5a53a1b4c6
webuiUpdaterScan now tells the truth instead of hardcoding update_available=false. Per app it resolves three facts (see roadmap §2): the running RepoDigest (one `docker inspect` of the anchor image), the display version (OCI label → versioned tag → channel·shortdigest), and — throttled — the registry's current index digest for the channel tag (`docker buildx imagetools inspect`, the same identity as RepoDigest, verified exact). update_available = the two digests differ. Emits type (versioned|rolling), channel, current/available digests + versions, and a services[] array (every image line, anchor flagged). - Registry lookups throttled separately from the scan: CFG_UPDATER_REGISTRY_ INTERVAL (min, default 360; 0 = local-only), own /tmp stamp, reuse of the prior available_digest between windows so the app list still refreshes every scan. UPDATER_REGISTRY_FORCE=1 forces a live pull (the Check-now button). Registry failure (offline/rate-limited) = "unknown", never a false "changed". - Digest-compare fully detects rolling apps' new builds; for versioned apps it catches rebuilds of the pinned tag (newer-version enumeration is a later step) — honest per type, and versioned apps are user-picked via P1b anyway. - Fixes a P1b regression: updaterPrimaryImage now strips the trailing version sentinel comment (`s/ #.*//`) via _updaterCleanImageRef — without this the anchor ref (and the live CVE scanner's image arg) carried the comment. - JSON built with jq for safe escaping; jq-less fallback keeps output valid. Verified via a simulated 2-app install: navidrome → "0.62.0" (OCI label) + detected update; rolling app → channel·shortdigest + update; throttled re-run reuses the prior digest; all output valid JSON. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: librelad <librelad@digitalangels.vip>
8 lines
822 B
Plaintext
8 lines
822 B
Plaintext
# ================================================================================
|
|
# WebUI Updater - Automatic app update, CVE & improvement scanning **ADVANCED**
|
|
# @icon 🔄
|
|
# ================================================================================
|
|
CFG_UPDATER_SCAN_INTERVAL=30 # App Scan Interval - Minutes between automatic app update/CVE/improvement scans. 0 disables.
|
|
CFG_UPDATER_REGISTRY_INTERVAL=360 # Registry Check Interval - Minutes between registry lookups for new image builds (the expensive step; the local scan still refreshes every scan). 0 = never (local-only).
|
|
CFG_HOTFIX_AUTO=security-breakage # Hotfix Auto-Apply - Which signed hotfix severities apply automatically on the update check [security-breakage|all|off]
|