From c5df12201c30d75c0546015f107ac133cb63475e Mon Sep 17 00:00:00 2001 From: librelad Date: Sat, 18 Jul 2026 00:00:49 +0100 Subject: [PATCH] =?UTF-8?q?docs(updater):=20mark=20P0=E2=80=93P3=20shipped?= =?UTF-8?q?=20in=20the=20roadmap?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit P0 anchor, P1 config-first pin, P2 registry detection + display, and P3 honest pinned apply/revert are all built and deployed. Records the detection nuance (digest-compare fully covers rolling apps; versioned newer-version enumeration is a P5 add) and the remaining deferred work. Co-Authored-By: Claude Opus 4.8 (1M context) Signed-off-by: librelad --- docs/roadmap/app-version-updater-and-cve.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/roadmap/app-version-updater-and-cve.md b/docs/roadmap/app-version-updater-and-cve.md index aae087f..98adb75 100644 --- a/docs/roadmap/app-version-updater-and-cve.md +++ b/docs/roadmap/app-version-updater-and-cve.md @@ -136,10 +136,10 @@ Once detection + pinned apply are trustworthy, add `CFG_UPDATER_AUTO=off|securit ## 7. Build phases (each independently shippable) -0. **P0 — Anchor fix.** *(done 2026-07-17)* `updaterPrimaryImage` resolves each app's version image from its `-service`, not the first `image:` line — fixes the ollama mislabel. Used by both the version and CVE loops. -1. **P1 — Config-first pin foundation.** (a) Wire the anchor `image:` line into the tagging system: add a `#LIBREPORTAL|_VERSION_TAG|` sentinel so `CFG__VERSION` drives the tag (opt-in; default = today's tag = no-op). (b) Factor the compose image-line **digest** rewrite into a shared helper (artifact op + updater both use it, all `image:` lines keyed by service). (c) Record resolved digest on install + reconcile-on-first-scan. Classify `type` (versioned/rolling) from the anchor tag. No UI change yet. -2. **P2 — Real detection + display.** Registry digest compare in `webuiUpdaterScan` behind the new interval knob; `updates.json` gains `type`/`services[]`/digests + resolved display `version` (config → OCI label → tag → short digest); fleet + per-app tabs light up with truthful data, versioned vs rolling rendered per type. Emit recovery fields while in there. -3. **P3 — Pinned apply/revert.** `updaterApplyApp`/`updaterRollbackApp` rewrite pins as in §4; history carries digest refs; failure path restores pins. *After this, the Update and Roll back buttons are honest.* +0. **P0 — Anchor fix.** ✅ *done 2026-07-17.* `updaterPrimaryImage` resolves each app's version image from its `-service`, not the first `image:` line — fixes the ollama mislabel. Used by both the version and CVE loops. +1. **P1 — Config-first pin foundation.** ✅ *done 2026-07-17.* (b) `CFG__VERSION` drives the anchor tag via a `#LIBREPORTAL|_VERSION_TAG|` sentinel on every app's anchor image line (32 apps, opt-in, default = today's tag = no-op). (c) Digest recorded/reconciled by the scanner itself (no install hook needed — it inspects the running image each scan). `type` classified from the anchor tag. Shared image-line digest-rewrite = `updaterSetAnchorRef` (anchor-aware; artifact-op sharing deferred). +2. **P2 — Real detection + display.** ✅ *done 2026-07-17.* Registry digest compare (`docker buildx imagetools inspect` = the RepoDigest identity) in `webuiUpdaterScan` behind `CFG_UPDATER_REGISTRY_INTERVAL` (throttled, reuse-between-windows); `updates.json` carries `type`/`channel`/`services[]`/digests + resolved display `version` (config → OCI label → tag → short digest). Fleet + Updates tabs show truthful data. **Note:** digest-compare fully detects *rolling* new-builds; *versioned* newer-version enumeration (tag listing) is a P5 add. Recovery fields still inferred from History (deferred). +3. **P3 — Pinned apply/revert.** ✅ *done 2026-07-17.* `updaterApplyApp` records exact `repo:tag@sha256:…` from→to and un-pins before pulling; `updaterRollbackApp` re-pins the anchor to the pre-update build's digest before `up` (closes "new code on old data"). History carries digest refs. *(Helpers unit-tested; end-to-end apply/revert not yet exercised on a live install with a pending update.)* 4. **P4 — CVE scanner.** The trivy app (catalog + recommended + first-install list) plus the updater's scan step through it; `cves.json` for real, guard dropped, totals + severity chips live, security-update tie-in. The app itself can ship ahead of the rest of P4. 5. **P5 — Polish.** Per-app critical-CVE / update chip on the app header (pattern exists for improvements), remote version-label enrichment, "N services" aggregation in rows. 6. **P6 — Auto-update policy** (§6), only after P3 has soaked on a real install.