AFS supports snapshots, so like windows/etc you just take a volume snapshot, apply a differential update then reboot. The COW nature would make the entire thing even fairly trivial IO wise.
The article notes they are using merkle trees, so its not really necessarily to validate the entire image. Only the parts that change, which should be fairly trivial, and likely is done as each part of the image is run (because you have to do it that way anyway, otherwise changes would sneak by if they were made while the OS was running).
If something bad happens, you "just" revert to the last known good snapshot.
The way this all gets messed up, is if there is some per build versioning information that ends up being propagated into every single part of the system like Linux does with its module loader on clean builds. Then effectively you are forced to update the entire OS just because the version number rolls, some signing key gets changed, or whatever.
The differential download in that case would compress really well, but it would take an eternity to apply, and the entire image would probably end up getting duplicated following the volume snapshot.
So I would expect some kind of "bug" like that, the kernel guys/whatever have their own version validation system, and the installer guys have some clever upgrade code, but put them together and neither works right.
The article notes they are using merkle trees, so its not really necessarily to validate the entire image. Only the parts that change, which should be fairly trivial, and likely is done as each part of the image is run (because you have to do it that way anyway, otherwise changes would sneak by if they were made while the OS was running).
If something bad happens, you "just" revert to the last known good snapshot.
The way this all gets messed up, is if there is some per build versioning information that ends up being propagated into every single part of the system like Linux does with its module loader on clean builds. Then effectively you are forced to update the entire OS just because the version number rolls, some signing key gets changed, or whatever. The differential download in that case would compress really well, but it would take an eternity to apply, and the entire image would probably end up getting duplicated following the volume snapshot.
So I would expect some kind of "bug" like that, the kernel guys/whatever have their own version validation system, and the installer guys have some clever upgrade code, but put them together and neither works right.