Argus

Setup

Installation

Argus ships as a single, self-contained binary. Download the build for your platform, drop it on the PATH, and make sure Maven is there too. That is the whole install, in your CI job's image or on a workstation.

Requirements

  • Maven: invoked to generate the SBOM and to validate patches before publication. The same mvn you build your project with.
  • A JDK: whichever your project builds against.
  • A GitLab token: only needed to publish merge requests. Set it in GITLAB_PRIVATE_TOKEN.

You do not need Go, or any build toolchain, to run Argus. The binary is prebuilt.

Download the binary

Grab the asset for your platform from the Releases page, make it executable with chmod +x, and move it somewhere on your PATH. Each asset is named argus-<version>-<os>-<arch>, and all downloads are served from argus-assets.typecheck.io.

terminal
# Pick the asset for your platform from the latest release, e.g. linux/amd64
VERSION=4.2.1
curl -fsSL -o argus \
  "https://argus-assets.typecheck.io/v${VERSION}/argus-${VERSION}-linux-amd64"

chmod +x argus
sudo mv argus /usr/local/bin/argus

Platforms

Prebuilt binaries are published for:

  • argus-<version>-linux-amd64: most Linux servers and CI runners.
  • argus-<version>-linux-arm64: ARM Linux and Apple-silicon containers.
  • argus-<version>-darwin-arm64: Apple-silicon macOS.

These cover the common Linux and Apple-silicon targets. Need another platform? Get in touch.

Verify the install

Confirm the binary runs and prints its version:

terminal
argus version
# argus version 4.2.1

Maven on the PATH

Argus does not bundle Maven. It runs mvn as a subprocess both to build the CycloneDX SBOM and to validate generated POMs, so the same Maven you build your project with must be available:

terminal
mvn --version
java --version

Mirror releases automatically

To pull Argus into an internal artifact repository, poll https://argus-assets.typecheck.io/releases.json instead of this site. It lists every published version, newest first, and latest names the newest release. Each artifact carries its kind (binary, ci-component, diagnostic-skill, grafana-dashboards), its os and arch for binaries, its download url, its size and its sha256. Each version folder also holds a SHA256SUMS file in the format sha256sum -c reads.

The versioned files never change once published, so a mirror only needs to fetch what it has not seen. The index is refreshed on every release and cached for five minutes. Fields may be added over time; a change that breaks existing readers bumps schema.

releases.json
{
  "schema": "argus.releases/v1",
  "latest": "4.2.1",
  "releases": [
    {
      "version": "4.2.1",
      "date": "…",
      "codename": "…",
      "notes_url": "https://argus.typecheck.io/releases/4.2.1",
      "checksums_url": "https://argus-assets.typecheck.io/v4.2.1/SHA256SUMS",
      "artifacts": [
        {
          "name": "argus-4.2.1-linux-amd64",
          "kind": "binary",
          "os": "linux",
          "arch": "amd64",
          "url": "https://argus-assets.typecheck.io/v4.2.1/argus-4.2.1-linux-amd64",
          "size": 12345678,
          "sha256": "…"
        }
      ]
    }
  ]
}

A script that downloads and verifies every Linux binary of the newest release:

mirror.sh
#!/usr/bin/env bash
# Download every linux binary of the newest Argus release, verified.
set -euo pipefail
index=$(curl -fsSL https://argus-assets.typecheck.io/releases.json)
latest=$(jq -r .latest <<<"$index")
jq -r --arg v "$latest" '.releases[] | select(.version == $v) | .artifacts[]
  | select(.kind == "binary" and .os == "linux") | "\(.sha256)  \(.name) \(.url)"' <<<"$index" |
while read -r sha name url; do
  curl -fsSL -o "$name" "$url"
  echo "$sha  $name" | sha256sum -c -
done