Installation & operation

Updates and lifecycle

PoisonZero keeps itself current without your hands. This page covers the signed auto-update path, how cloud and private devices differ, how the installer tells an upgrade from a fresh install, and the pause, resume and uninstall commands.

~6 min read · Installation & operation

How auto-update works

A cloud device updates itself in a signed, verifiable sequence:

  1. It checks in periodically and the backend may return a signed update instruction.
  2. The daemon verifies the signature offline before acting; an empty or invalid instruction is a no-op.
  3. It refuses anything that is not strictly newer, so a downgrade can never be pushed, and skips a version that already failed to install.
  4. It downloads the new binary pinned to a hash carried inside the signed claim, over a single vendor destination.
  5. It swaps the binary atomically, keeping the previous one as a backup, then restarts into the new version.
Fail-closed on the instruction: nothing unsigned is ever run, no downgrade is ever accepted, and a replayed instruction is rejected. If verification fails, the daemon simply keeps running the version it has.

Cloud updates itself, private does not

The self-update path is gated by device mode, not by tier:

ModeUpdate path
CloudSigned self-update over the config channel, on by default; an operator can turn it off
PrivateNo self-update over the config channel; a private device is updated through its own channel
Because the gate is on mode, an Enterprise device in cloud mode self-updates, while any private device is left for its own update channel.

Upgrade, fresh install or re-enroll

Re-running the installer does the right thing on its own, decided by whether the device is already enrolled:

ModeTriggerEffect
FreshNot yet enrolledInstalls and enrolls
Re-enrollEnrolled, and both app ID and a new code passedSwaps the binary and re-enrolls; the old credential is kept on failure
UpgradeEnrolled, no new codeSwaps the binary only and keeps the credential and seat
The installer decides by the presence of the saved credential file. An upgrade never re-enrolls and never disturbs the seat.

Pause, resume and uninstall

These are owner commands, delivered to the device as signed instructions from the console or an air-gapped token file, not local flags anyone on the machine can set:

CommandEffect
PauseThe daemon stops acting on changes but keeps checking in; the paused state survives a restart
ResumeThe daemon returns to acting on changes
UninstallThe service is torn down and the binary and data directory are removed
A paused daemon keeps heartbeating on purpose, so you can resume it from the console. Like updates, these commands are signed and verified offline before they take effect.

What a paused or held device reports: device status. Where a device first enrolls and gets its credential: installing PoisonZero. How enrollment binds a device: enroll a device.

Was this helpful?

Always current, never surprised.

Signed self-updates on cloud devices, with pause, resume and uninstall on command. Free for Linux, macOS and Windows.

Sign me up