:latest is three independently-mutable registry tags with no cross-image
transaction -- update.sh pulling it directly could observe a torn set
mid-promotion (api already retagged, ui/proxy not yet). latest-version.json
is a single, atomically-committed pointer that argus-appliance's release
pipeline only ever writes AFTER every image it names has finished
promoting, so resolving it first cannot observe a partial release: by the
time it names a version, that version is already guaranteed complete.
docker-compose.yml: image tags now ${ARGUS_VERSION:-latest} -- default
unchanged for manual/non-update.sh use (plain `docker compose pull` with
no env var set behaves exactly as before).
update.sh: resolves latest-version.json first (fails loud and untouched if
unreachable/malformed, never falls back to :latest), exports ARGUS_VERSION
for its own docker compose calls only (not written to .env), and -- new --
verifies every service's actual running image tag matches the target
version before declaring success, not just that the API container itself
reports healthy. A torn pull (network hiccup, disk full on one image) is
now a loud failure instead of a silently-reported success.
Cross-repo documentation audit against argus-appliance's real current feature set
(v3.79.80): added a Reports Center bullet (guided JSON/CSV/HTML reporting, honestly scoped —
no PDF/scheduling/compliance templates yet) and expanded the Attack Origin Visualization bullet
with the two real additions from the appliance's Attack Operations Center follow-on (attack-type
coloring, fullscreen SOC wall mode).
Moved this changelog's own "not kept in sync" disclosure from a buried trailing note to the top
of the file, right under the title, so a reader sees it before the stale entries rather than
after — same honest content, just where it's actually useful.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
tech
root