Skip to main content

Offline and Air-Gapped Distribution

Certain operational sectors (defense, secured trading floors, rural branch banks lacking persistent Internet connectivity, maritime vessels, mining concessions) require software updates to execute in strictly air-gapped or low-bandwidth environments.

TkushPatch includes capabilities to export, transport, and deploy OTA patches without demanding active online connections to the centralized control plane.

1. Air-Gapped Deployment Architecture​

Air-Gapped Offline Distribution Flow
  1. Connected Hub: Download signed patch bundles and metadata from the Web Console.
  2. Secure Transfer: Relay packages through authorized encrypted removable storage or private network.
  3. Isolated Edge: Serve packages from a local intranet relay or directly to devices.

2. Manual Artifact Export from the Web Console​

To construct an offline update bundle:

  1. Authenticate to the TkushPatch web console (/releases).
  2. Open the release inspector pane (ReleaseDetailInspectorPane).
  3. Inside the contextual action menu (PatchActionMenu), select Download Binary Artifact:
    • The browser downloads the compressed differential file (e.g., patch_v1.0.0_1.vmcode).
  4. Download the corresponding manifest record containing:
    • Target SHA-256 digest (targetSha256Hash).
    • Base64 RSA digital signature digital signature.
    • Public key in public signing key format representation.

3. Local Patch Injection via the Mobile SDK​

The Flutter SDK tk_ota_push exposes a dedicated API method to apply a differential payload stored directly on the handset's local filesystem (transferred via USB cable, secure SD card, or local Bluetooth/Wi-Fi share):

import 'dart:io';
import 'package:flutter/material.dart';
import 'package:tk_ota_push/tk_ota_push.dart';

Future<void> applyOfflinePatch(String vmcodeFilePath, String signatureBase64) async {
  final patchFile = File(vmcodeFilePath);

  if (!await patchFile.exists()) {
    throw Exception("The specified patch artifact does not exist on local storage.");
  }

  // Execute local application with strict cryptographic verification
  final result = await TkOtaPush.applyPatchFromFile(
    patchFile: patchFile,
    signatureBase64: signatureBase64,
  );

  if (result.isSuccess) {
    debugPrint("✅ Offline patch successfully applied!");
    // Restart application to mount the new binary into the AOT runtime
    await TkOtaPush.restartApp();
  } else {
    debugPrint("❌ Offline application failed: ${result.errorMessage}");
  }
}

[!IMPORTANT] Even during offline execution, the native Rust engine strictly refuses to execute any file whose RSA signature or SHA-256 digest fails verification. The integrity chain of custody is absolute and independent of network reachability.

4. Local Branch Office Caching Relays​

In remote branch offices cut off from the wide-area corporate WAN but possessing a local Wi-Fi LAN:

  1. Stage .vmcode differential files and a patches.json manifest onto a local micro-server (e.g. lightweight Nginx on a branch POS or Raspberry Pi).
  2. Configure application bootstrap to target the local fallback proxy: 
    await TkOtaPush.initialize(
      overrideEndpoint: "http://192.168.1.100:8080/ota-cache",
    );
  3. When field branch employees connect to the internal branch Wi-Fi in the morning, handsets retrieve updates locally from the office server without consuming satellite or cellular bandwidth.