Signed swi containing signed extensions for dynamic installation

A network device, comprising:

• a processor;
• a nonvolatile memory;
• and
• instructions stored on the nonvolatile memory and translatable by the processor for:
• receiving a command to download a full software image (SWI) from an install source, the full SWI having a signature and a directory containing software packages for extensible network operating system (ENOS) extensions;
• while the full SWI is being downloaded from the install source to the nonvolatile memory, modifying the full SWI on the fly, the modifying comprising:
• reading and removing the software packages from the directory;
• as each respective software package is read from the directory, determining whether to process the respective software package;
• and
• for each respective software package that is to be processed:
• extracting an ENOS extension and a corresponding signature from the respective software package;
• and
• storing the ENOS extension with the corresponding signature on the nonvolatile memory;
• wherein the modifying results in a modified SWI containing the signature without the software packages;
• and
• wherein, after download is complete, the nonvolatile memory stores a subset of the ENOS extensions with corresponding signatures;
• verifying, using the corresponding signatures, the subset of the ENOS extensions so as to determine valid ENOS extensions for inclusion in an overlay filesystem which becomes a root filesystem for the network device;
• and
• verifying the signature of the modified SWI before booting the network device into the modified SWI.

A computer program product comprising a non-transitory computer-readable medium storing instructions translatable by a processor of a network device for:

• receiving a command to download a full software image (SWI) from an install source, the full SWI having a signature and a directory containing software packages for extensible network operating system (ENOS) extensions, the network device having a nonvolatile memory;
• while the full SWI is being downloaded from the install source to the nonvolatile memory, modifying the full SWI on the fly, the modifying comprising:
• reading and removing the software packages from the directory;
• as each respective software package is read from the directory, determining whether to process the respective software package;
• and
• for each respective software package that is to be processed:
• extracting an ENOS extension and a corresponding signature from the respective software package;
• and
• storing the ENOS extension with the corresponding signature on the nonvolatile memory;
• wherein the modifying results in a modified SWI containing the signature without the software packages;
• and
• wherein, after download is complete, the nonvolatile memory stores a subset of the ENOS extensions with corresponding signatures;
• verifying, using the corresponding signatures, the subset of the ENOS extensions so as to determine valid ENOS extensions for inclusion in an overlay filesystem which becomes a root filesystem for the network device;
• and
• verifying the signature of the modified SWI before booting the network device into the modified SWI.