Releases, upgrades and rollback

Versioning

A customer release is a chart version X.Y.Z whose images carry the tag vX.Y.Z. The chart’s images pull at a fixed tag, and the model files are baked into the service images, so the version you install fixes the rules, the models and the thresholds together. The verifier additionally checks its model file against a pinned hash at start and refuses to serve on a mismatch.

What ships with a release

• Release notes, curated per release.
• A software bill of materials in CycloneDX 1.6 for every image, generated at build and validated, bundled inside the chart with a SHA256SUMS file. Rust dependencies are embedded in the binaries in auditable form. The SBOM is an inventory, not a vulnerability report.
• A release manifest listing the chart checksum, the source commit, the SBOM checksum, the digest of every image, the digest of the model sources and the third-party images.

Verifying what is running

sha256sum -c SHA256SUMS                      # the bundled SBOM files
oc -n salus get pods -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.status.containerStatuses[*].imageID}{"\n"}{end}'

Compare the running image digests with the manifest. Mirrored installs keep the same digests.

Upgrading

helm upgrade salus oci://ghcr.io/salusapp-ai/charts/salus-app --version "$NEW_VERSION" \
  --namespace salus --rollback-on-failure --wait --timeout 20m

Read the release notes first: a release may add a setting or a service (for example OCR) that you choose to enable. Database migrations run on start.

Rolling back

Back up PostgreSQL, then install the previous chart version with the same command. If you need to hold an image version while keeping the chart, set global.imageTag to the earlier tag and global.imagePullPolicy to IfNotPresent. With Compose, pin IMAGE_TAG and bring the stack up again.

Uninstalling

helm uninstall salus removes the services. Set postgres.preserveOnDelete=true before uninstalling if the vault and audit data must survive the removal of the chart.