Skip to main content
Every production release of Argus is built by Cosmon’s CI from a protected release branch. This page describes the integrity guarantees attached to each release and how to verify them independently. For what IT must allowlist on the workstation, see IT prerequisites.

​
Code signing

​
Checksums

Each release publishes a manifest next to the installer with the SHA-512 of every file (latest.yml, latest-mac.yml, latest-linux.yml). The built-in updater downloads only over HTTPS from Cosmon’s release endpoint and refuses to apply any file whose SHA-512 does not match the manifest. To verify a download by hand, compare the base64 SHA-512 in the manifest with:

​
Build provenance

Every installer on every platform ships with a SLSA v1.0 build provenance attestation, a Sigstore bundle named <installer>.sigstore.json published beside the installer. On macOS one bundle covers both the .dmg and the .zip and is published under the .dmg name; verify the .zip against that same bundle. It is issued by GitHub Actions and binds the artifact’s SHA-256 digest to the exact source commit and workflow that built it, so a binary that did not come out of Cosmon’s release pipeline cannot carry a valid attestation. Verify offline with the GitHub CLI:

​
Runtime hardening

The packaged application enables Electron’s integrity fuses: embedded ASAR integrity validation, load-only-from-ASAR, and runAsNode and Node CLI inspection disabled. Application code cannot be swapped after installation without breaking both the signature and the integrity check.

​
Software bill of materials

A CycloneDX SBOM is available for each release on request, covering the Electron application’s runtime dependencies and the bundled Python agent’s dependencies, generated from the pinned lockfiles the release was built from. Contact support@cosmon.com with the release version.

​
Dependencies and maintenance

Dependencies are pinned by lockfile. Automated dependency update pull requests run daily for the Python packages and the CI workflow actions; coverage for the Electron application’s npm packages is being added. GitHub code scanning with CodeQL runs on every pull request and on a weekly schedule across the JavaScript, TypeScript, Python, C/C++, C# and Java code in the repository. Core runtimes are kept within their upstream support windows: Electron on a currently supported major, Node.js on an LTS line, and CPython 3.12.

​
Updates

The desktop application checks Cosmon’s release endpoint over HTTPS and applies updates through the platform mechanism: the signed NSIS installer on Windows, the signed and notarized bundle on macOS, and the AppImage on Linux. Each update is verified against the checksum manifest before it is applied. Cosmon can set a minimum supported version; a client whose version check succeeds and falls below it must update before it can continue.