immos-update reference

The complete command surface for system updates, rollback and slot inspection.

Commands

Command	What it does
`immos-update check`	Fetches the release manifest and reports the current and available versions
`immos-update apply`	Downloads, verifies and writes the new image to the free slot, then stages its boot entry
`immos-update reboot`	`apply`, then reboot immediately
`immos-update rollback`	Makes the previous image the default for the next boot
`immos-update status`	Shows which version is in which slot, which is booted, and the state of each boot entry
`immos-update etc-diff`	Lists the files under `/etc` you have changed from the vendor defaults

Update operations need root. Members of the wheel group can run them through sudo, and the desktop’s authentication agent handles the prompt when they are triggered from a graphical session.

Checking and applying

immos ~$

$ immos-update check
Current: 0.2.0
Available: 0.3.0

$ sudo immos-update apply
→ Verifying manifest signature… ok
→ Downloading immos_0.3.0 (3.9 GB)… ok
→ Writing to free slot… ok
→ Staged 0.3.0 for next boot.

Nothing about the running system changes until you reboot.

Inspecting the slots

immos ~$

$ immos-update status
● 0.2.0   booted    slot 1
  0.3.0   staged    slot 2
  boot entries: immos_0.3.0.efi (3 tries left), immos_0.2.0.efi (blessed)

“Blessed” means an entry has already booted successfully at least once and will not be counted against again. An entry with tries remaining is on probation.

Rolling back

immos ~$

$ sudo immos-update rollback
→ Next boot: 0.2.0

For a one-off boot of a different image without changing the default, hold Space during startup and choose from the boot menu.

Seeing your local configuration changes

immos ~$

$ immos-update etc-diff
/etc/fstab
/etc/systemd/system/backup.timer

These are the files where your version is being used instead of the vendor’s. Why that matters is covered in editing /etc.

Automatic updates

Shipped, but disabled by default in this release:

immos ~$

$ sudo systemctl enable --now systemd-sysupdate.timer
$ systemctl list-timers systemd-sysupdate.timer

Where updates come from

The update server is a plain static file host: a signed SHA256SUMS manifest plus the image and boot files for each published version. The channel — stable or testing — is a path segment on that server, configured in the image. There is no update service to talk to and no account to have.

Every download is verified twice: the manifest’s GPG signature against the release key baked into your image, and each file’s SHA256 against the manifest.