Dell SmartFabric OS10 Installation, Upgrade, and Downgrade Guide

Upgrade or downgrade OS10 image on secure boot-enabled nodes

This section describes how to use the image secure-install command to upgrade or downgrade OS10 image on secure boot-enabled nodes. When secure boot is enabled, the image install command is disabled. Use the image secure-install command to validate the image file using digital signatures and to install the OS10 image.

To install OS10 image when secure boot is enabled:

1. Extract the OS10 *.tar file that you downloaded from the Dell Support Site. The package includes the following files:
   • PKGS_OS10-Enterprise-10.5.5.0P1.48buster-installer-x86_64.bin—OS10 image binary file.
   • PKGS_OS10-Enterprise-10.5.5.0P1.48buster-installer-x86_64.bin.sha256—SHA-256 hash of the OS10 image binary file.
   • PKGS_OS10-Enterprise-10.5.5.0P1.48buster-installer-x86_64.bin.gpg—GNU privacy guard (GnuPG or GPG) signature of the OS10 image binary file.
   • PKGS_OS10-Enterprise-10.5.5.0P1.48buster-installer-x86_64.bin.sha256.base64—PKI signature of the OS10 image binary file.
   • DellOS10.cert.pem—Dell public key certificate.
   • PKGS_OS10-Enterprise-10.5.5.0P1.48buster-installer-x86_64.bin.sig—OS10 image signature file.
   • README.PKGS_OS10-Enterprise-10.5.5.0P1.48buster-installer-x86_64.txt—README file.
2. If not already done, save the configuration and protect the start-up configuration.
   NOTE:This step is important because you cannot load an unprotected start-up configuration file on a secure boot-enabled node.

   OS10# write memory
   OS10# secure-boot protect startup-config

   Use the show secure-boot status command to check if the start-up configuration file is protected.
3. Copy the OS10 image binary file to image: directory or usb. Copy the signature files to a remote repository or copy them to image: directory or usb.
4. Use the image secure-install command to validate and install the OS10 image. The OS10 image installer verifies the signature of the image files using the SHA-256 hash, or GNU privacy guard (GnuPG or GPG)-based signatures, or digital signatures (PKI-signed). After successful validation, the image file is installed.
   1. To install OS10 image with SHA-256 hash:
      1. Obtain the SHA-256 hash from the *.sha256 file.
      2. Install the OS10 image using the SHA-256 hash.

         OS10# image secure-install image://PKGS_OS10-Enterprise-10.5.5.0P1.48buster-installer-x86_64.bin sha256 signature 13b55d1740a5e9e95353623c69bd2f86a284eff2242ca076867b32a3b7c098e2

   2. To install OS10 image with GPG signature verification:
      1. Ensure that you have installed the GPG key into the switch GPG keyring.

         OS10# image gpg-key key-server keyserver.ubuntu.com key-id 47CB9029

      2. Install the OS10 image with GPG signature from the *.gpg file.

         OS10# image secure-install image://PKGS_OS10-Enterprise-10.5.5.0P1.48buster-installer-x86_64.bin gpg signature image://PKGS_OS10-Enterprise-10.5.5.0P1.48buster-installer-x86_64.bin.gpg

   3. To install OS10 image with PKI signature verification: Install the OS10 image with the PKI signature and Dell public key certificate files.

      OS10# image secure-install image://PKGS_OS10-Enterprise-10.5.5.0P1.48buster-installer-x86_64.bin pki signature image://PKGS_OS10-Enterprise-10.5.5.0P1.48buster-installer-x86_64.bin.sha256.base64 public-key image://DellOS10.cert.pem

5. Check the status of image installation using the show image status command.
6. After successful installation, use the boot system standby and reload commands to boot with the new image.