Guides

Deliver packs over the air

Catalogue, staged rollout, entitlements, revocation, rollback.

  1. 1

    Run the control plane

    A single static binary; the catalogue index is generated from a directory of .lybopack files.

    cargo build -p lybo-plane --release
    lybo-plane --dir /var/lybo/packs --port 8787 \
      --rollout my.new-pack:25 \
      --entitle customer-org:pro
  2. 2

    Devices sync

    Plan → download → catalogue-hash check → revocation check → full signature verification → install. The CLI shows the exact flow your app performs via the SDK.

    lybo sync --plane http://127.0.0.1:8787 \
      --data-dir /tmp/device --device-id device-42 \
      --trust "you:$PUBKEY"
  3. 3

    Operate the rollout

    Raise --rollout percentages as confidence grows; emergency-stop with 0; revoke a compromised publisher key with --revoke; devices roll back locally in one call.

The server is untrusted by design — a compromised catalogue cannot inject packs, because devices verify the ed25519 signature against their local trusted-publisher list before installing anything.