Supply chain security

A self-hosted deployment receives artifacts through two paths:

Artifact	Default source	Internal control
Watcher client, installer, and checksums	Public ApolloResearch/watcher-bin releases	WATCHER_DOWNLOAD_BASE
Analyzer, API, and bootstrap images	Apollo's container registry	WATCHER_IMAGE_REGISTRY

The self-host bundle is published with the client release. Approve the bundle, client, and server images together, even if you import them through different systems.

Verify release files

Download the self-host bundle and checksums.txt from the same Watcher release, then verify the bundle before unpacking it:

grep " watcher-self-host-<version>.zip$" checksums.txt \
  | shasum -a 256 -c -

Use sha256sum -c - on systems with GNU coreutils. The installer performs the same checksum check for the client archive. A checksum detects corruption, not a compromised release channel, so use your normal approval and scanning process before copying artifacts into an internal mirror.

Keep releases compatible

Use the Compose file and server image tag from the same release. Upgrade the server before the client fleet. The public installer selects a client supported by the configured server. For an internal mirror, choose a client release the server supports.

Use internal mirrors

For the client, mirror the installer, checksums.txt, and the platform archives you use. Keep their published filenames and set WATCHER_DOWNLOAD_BASE while running the installer. Mirror-backed clients do not update automatically; replace the approved files and redeploy the client through your fleet tooling.

For the server, import the xylon-api, bootstrap, and analyzer repositories while preserving their suffixes. Set the registry and tag in .env:

WATCHER_IMAGE_REGISTRY=registry.example.com/security-approved
WATCHER_IMAGE_TAG=<tag>

The system that performs the import needs read access to the release images and write access to the internal registry. It can run outside the Watcher network. Complete that approval and import before setup; the Watcher host itself needs access only to the internal registry.

Run docker compose config --images before deployment to check that every Watcher image uses the internal registry. Apply your registry's normal signing, scanning, digest, and immutability controls.

The bundled Terraform module configures Apollo registry authentication by default: an IAM policy on the host role, and a systemd timer that refreshes the registry login every eight hours. For a mirror-only host, disable both by setting this module input and authenticate through your own registry tooling:

configure_apollo_ecr = false

The bundled Postgres image comes from Docker Hub. Mirror it separately when the host cannot reach Docker Hub, using the override in compose.override.yml.example. Do not change the Postgres major version for an existing data volume.

See Update Watcher for server and client updates.