Skip to main content
Menu

Air-gap operation

For operators running in disconnected environments — OT networks, classified enclaves, regulated segments — the question is not “how do we pull a Rasid image”, it is “how do we verify a Rasid image when nothing in the network can reach rekor.rasid.cc.”

This page covers the practical workflow.

What an air-gap bundle contains

The enterprise tier ships air-gap bundles as a tarball. Each bundle pinned to a specific Rasid image digest contains:

  • The image itself, exported as an OCI directory layout (oci-layout + blobs/sha256/… + index.json).
  • The Cosign signature blob and the Rekor transparency-log inclusion proof.
  • The CycloneDX 1.5 SBOM.
  • The SPDX 2.3 SBOM.
  • The in-toto v1.0 SLSA Level 3 build provenance attestation.
  • The Rasid Cosign verification public key.
  • A snapshot of the Fulcio certificate chain in effect when the image was signed.
  • A small verify.sh script that runs the entire verification offline.

Everything required to verify the image is in the tarball. Nothing reaches outside the air-gap.

Workflow for a single image

# On the connected side (or wherever you receive the bundle):
mkdir -p /opt/rasid/postgres-17
tar -xzf rasid-postgres-17-airgap.tar.gz -C /opt/rasid/postgres-17
cd /opt/rasid/postgres-17

# Verify the bundle's own integrity:
sha256sum -c MANIFEST.sha256

# Inside the air-gap:
./verify.sh
# … runs cosign verify with --key ./rasid-cosign.pub
# … runs cosign verify-attestation --type slsaprovenance
# … runs syft / grype against the SBOM if installed
# … exits 0 only if all four checks pass

# Load the image into the local container runtime:
crane push --image-format oci ./oci-layout local-registry.internal/postgres:17
# or:
skopeo copy oci:./oci-layout docker://local-registry.internal/postgres:17

The verify.sh script never makes a network call.

Workflow for a fleet

For environments that consume many Rasid images at once, the enterprise tier provides:

  • A combined index file listing every image in the bundle and its content addressable digest.
  • A single OCI layout containing all the blobs (deduplicated at the layer level).
  • A mirror.sh script that pushes the entire set into a customer’s internal registry.
tar -xzf rasid-fleet-2026-05-24.tar.gz -C /opt/rasid/fleet
cd /opt/rasid/fleet
./verify-all.sh
./mirror.sh --to local-registry.internal/rasid

This is the path used by operators who need a controlled, audited refresh cadence.

Refresh cadence

Air-gap bundles ship on the same daily-rebuild cadence as the public catalogue. For deployments that cannot tolerate a daily refresh, the enterprise tier supports weekly or quarterly refresh cycles with a documented patch-debt report.

What you cannot do over an air-gap

  • Real-time Rekor lookup. The Rekor inclusion proof shipped in the bundle is what you verify against. The proof is unforgeable; it does not require live network access to validate.
  • Live CVE database queries. The SBOM in the bundle is what your scanner runs against. Bring your own offline CVE database (NVD mirror, OSV mirror) or use the static report the enterprise package ships.
  • Dynamic FIPS policy updates. FIPS-validated cryptographic modules are pinned at bundle build time. Updates ship as a new bundle.

What to do if verify.sh fails

Failure in an air-gapped verification is treated as a P0 incident. The bundle should not be installed.

  1. Re-verify the bundle MANIFEST sha256 against the original tarball you received.
  2. Document the failure (image, version, bundle build date, failure step) and escalate via your enterprise support contract — [email protected] reaches a named engineer for enterprise accounts.
  3. Do not attempt to “fix” the bundle by editing files inside it. The signature chain is integrity-protected end-to-end; any edit will be detected.

Open questions for enterprise scoping

If you are evaluating Rasid for an air-gapped workload, talk to us about:

  • Refresh cadence (daily / weekly / quarterly)
  • Image inventory (which images, which tags, FIPS variants?)
  • Bundle delivery channel (physical media, customer-controlled SFTP, write-once-read-many archive)
  • Customer-side verification automation (cron-driven, CI-driven, manual)
  • Disconnected SBOM scanning (which scanner, which CVE source)
  • Compliance reporting frequency

Talk to sales.