Promotion between environments, and into an air-gapped hub that verifies the release offline issue #88
open andymccall opened this · 0 comments
andymccall
Third of three (after issue #86 environments and the release bundles issue): moving a release between environments, including into one with no internet at all. Andy (2026-10-26): dev has the internet, prod often does not; the usual answer is copying assets through a manual "sheep dip" gate.
Promotion on one hub: "promote run #412's bundle to prod" checks that it was deployed to (and passed in) the environment before it, that prod's approvals are sealed, and that the bundle passes prod's policy; then prod's runners deploy it by hash. Same bytes as staging, never rebuilt.
Across an air gap: the connected hub exports the release as one file: the bundle, its SBOM and provenance, the signatures, the transparency-log inclusion proofs and the cosigned checkpoints (witnesses, §14.8 in oxygen), and the repository state it came from. An air-gapped OxygenHub imports it and verifies everything offline: hashes, signatures by keys its policy trusts, log proofs against the checkpoints it pinned. Then it promotes as above. The crossing is still physical (a disk, a data diode), but nobody has to judge the files: the gate becomes a verification the machine does, and anything not in the bundle cannot happen in prod.
Pieces:oh release export --environment prod RUN → file; Admin › Import on the air-gapped hub (or oxygenhub import FILE); the air-gapped hub's own runners, with no egress at all; its tlog pinning the connected hub's log key and witnesses.
Fits the UK sovereignty story: verifiable releases into networks that never touch the internet. Comparable tools today: Zarf, Hauler (Kubernetes air-gap packages), Nix closures; none ties the package to the version control history and its signatures as Oxygen can.
Third of three (after issue #86 environments and the release bundles issue): moving a release between environments, including into one with no internet at all. Andy (2026-10-26): dev has the internet, prod often does not; the usual answer is copying assets through a manual "sheep dip" gate.
Promotion on one hub: "promote run #412's bundle to prod" checks that it was deployed to (and passed in) the environment before it, that prod's approvals are sealed, and that the bundle passes prod's policy; then prod's runners deploy it by hash. Same bytes as staging, never rebuilt.
Across an air gap: the connected hub exports the release as one file: the bundle, its SBOM and provenance, the signatures, the transparency-log inclusion proofs and the cosigned checkpoints (witnesses, §14.8 in oxygen), and the repository state it came from. An air-gapped OxygenHub imports it and verifies everything offline: hashes, signatures by keys its policy trusts, log proofs against the checkpoints it pinned. Then it promotes as above. The crossing is still physical (a disk, a data diode), but nobody has to judge the files: the gate becomes a verification the machine does, and anything not in the bundle cannot happen in prod.
Pieces:
oh release export --environment prod RUN→ file; Admin › Import on the air-gapped hub (oroxygenhub import FILE); the air-gapped hub's own runners, with no egress at all; its tlog pinning the connected hub's log key and witnesses.Fits the UK sovereignty story: verifiable releases into networks that never touch the internet. Comparable tools today: Zarf, Hauler (Kubernetes air-gap packages), Nix closures; none ties the package to the version control history and its signatures as Oxygen can.