed with a throwaway TEST key. The kit directory also carries that key’s public root in kit/trust-roots/, which the command ignores. Directory paths are shortened to <dir>.

With the pinned set (STELLAOPS_VENDOR_TRUST_ROOTS naming a set whose manufacturer-release anchor is the TEST root):

$ stella self update --check --manifest kit/product-update-manifest.dsse.json
Stella update
=============

Manifest: <dir>\kit\product-update-manifest.dsse.json
Trust roots: pinned vendor set <dir>\vendor-roots (manufacturer-release)
Verifying DSSE product update manifest...
Manifest signature verified.
Manifest digest: sha256:8010678c380d764d2a3bd01a5cbf6cede8fd09a7c61e1d4342e52451ab504920
Payload digest: sha256:864581aebf1af593efe32311943c541c2f5782697ad501bb9550cd3384d0bdd9
Verified key IDs:
  - release-root

Release manifest:
  Release: stella-ops
  Version: 2026.10.0
  CRA applicability: cra-reporting-only
  Made available in EU: 2026-10-28
  Placed on market: n/a
  End of support: 2999-12-31
  Manifest SHA-256: sha256:8010678c380d764d2a3bd01a5cbf6cede8fd09a7c61e1d4342e52451ab504920

Resolved image digests:
  - registry.stella-ops.org/stellaops/signer [linux/amd64] sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef

Fixed CVEs:
  - CVE-2026-0001 (stella-product-csaf/TEST-2026-0001): TEST advisory for documentation output.

Check-only mode: verified manifest plan; no binaries will be written.

--dry-run prints the same plan and ends with Dry run: no binaries will be written.

With an empty pinned set and no operator root, the root inside the kit is not used:

$ stella self update --check --manifest kit/product-update-manifest.dsse.json
Stella update
=============

No operator-configured trust root, and no usable pinned vendor root set:
  - vendor_roots_missing:manufacturer-release
Pass --trust-root, set STELLAOPS_PRODUCT_UPDATE_TRUST_ROOT, or set STELLAOPS_VENDOR_TRUST_ROOTS to a vendor trust-root set.
Trust roots inside an update kit are not used.
Manifest: <dir>\kit\product-update-manifest.dsse.json
Verifying DSSE product update manifest...
Update manifest verification failed.
  - trust_roots_required

The same manifest with an operator root kept outside the kit prints the plan with Trust roots: operator-configured. A run without --check or --dry-run refuses:

$ stella self update --manifest kit/product-update-manifest.dsse.json
Package application and --force are unsupported. Use --check or --dry-run with a signed local manifest and trust root.

Exit code	Meaning
`0`	The manifest verified and the plan was printed.
`5`	The manifest did not verify, no trust root was available, or the manifest is a remote URI.
`6`	Lifecycle policy refused the manifest (for example end of support without `--allow-eol`), or `--version` does not match it.
`7`	No manifest was given or found, or the file does not exist.
`9`	Application was requested (no `--check` or `--dry-run`, or `--force`).

stella verify release-manifest

Verifies a product update manifest offline and prints its release, digests and images, without an update plan. Trust roots resolve as for self update: operator roots replace the pinned manufacturer-release set, and roots beside the manifest are never loaded.

stella verify release-manifest <file> [--trust-root <path>]... [--trusted-public-key-pem <pem>]... [--output table|json] [--json]

Argument or option	Description
`<file>`	The DSSE product update manifest envelope. A remote URI is refused; the command does not fetch.
`--trust-root`	A PEM file or a directory of PEM files; repeatable. Replaces the pinned vendor set.
`--trusted-public-key-pem`	An inline public key PEM; repeatable. Prefer `--trust-root` in scripts.
`--output`, `-o`	`table` (default) or `json`.
`--json`	Same as `--output json`. JSON fields: `file`, `valid`, `release`, `version`, `manifestSha256`, `payloadSha256`, `verifiedKeyIds[]`, `issues[]`, `images[]`.

$ stella verify release-manifest kit/product-update-manifest.dsse.json
Release Manifest Verification
=============================

File: <dir>\kit\product-update-manifest.dsse.json
Trust roots: pinned vendor set <dir>\vendor-roots (manufacturer-release)
Result: valid
Release: stella-ops
Version: 2026.10.0
Manifest digest: sha256:8010678c380d764d2a3bd01a5cbf6cede8fd09a7c61e1d4342e52451ab504920
Payload digest: sha256:864581aebf1af593efe32311943c541c2f5782697ad501bb9550cd3384d0bdd9
Verified key IDs:
  - release-root

Images:
  - registry.stella-ops.org/stellaops/signer [linux/amd64] sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef

With an empty pinned set and no operator root, it prints the same vendor_roots_missing notice as self update and fails with trust_roots_required.

Exit code	Meaning
`0`	The manifest verified.
`2`	No file was given.
`5`	The manifest did not verify, no trust root was available, or the file is a remote URI.
`7`	The file does not exist.

Until a release ships the vendor’s manufacturer-release root, the shipped pinned set holds none, so both commands need an operator root.