Scope and prerequisites
Verification is separate from installed apply; full reconstructible backup/coordinator gates remain mandatory. This reference describes the reviewed newer source CLI. Use the exact approved installed kit and authenticated operator terminal on the designated disposable VM. A marketing/documentation publication does not install these commands or qualify the host. Keep provider console, private configuration, original journals and independent recovery available. Never substitute placeholder digests, automatically accept a confirmation or reset a blocked journal. Inspect a read-only plan first where the family supports planning; apply is a separate explicit reviewed step. Credentials belong in the protected file parameters, not command-line secret values.
Parsed command family
panelctl update verify|plan|apply|recover|rollback|status|rotate-root
Exact parsed options
| Option | Parser default | Purpose |
|---|---|---|
--metadata |
"" |
absolute signed release metadata path |
--package |
"" |
absolute gzip USTAR package path |
--trusted-root |
"" |
absolute public update-root document; verification only |
--trusted-root-sha256 |
"" |
independently pinned public root SHA256; verification only |
--operation |
"" |
32-hex local update operation ID |
--plan-file |
"" |
absolute private reviewed plan document |
--authorize |
"" |
exact review confirmation |
Update acceptance remains blocked
The family includes verify, plan, apply, recover, rollback, status and root rotation. Verification-only trust arguments do not enroll production signing custody. Root rotation requires both signature thresholds. Apply/recovery must preserve the exact protected plan and operation; production updates remain blocked by missing reconstructible recovery/coordinator acceptance. Never copy a verified archive over active binaries manually.
Verify and handle failure
Read the command result and retained operation/report, then inspect actual owned service state. A saved metadata file or successful verification is not necessarily apply. On stale digest, unknown layout, unavailable agent, partial effect or uncertain delivery, retain the evidence and follow the exact release recovery procedure. Do not disable AppArmor, remove locks/receipts, overwrite unrelated files or claim a source-only test as installed success.