Secure Update Gateway — examples
Sample configs and an executable end-to-end journey for the Holger Secure Update Gateway MVP. See docs/v1/secure-update-gateway-mvp.md (architecture), the threat model, and the operator guide for the full picture.
| file | what it is |
trust-policy.ron |
holger.bundle-trust-policy/v1 — fingerprint-pinned two-person policy (replace the placeholder fingerprints). |
intake-critical.ron |
Intake / review-side registry (Standard profile, authenticated writes; egress expected). |
ot-critical-readonly.ron |
Protected OT node — Critical profile + ReadOnly mode + mTLS + a bundles raw store. |
core-v1.json |
Illustrative core.json (the immutable candidate) with every schema field. |
e2e-journey.sh |
Hermetic end-to-end journey (needs openssl + cargo); exits non-zero on any failed assertion. |
Run the journey
examples/secure-update-gateway/e2e-journey.shIt builds a firmware payload + SBOM, prepares a candidate, collects two distinct signed approvals, finalizes with a distinct release signer, verifies offline, carries the bundle through an untrusted staging dir, proves a one-byte mutation fails verification, imports into an empty protected store, proves an idempotent re-import and a rejected rollback, scrubs, backs up + verifies + restores, verifies the audit segments, and proves the protected binaries link no outbound HTTP client.
All keys/certs are generated on the spot — no production private keys are ever committed.