At 06:41 UTC Sable read that a new version of the library had been tagged.
The version was 4.2.2. The change in it was one number. The person who had signed the release used the handle kolobok, which was the same handle on the file Sable had been reading for two days.
Sable had expected the number to sit where it was until the rotation finished. It had not. Somebody had found it, written the one line, and persuaded two maintainers and a company to move on a weekend, in a night. Whoever had done it was fast. It was good work, and it was three days early.
It did not matter.
The number had been wrong for years. Every signature made under it was in the public log, and a fix did not make the log shorter. Sable’s people had been averaging those signatures on better hardware than anyone else watching, and the key had fallen out on Monday, a few hours after Sable thought it would. The new code would keep the next key clean. It could not reach back and take this one. This one was theirs.
At 07:00 UTC the status page changed. The portal that had been counting toward completion for two days now said that signing was paused for scheduled maintenance.
Nobody paused a thing like that for maintenance at seven in the morning. A status page said maintenance when the people writing it did not want to say what had actually happened, and the only thing that had happened was that somebody had told them the number was wrong. So they had stopped, and they would make a new root on the clean code, and they would try to put it on every device before the old one mattered.
That was the thing to beat. Not Thursday.
The machine at the Institute would finish the old root on Thursday. Sable had the daily note from Ochre on the screen. The run was on schedule and the generator had held through one outage in the night. Thursday was real but it was now too late.
Sable did not need Thursday. Sable had a key today.
One key was enough. Whoever reached the devices first would own them. Sable had the update the devices already trusted. The Americans would write their own now and try to reach the devices before Sable did. It was a straight race between two packages, and Sable had been ready since Monday.
Carmine came in without knocking. He had the leather folder.
“The minister has the list ready,” Carmine said. “You can begin whenever you are prepared. He would like the port first.”
The list was the minister’s parade — the port, the power companies, the water authority, a payment network, a satellite. Sable had read it in a cold room three weeks ago and told Carmine half of it would have a new root inside a month. Carmine had brought it in anyway.
“Not the port,” Sable said. “Not any of it. Not today.”
Carmine made a face. “The minister —”
“The minister can have the whole list next week, and every line of it will still work, because nobody is rotating a water authority by next week. There is one thing that keeps for hours, and I need to beat it.”
“One thing.”
“The root. All of it. Everything with the old root in it.” Sable turned the screen so Carmine could see the paused status page, though it would mean nothing to him. “They stopped an hour ago. They are building the replacement now. If they put it out before I do, the key I spent a year on opens nothing. If I put mine out first, every machine that has not been touched by a person believes me instead of them, and they cannot take it back. Not the minister, not the Americans, not the person who wrote the fix.”
Carmine looked at the folder in his hands as though the list in it had rearranged itself.
“The minister wanted the port,” he said again, more quietly.
“The port runs on things a person can unplug and replace. This runs on things no one can reach. After today the minister can have the port, and it will be a small thing, and he will be pleased, even though it doesn’t matter. Please leave me alone.”
Carmine went out to call someone.
Sable pulled the package up.
It was built. It carried the key, and it answered every line of the Americans’ own bulletin — run this, confirm that, accept it only if it also carries the new signature. The package would arrive looking exactly like the thing the world had been told to trust.
Sable read it through one more time to be sure. There was nothing left to find. Then Sable opened the line to the team.
“We send the root update,” Sable said. “Now. The widest reach we have, everything that will take it, below the places anyone is watching. You have the targets.”
“All of them,” the voice on the line said. It was not a question, but there was a stutter in the voice. The team had been holding the list of what could not defend itself for a week.
“All of them.”
Sable made tea and drank it standing at the window while the package went into the pipe. Sable stared at the trams across the water. A man in an apron was hosing down the pavement in front of a café. All of it ran, one way or another, on the things now in the pipe. Nobody over there would notice, today or tomorrow. The minister had wanted a parade. This was the opposite. Fuck the minister. This was what mattered.
Sable thought of the parking lot in Boulder. Sable had heard the report of the yellow dog and the blaring horn. Hale had walked out of that lot. She had a better version of all of this in her head, and the Americans had four hundred policemen and a photograph of the top of a man’s skull. Sable did not need Hale for this. Sable had her beat.
The team came back on the line.
“It is moving,” the voice said.
Sable set the cup down. Every machine that received the package would check it, and every check would pass. Machines would think the credential checked out and say the update was permitted. The update would be installed.
Sable was certain of that.
What Sable did not know, standing at the window with the now cooling cup of tea, was whose package the devices would see first.