█████████████████████████████████████████████████████████████████ █▒███ █ ▒ █ ▒ █ █ █▒█ █▒█                
██████▒███████▒███ █ █▒███▒███▒███████████████████████▒███████ █ ▒ ▒ █ ▒             █ ▒ █                 
███████████████████ █ ███████████████████████████████████████▒█▒█ █ █ █ █ █ █ █ █ █ █ █ █ █ ▒ █ █ █ █ █ █ █
▒███▒███▒███▒███▒█ ▒ ▒▒█▒███▒███▒███▒███▒███▒███████▒███▒███▒█ █     ▒    ██ ███ █▒█ █▒█ █▒                
███████████████████ █ ███████████████████████████████████████ █     █ █   █████████████████                
██▒███████▒███▒█▒█     ███▒███▒███▒███████ █▒█ █▒█▒███▒███▒█▒▒            ▒███▒█▒█ █▒█▒███                 
█████████████████ █ ▒ ███████████████████▒█▒█ █▒█ ███████████ ▒   ▒ ▒ █ ▒ █████████████████   ▒   ▒       ▒
▒███▒███▒███▒█ █ █ █ █ █▒███▒███▒█ █ █▒█ █ ▒ ▒ █ ▒ █ █ █ █▒█               █▒███ █▒█ █▒█ █ █ █ █ █▒█ █ █ █ 
███████████████████████ ███████████ ███ █▒█ █ █ █ █ █▒█ █████             ███████████████▒▒ █▒█▒█████▒█████
 █ █▒█ ███ █ █ █▒█ █ █ ▒▒█▒███████ ▒▒█▒▒ █           ▒   █ █               █▒█▒███▒███▒██▒   █ ▒ █ █ █ █▒█ 
█▒█▒█▒███▒█▒█ █▒█▒███▒  █▒███████ █ ███ █ ▒           █ ▒ █                ██████████▒███   ▒     █ ▒ █████
 ▒ █ █ █ ▒ ▒   ▒ ▒ █ █   ▒ █ █▒█ ▒   █                     ▒               █ █ █ █▒█ █ █               █ █ 
█ █ █ █▒█ █ █   █ █ █▒  █ █ ███▒█   ███                   ▒                ▒█▒█▒█▒█ █ █ █             ▒▒█▒█
       ▒             ▒       █ ▒     █                                     █▒█ ▒ █ ▒ ▒                 ▒ ▒ 
      █             ▒       █ █       ▒                                     █ ▒ ▒ █                     █  
                                                                                                           
                                                                            █

Upgrade by digest

Last updated 2026-09-29

Upgrade a Weald relay by pinning an image digest instead of a tag. Every release publishes its digest and its binary SHA-256, signed. The client shows the digest its relay reports, so every connected member can see a mismatch.

Schema migrations stay forward-compatible for one minor version, so an upgrade is a rolling restart with no outage.

Why a digest

Somebody can move a tag to new content. A digest names the content itself, so pinning one means you run what you reviewed.

The published container digest is reproducible from the tagged source, so a third party can rebuild and compare.

The sequence

Read the release notes and the advisory, if the release carries one.
Verify the signature on the published digest and the binary SHA-256.
Pin the new digest in your compose file or unit file.
Restart. Migrations run forward and an old process and a new one can share the database for the length of a deploy.
Confirm the digest the client reports matches the one you pinned.

Rolling back

Pin the previous digest and restart. Migrations are forward-compatible across one minor version, so a rollback within that window is the same operation in reverse.

Across a larger gap, restore a backup taken before the upgrade. Do not migrate a database backwards.

The release check

The relay fetches the public release feed once a day and reports the result on its readiness endpoint. When a security release is out, admins see an update notice in the client naming the release and its advisory.

The check is an unauthenticated GET of a public file. There is no auto-upgrade and no telemetry alongside it. WEALD_RELAY_RELEASE_CHECK=off turns it off for an air-gapped install.

Two different signals

The client treats these two states differently, and so should you.

Digest states and what they mean
State	What it is	Response
Digest does not match its source tag	An alarm. Something is running that no release describes	Investigate before anything else
Digest is older than the latest release	A chore	Schedule an upgrade

The two are drawn differently so that routine upgrade notices do not train people to ignore a security banner.

What a digest check is worth

It catches deployment drift and operator mistakes. It does not prove what a remote host is executing, because a modified binary can misreport its own digest.

A relay you run, from an image you verified, is running what you think it is. Verify is the procedure for checking the rest.

Upgrade by digest

Why a digest#

The sequence#

Rolling back#

The release check#

Two different signals#

What a digest check is worth#