Upgrading

An upgrade is in place. The payload is replaced as a whole. The state, the service accounts, the key database and the keys are all kept.

The order

1. Verify the new release against its signed SHA256SUMS. See Verifying a release.
2. Install the new packages or MSIs over the installed ones. Each package restarts the units it stopped. On Windows each MSI stops its product's services and starts them again.
3. Register the new Console and Gateway release with the key server. A new release is a new signed manifest. At code-signing level 2 the tier answers 503 BUILD_NOT_ADMITTED until you register it. At levels 0 and 1 nothing is needed after an upgrade on Linux. The Windows procedure registers the release every time.

The commands for each platform:

• Upgrade on Linux, with the code-signing level 2 step (tricryption-tier-provision --register-release). Amazon Web Services follows the Linux procedure.
• Upgrade on Windows (tricryption-tier-provision.ps1 -RegisterRelease).

Do not re-run the full tier provisioner after an upgrade at level 2. The key server refuses every connection from an unregistered release, the administrator's included, so the full run stops before it registers anything.

Qualified at engine master ac4545d27c95.