Support · Updates

How updates reach you

How a new version of SecurityInsight or PIM Manager travels from the product team to your installation: ring by ring, approved by a person before it reaches customers, signed by Invardia and checked by your install.

Pro

From the product team to your install

The product team decides which version goes to which ring. Invardia checks, signs and delivers. Your install fetches the update itself, from Invardia, and checks it before anything changes.

How a Pro update reaches your installThe product team, SecurityInsight or PIM Manager, publishes a version. Rings 0 and 1, dev and test, are the product team's own. Rings 2 and 3, design partners and then everyone, get a version only after a person at Invardia approves that exact version. Invardia signs a manifest for each ring with the version, a sequence number and the checksum. Your install pulls its ring's signed manifest with its licence and install key, checks the signature, checks that the sequence number is not lower than the last one it applied, checks the SHA-256 checksum of the package, waits while a run is going, installs with the product's own steps, and its next heartbeat names the new version.Product teamSecurityInsight orPIM Managerpublishes a versionUPDATE RINGSRing 0Ring 1Dev and testthe team's ownRing 2Ring 3Design partners,then everyoneOnly after a person at Invardiaapproves that exact versionInvardia signsa manifest per ring:version, sequenceand checksumYour installin your own Azure,pulls with its licenceand install keyversionreleasedsignedYOUR INSTALL'S UPDATER, STEP BY STEP1 · Pullsits ring's signedmanifest2 · Signaturechecked againstthe built-in keys3 · Sequencenever lower thanthe last applied4 · ChecksumSHA-256 of thepackage5 · Waitsa run going? Itwaits for its end6 · Installsthe product's owninstall steps7 · Reportsnext heartbeatnames the versionHow a Pro update reaches your installThe product team, SecurityInsight or PIM Manager, publishes a version. Rings 0 and 1, dev and test, are the product team's own. Rings 2 and 3, design partners and then everyone, get a version only after a person at Invardia approves that exact version. Invardia signs a manifest for each ring with the version, a sequence number and the checksum. Your install pulls its ring's signed manifest with its licence and install key, checks the signature, checks that the sequence number is not lower than the last one it applied, checks the SHA-256 checksum of the package, waits while a run is going, installs with the product's own steps, and its next heartbeat names the new version.Product teamSecurityInsight or PIM Manager publishesversionUPDATE RINGSRing 0Ring 1Dev and testthe team's ownRing 2Ring 3Design partners,then everyoneOnly after a person at Invardia approves itreleasedInvardia signsa manifest per ring: version,sequence and checksumsignedYour installin your own Azure, pulls with itslicence and install keyTHE UPDATER, STEP BY STEP1Pullsits ring's signed manifest2Signaturechecked against the built-in keys3Sequencenever lower than the last one applied4ChecksumSHA-256 of the package it fetched5Waitsa run going? It waits for its end6Installswith the product's own install steps7Reportsthe next heartbeat names the version
Step 5 is SecurityInsight's: its updater never starts an install while one of its runs is going, and never cancels a run - it installs when the run has ended. Updates keep working when status reports are switched off; only step 7 is then left out.

Rings

Ring by ring, with a person's approval for customers

Rings 0 and 1: the team's own

Ring 0 is development and ring 1 is test. The product team releases to them itself, so a new version is installed and checked there first.

Rings 2 and 3: customers

Ring 2 is for design partners, ring 3 for everyone else. A version reaches them only after a person at Invardia has seen what it fixes and what it changes, and approved that exact version. The moment it is approved, it is released to your ring.

Your ring is a setting in the product

Your installation's ring is set in the product, per product: one environment can run SecurityInsight on one ring and PIM Manager on another.

Safeguards

What keeps an update safe

Only the product team releases

A version reaches a ring only when the product's own release identity, signed in with a certificate, sends it. Invardia's staff cannot release a version.

Signed, and checked by your install

Every manifest is signed with Invardia's update key. Your install checks the signature against the keys built into the product, refuses a manifest whose sequence number is lower than the last one it applied, and checks the package's SHA-256 checksum before it installs.

Your licence and install key

Your install fetches its update with its Pro licence and its own install key. Every Pro download is served from invardia.com, and every update check is on record: which environment asked, on which ring, and which version it was given.

The hosts your install talks to, for your firewall: Network egress.

Community

How the free Community editions update

The Community code and its release packages stay public on GitHub. Invardia signs the Community channel for rings 2 and 3 with the same update key as Pro, so an install that reads the channel checks every update just like Pro. SecurityInsight Community uses the same updater job as Pro.

How Community updates reach youThe product's public GitHub repository holds the code and each release package. Invardia takes the package's checksum once and signs the Community channel for rings 2 and 3 with the same update key as Pro. Your Community install checks the signature and the sequence, then takes the package from GitHub. One approval covers Pro and Community; the same version on each ring is rolling out.GITHUBThe public codeThe product's own repository:the code and each release packageINVARDIASigns the Community channelfor rings 2 and 3, with the sameupdate key as ProYOUR AZUREYour Community installchecks the signature and thesequence, then updateschecksumsignedthe package itself always comes from GitHubOne approval covers Pro and Communityand both editions carry the same version on each ringRolling outHow Community updates reach youThe product's public GitHub repository holds the code and each release package. Invardia takes the package's checksum once and signs the Community channel for rings 2 and 3 with the same update key as Pro. Your Community install checks the signature and the sequence, then takes the package from GitHub. One approval covers Pro and Community; the same version on each ring is rolling out.GitHub: the public codethe code and each release packagechecksumInvardia signs the channelrings 2 and 3, the same update key as ProsignedYour Community installchecks the signature and the sequence,then takes the package from GitHubOne approval covers Pro and CommunitySame version on each ringRolling out
PIM Manager Community today updates when an admin runs its update command on their own machine. The same signed updater as Pro is coming to PIM Manager Community.

Two ways to update Rolling out

  • Automatic (the default): the updater job in your Azure checks for a new release, verifies Invardia's signature, waits for a running job to finish, then updates and checks the result.
  • Manual, if you prefer: turn the updater job off, or never install it, and run the product's update command yourself when you choose. The command makes the same checks as the updater: Invardia's signature, the release order and the package checksum.
Community editionsHow support worksAll support options