JEDEN Request access
Jeden/Docs

CLI command

jeden update

Transactionally install a signed Jeden release and verify the activated binary before committing it.

Exact invocation#

Shell
JEDEN_UPDATE_MANIFEST=<https-or-local-dsse-manifest> jeden update

Inputs and options#

  • Required environment: JEDEN_UPDATE_MANIFEST, pointing to an HTTPS or local DSSE release manifest.
  • Optional environment: JEDEN_UPDATE_CHANNEL (stable by default), JEDEN_UPDATE_TARGET_TRIPLE, and JEDEN_UPDATE_TARGET.

Output and state effect#

Recovers any prior update journal, verifies the DSSE signature against the embedded channel trust root, checks target/version/digests plus SBOM and provenance, installs atomically, runs post-health, and prints the installed version and digest. Failed health rolls back to the last-known-good binary.

Refusals and boundaries#

  • Absent manifest configuration is refused exactly as JEDEN_UPDATE_MANIFEST must point to an HTTPS or local DSSE release manifest.
  • Channels other than canary or stable, noncanonical or unsigned manifests, mismatched targets/digests/evidence, unsafe archives, downgrade/selection failures, and missing rollback material are refused.