> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cosmon.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Release integrity

> How Argus releases are signed, checksummed and attested, how to verify a build you received, and how dependencies are tracked.

Every production release of Argus is built by Cosmon's CI from a protected release branch. This page describes the integrity guarantees attached to each release and how to verify them independently. For what IT must allowlist on the workstation, see [IT prerequisites](/architecture/it-prerequisites).

## Code signing

| Platform | Artifact | Signing |
| - | - | - |
| Windows | NSIS installer (`.exe`) | Authenticode, SHA-256 digests, RFC 3161 timestamped. The certificate's private key is held in an HSM-backed cloud signing service and never leaves it. The installer, the main executable, helper executables, the bundled Python interpreter and Cosmon's integration DLLs are each signed individually, and signature verification is a build gate. |
| macOS | `.dmg` and `.zip` (Apple Silicon) | Apple Developer ID with the hardened runtime, notarized by Apple, notarization ticket stapled. A post-build check runs `codesign`, the Gatekeeper assessment and stapler validation and fails the release if any does not pass. |
| Linux | AppImage | Unsigned; there is no platform signing mechanism. Integrity is provided by the checksum manifest and the provenance attestation below. |

## Checksums

Each release publishes a manifest next to the installer with the SHA-512 of every file (`latest.yml`, `latest-mac.yml`, `latest-linux.yml`). The built-in updater downloads only over HTTPS from Cosmon's release endpoint and refuses to apply any file whose SHA-512 does not match the manifest.

To verify a download by hand, compare the base64 SHA-512 in the manifest with:

```bash theme={null}
# macOS / Linux
shasum -a 512 <installer> | awk '{print $1}' | xxd -r -p | base64
```

```powershell theme={null}
# Windows
$hex = (Get-FileHash <installer> -Algorithm SHA512).Hash
[Convert]::ToBase64String([byte[]] -split ($hex -replace '..', '0x$& '))
```

## Build provenance

Every installer on every platform ships with a [SLSA](https://slsa.dev) v1.0 build provenance attestation, a Sigstore bundle named `<installer>.sigstore.json` published beside the installer. On macOS one bundle covers both the `.dmg` and the `.zip` and is published under the `.dmg` name; verify the `.zip` against that same bundle. It is issued by GitHub Actions and binds the artifact's SHA-256 digest to the exact source commit and workflow that built it, so a binary that did not come out of Cosmon's release pipeline cannot carry a valid attestation.

Verify offline with the GitHub CLI:

```bash theme={null}
gh attestation verify "<installer>" --bundle "<installer>.sigstore.json" -R Cosmon-Inc/cosmon
```

## Runtime hardening

The packaged application enables Electron's integrity fuses: embedded ASAR integrity validation, load-only-from-ASAR, and `runAsNode` and Node CLI inspection disabled. Application code cannot be swapped after installation without breaking both the signature and the integrity check.

## Software bill of materials

A CycloneDX SBOM is available for each release on request, covering the Electron application's runtime dependencies and the bundled Python agent's dependencies, generated from the pinned lockfiles the release was built from. Contact [support@cosmon.com](mailto:support@cosmon.com) with the release version.

## Dependencies and maintenance

Dependencies are pinned by lockfile. Automated dependency update pull requests run daily for the Python packages and the CI workflow actions; coverage for the Electron application's npm packages is being added. GitHub code scanning with CodeQL runs on every pull request and on a weekly schedule across the JavaScript, TypeScript, Python, C/C++, C# and Java code in the repository. Core runtimes are kept within their upstream support windows: Electron on a currently supported major, Node.js on an LTS line, and CPython 3.12.

## Updates

The desktop application checks Cosmon's release endpoint over HTTPS and applies updates through the platform mechanism: the signed NSIS installer on Windows, the signed and notarized bundle on macOS, and the AppImage on Linux. Each update is verified against the checksum manifest before it is applied. Cosmon can set a minimum supported version; a client whose version check succeeds and falls below it must update before it can continue.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.