Security Policy | APOLLO™ Data Auditor Docs

Official Distribution

APOLLO Data Auditor binaries are distributed exclusively via:
https://aiia-tech.com/download

Do not download binaries from other sources (GitHub Releases mirrors, torrents). Any binary obtained outside this channel is unverified and potentially compromised.

Lock 1 — SHA256 Checksum

Each release publishes a SHA256SUMS.txt file at https://aiia-tech.com/download/SHA256SUMS.txt.

This file is generated automatically by the CI pipeline (GitHub Actions) after each PyInstaller build, then deployed manually to the distribution server alongside the binaries.

Manual Verification Before Execution

Linux

EXPECTED=$(curl -sSL https://aiia-tech.com/download/SHA256SUMS.txt | grep "apollo-agent$" | awk '{print $1}')
ACTUAL=$(sha256sum ./apollo-agent | awk '{print $1}')
[ "$EXPECTED" = "$ACTUAL" ] && echo "OK" || echo "MISMATCH — do not execute"

macOS

EXPECTED=$(curl -sSL https://aiia-tech.com/download/SHA256SUMS.txt | grep "apollo-agent-macos$" | awk '{print $1}')
ACTUAL=$(shasum -a 256 ./apollo-agent-macos | awk '{print $1}')
[ "$EXPECTED" = "$ACTUAL" ] && echo "OK" || echo "MISMATCH — do not execute"

Windows (PowerShell)

$expected = (Invoke-WebRequest https://aiia-tech.com/download/SHA256SUMS.txt).Content `
  | Select-String "apollo-agent.exe" | ForEach-Object { $_ -split '\s+' | Select-Object -First 1 }
$actual = (Get-FileHash .\apollo-agent.exe -Algorithm SHA256).Hash.ToLower()
if ($expected -eq $actual) { "OK" } else { "MISMATCH - do not execute" }

Lock 2 — Automatic Verification via install.sh

The install.sh script integrates SHA256 verification before any installation:

curl -sSL https://aiia-tech.com/download/install.sh | bash

Behavior:

Downloads the binary from aiia-tech.com/download/apollo-agent
Downloads SHA256SUMS.txt
Compares hashes — on mismatch:

======================================================
  BINARY INTEGRITY CHECK FAILED
  Do not execute this binary.
  Contact: contact@aiia-tech.com
======================================================

On success: installs to /opt/apollo-agent/ and creates symlink /usr/local/bin/apollo-agent

Reporting a Suspect Binary

If you believe you have downloaded a corrupted or altered binary:

Do not execute the binary
Calculate its SHA256:
- Linux/macOS: sha256sum apollo-agent or shasum -a 256 apollo-agent-macos
- Windows: Get-FileHash apollo-agent.exe -Algorithm SHA256
Compare with SHA256SUMS.txt at https://aiia-tech.com/download/SHA256SUMS.txt
Contact: contact@aiia-tech.com
- Subject: [SECURITY] Suspect binary - Apollo Data Auditor vX.Y.Z
- Include: SHA256 of the binary, OS, download source

Disclosure Policy

Response within 48h to security reports
Responsible disclosure: 90 days before public disclosure
Contact: contact@aiia-tech.com

Supported Versions

Version	Supported
`1.7.R` (current)	✓ Yes
< 1.7	✗ No