Air-gap transfer
Signed content transfer into fully disconnected networks
Assemble a signed bundle on a connected instance, move it over physical media, and import it into a disconnected instance that trusts only keys you pinned yourself.
Last verified: July 28, 2026
Networks that never touch the internet still have to be patched. Praxis exports the content your fleet needs as a self-describing signed bundle, you move it across on whatever media your policy allows, and the disconnected side verifies it against a key you registered out of band. Every failure is a refusal with a named reason, never a partial import.
What Praxis does here
- A bundle is a single tar carrying a signed descriptor at its root plus each selected mirror’s materialized tree and manifest sidecar, so the importer can verify it with no network access.
- Trust is operator-pinned. The disconnected side verifies only against public keys you registered there yourself; keys carried inside the bundle are ignored, so a tampered bundle cannot vouch for itself.
- Imported content lands as offline mirrors that the scheduler never syncs upstream, so a disconnected instance cannot quietly reach for the internet.
- Failures are refusals with named reasons: a corrupt tar, a signature no pinned key matches, a payload byte that does not match its signed hash, or a slug that would collide with existing content.
- Delta bundles carry only what changed since a parent bundle you already imported, with the parent verified first.
- Bundles can be inspected and their signature checked from the command line before you pin anything, so the first key you trust is one you verified out of band.
Why it's different
- Self-hosted on both sides, with no call-home from either.
- Trust that runs one way: the disconnected instance decides what it trusts, not the bundle.
- A transfer path SaaS patch and compliance tools structurally cannot offer.
Honest boundary: Praxis 1.0 keeps one materialized copy of each mirror’s content on disk rather than a full history of past states. An export of a pinned state that no longer matches what is live is refused rather than silently substituted, and exported bundles are themselves the supported way to retain byte-exact history. Air-gapped deployments are a sales-assisted Enterprise engagement.