← Back to Architecture & Engineering Studies

Study 04 · Supply-Chain Security October 10, 2026 · 6 min visual read · By Rasnu Security Engineering

Zero-Trust Agent Supply Chain: Offline Signing, Key Pinning & Fail-Closed Updates

Any infrastructure agent capable of updating itself must be engineered under the assumption that download mirrors or networks could one day be untrusted. Below is the visual supply-chain architecture of how the open-source RasnuOS agent signs releases offline, pins verification keys at compile time, and operates with zero open inbound ports.

Flowchart 01 · Two-Lane Supply-Chain Verification Pipeline

Offline Release Signing vs. On-Host Fail-Closed Verification

Linux · macOS · Windows (x86_64 & ARM64)

Lane A · Release Build & Offline Signing Pipeline

1. Compile-Time Key Pinning

Public verification key is embedded directly inside the compiled binary—never read from an editable config file on disk.

2. Multi-Arch Compilation

Standalone binaries built for Linux, macOS, and Windows across `amd64` and `arm64` with zero external runtime dependencies.

3. Detached `.sig` Generation

Each binary is cryptographically signed offline to produce a detached `.sig` signature file distributed alongside the release.

Lane B · Server Agent Self-Update State Machine (On Your Host)

Step 01 · Isolated Fetch

Downloads candidate binary + `.sig` into a private temporary directory without touching the active binary.

Step 02 · In-Memory Verify

Verifies detached `.sig` against the downloaded binary using the public key compiled into the running agent.

Pass → Atomic Swap

Swaps the verified binary into place cleanly and restarts the service with zero dropped state.

Fail → Fail-Closed Abort

Deletes temp files immediately, keeps current binary running untouched, and logs a security alert.

Chart 02 · Update Verification Threat Comparison

Why Same-Server Checksums Fail and Offline Signatures Succeed

Zero-Trust Update Model

Compromise Scenario	Unsigned Updater	Checksum File on Same Server	RasnuOS Pinned Offline Signature
Download Mirror / CDN Tampering	Vulnerable	Vulnerable (Attacker edits checksum)	Protected (Signature fails, update aborts)
Network Transit Bit-Flip / Truncation	Corrupts Binary	Detected	Protected (Verified before swap)
Local Config File Key Replacement	N/A	Vulnerable	Protected (Key compiled into binary)

Flowchart 03 · Network Perimeter Comparison

Inbound SSH Bastions vs. Outbound-Only Port 443 Topology

Legacy Management Tools (Inbound SSH)

× Requires Port 22 exposed to external IP ranges or bastion relays.

× Third-party cloud stores long-lived root SSH private keys for your fleet.

× Difficult to deploy behind NAT, private VPC subnets, or CGNAT.

RasnuOS Agent (Outbound Port 443 Only)

✓ Zero open inbound ports: Agent dials outbound over standard HTTPS/WSS (TLS 1.3).

✓ Zero stored root SSH keys: Authenticates via per-server revocable token.

✓ Works seamlessly inside private VPCs, NAT gateways, and bare-metal racks.

1-Click Server Revocation: Revoking a server in the RasnuOS console immediately invalidates its per-server token and terminates the active WebSocket stream.

100% Open-Source Agent: Audit the complete source code, updater verification logic, and release build workflows at github.com/rasnu/os-agent.

More Architecture Studies

System Architecture