Releases: tilas01/Unix-SIT
Release list
Unix Security Suite v2026.08.10-1638-main
Unix Security Suite — v2026.08.10-1638-main
Six independent Rust tools for hardening an Arch Linux install, plus a combined
binary. Every binary below is reproducible-built and GPG-signed.
Built from commit 92a6fea with the toolchain pinned in
security-tools/rust-toolchain.toml.
What is in this release
| Tool | What it does | Worth knowing |
|---|---|---|
libre-otp |
TOTP/HOTP second factor for boot, login and SSH, with no cloud account and no blobs. | Dual-OTP: one code verifies, one is displayed. |
anti-ducky |
Blocks BadUSB keystroke injection by watching HID timing, and captures the payload. | Enrol your own keyboards first: --enroll |
anti-evil-maid |
Hashes the boot chain so you know if it changed, and suspends LUKS so the master key leaves RAM. | --lock-now is a real boundary; a screen lock is not. |
kernel-watcher |
Filesystem monitor for infostealers touching browser profiles, SSH keys and wallets. | Runs as a daemon; logs to /var/log. |
scarecrow |
Canary tokens, sandbox spoofing, and three optional duress PINs for the login prompt. | Needs the pam_exec line to be installed or the PINs never fire. |
aur-guard |
Reads a PKGBUILD before makepkg runs it and reports what is worth reading yourself. | Read-only. Never needs root. Never says a package is safe. |
unix-security-suite |
The five daemons linked into a single binary, for people who want all of them. | aur-guard stays standalone — it never needs root. |
Install
The installer verifies each binary's SHA-512 and its GPG signature, pins the
signing key by fingerprint, and fails closed if either check does not pass.
curl -fsSL https://raw.githubusercontent.com/tilas01/unix-guides-dynamic/main/scripts/install-security-suite.sh -o install.sh
less install.sh # read it before running it as root
sudo bash install.sh # interactive picker
sudo bash install.sh --only scarecrow,aur-guardIt installs the daemons but does not enable them. Several of these can lock
you out of your own machine, which is the point of them, so arming each one is a
separate and deliberate decision you make on the machine itself.
Verify a binary yourself
Do this rather than trusting the installer, if you prefer:
gpg --recv-keys 5CC1B2BED4D05F65E9E965423AA74BEC12F3D5ED
gpg --fingerprint 5CC1B2BED4D05F65E9E965423AA74BEC12F3D5ED # compare against the repository README
gpg --verify anti-ducky.sig anti-ducky
sha512sum -c anti-ducky.sha512The signing key's UID is the bare string tilas01 — no email, deliberately.
An earlier key,
4C0383A1…, is revoked: its private half was committed to
public git history. Anything signed with it should be treated as unsigned.
Documentation
- Full wiki: https://tilas01.github.io/unix-guides-dynamic/wiki.html
- Security tools overview: https://tilas01.github.io/unix-guides-dynamic/security-tools.html
- Per-tool README, including an Honest limitations section for every one:
security-tools/<tool>/README.md
Those limitation sections are not marketing hedging. They name what each tool
cannot do — that anti-evil-maid's software hashing is not a hardware root of
trust, that anti-ducky's timing thresholds have never been measured on real
hardware, that aur-guard is a substring scanner and not a shell parser, and
that the LUKS unlock backoff is not comparable to a phone's secure element.
Read them before relying on any of this.
Changes since v2026.08.09-1333-main
Assets
anti-duckyanti-ducky.ascanti-ducky.sha256anti-ducky.sha512anti-ducky.siganti-evil-maidanti-evil-maid.ascanti-evil-maid.sha256anti-evil-maid.sha512anti-evil-maid.sigaur-guardaur-guard.ascaur-guard.sha256aur-guard.sha512aur-guard.sigkernel-watcherkernel-watcher.asckernel-watcher.sha256kernel-watcher.sha512kernel-watcher.siglibre-otplibre-otp.asclibre-otp.sha256libre-otp.sha512libre-otp.sigpi-boot-guardpi-boot-guard.ascpi-boot-guard.sha256pi-boot-guard.sha512pi-boot-guard.sigscarecrowscarecrow.ascscarecrow.sha256scarecrow.sha512scarecrow.sigunix-security-suiteunix-security-suite.ascunix-security-suite.sha256unix-security-suite.sha512unix-security-suite.sig
Each <tool> ships with a .sha512, a detached .sig, and an armoured
.asc.
Issues and suggestions are welcome: https://github.com/tilas01/unix-guides-dynamic/issues
Built with Claude Code.
Unix Security Suite v2026.08.09-1333-main
Unix Security Suite — v2026.08.09-1333-main
Six independent Rust tools for hardening an Arch Linux install, plus a combined
binary. Every binary below is reproducible-built and GPG-signed.
Built from commit 4128b44 with the toolchain pinned in
security-tools/rust-toolchain.toml.
What is in this release
| Tool | What it does | Worth knowing |
|---|---|---|
libre-otp |
TOTP/HOTP second factor for boot, login and SSH, with no cloud account and no blobs. | Dual-OTP: one code verifies, one is displayed. |
anti-ducky |
Blocks BadUSB keystroke injection by watching HID timing, and captures the payload. | Enrol your own keyboards first: --enroll |
anti-evil-maid |
Hashes the boot chain so you know if it changed, and suspends LUKS so the master key leaves RAM. | --lock-now is a real boundary; a screen lock is not. |
kernel-watcher |
Filesystem monitor for infostealers touching browser profiles, SSH keys and wallets. | Runs as a daemon; logs to /var/log. |
scarecrow |
Canary tokens, sandbox spoofing, and three optional duress PINs for the login prompt. | Needs the pam_exec line to be installed or the PINs never fire. |
aur-guard |
Reads a PKGBUILD before makepkg runs it and reports what is worth reading yourself. | Read-only. Never needs root. Never says a package is safe. |
unix-security-suite |
The five daemons linked into a single binary, for people who want all of them. | aur-guard stays standalone — it never needs root. |
Install
The installer verifies each binary's SHA-512 and its GPG signature, pins the
signing key by fingerprint, and fails closed if either check does not pass.
curl -fsSL https://raw.githubusercontent.com/tilas01/unix-guides-dynamic/main/scripts/install-security-suite.sh -o install.sh
less install.sh # read it before running it as root
sudo bash install.sh # interactive picker
sudo bash install.sh --only scarecrow,aur-guardIt installs the daemons but does not enable them. Several of these can lock
you out of your own machine, which is the point of them, so arming each one is a
separate and deliberate decision you make on the machine itself.
Verify a binary yourself
Do this rather than trusting the installer, if you prefer:
gpg --recv-keys 5CC1B2BED4D05F65E9E965423AA74BEC12F3D5ED
gpg --fingerprint 5CC1B2BED4D05F65E9E965423AA74BEC12F3D5ED # compare against the repository README
gpg --verify anti-ducky.sig anti-ducky
sha512sum -c anti-ducky.sha512The signing key's UID is the bare string tilas01 — no email, deliberately.
An earlier key,
4C0383A1…, is revoked: its private half was committed to
public git history. Anything signed with it should be treated as unsigned.
Documentation
- Full wiki: https://tilas01.github.io/unix-guides-dynamic/wiki.html
- Security tools overview: https://tilas01.github.io/unix-guides-dynamic/security-tools.html
- Per-tool README, including an Honest limitations section for every one:
security-tools/<tool>/README.md
Those limitation sections are not marketing hedging. They name what each tool
cannot do — that anti-evil-maid's software hashing is not a hardware root of
trust, that anti-ducky's timing thresholds have never been measured on real
hardware, that aur-guard is a substring scanner and not a shell parser, and
that the LUKS unlock backoff is not comparable to a phone's secure element.
Read them before relying on any of this.
Changes since v2026.08.09-1316-main
Assets
anti-duckyanti-ducky.ascanti-ducky.sha256anti-ducky.sha512anti-ducky.siganti-evil-maidanti-evil-maid.ascanti-evil-maid.sha256anti-evil-maid.sha512anti-evil-maid.sigaur-guardaur-guard.ascaur-guard.sha256aur-guard.sha512aur-guard.sigkernel-watcherkernel-watcher.asckernel-watcher.sha256kernel-watcher.sha512kernel-watcher.siglibre-otplibre-otp.asclibre-otp.sha256libre-otp.sha512libre-otp.sigpi-boot-guardpi-boot-guard.ascpi-boot-guard.sha256pi-boot-guard.sha512pi-boot-guard.sigscarecrowscarecrow.ascscarecrow.sha256scarecrow.sha512scarecrow.sigunix-security-suiteunix-security-suite.ascunix-security-suite.sha256unix-security-suite.sha512unix-security-suite.sig
Each <tool> ships with a .sha512, a detached .sig, and an armoured
.asc.
Issues and suggestions are welcome: https://github.com/tilas01/unix-guides-dynamic/issues
Built with Claude Code.
Unix Security Suite v2026.08.09-1322-main
Unix Security Suite — v2026.08.09-1322-main
Six independent Rust tools for hardening an Arch Linux install, plus a combined
binary. Every binary below is reproducible-built and GPG-signed.
Built from commit a1aaa32 with the toolchain pinned in
security-tools/rust-toolchain.toml.
What is in this release
| Tool | What it does | Worth knowing |
|---|---|---|
libre-otp |
TOTP/HOTP second factor for boot, login and SSH, with no cloud account and no blobs. | Dual-OTP: one code verifies, one is displayed. |
anti-ducky |
Blocks BadUSB keystroke injection by watching HID timing, and captures the payload. | Enrol your own keyboards first: --enroll |
anti-evil-maid |
Hashes the boot chain so you know if it changed, and suspends LUKS so the master key leaves RAM. | --lock-now is a real boundary; a screen lock is not. |
kernel-watcher |
Filesystem monitor for infostealers touching browser profiles, SSH keys and wallets. | Runs as a daemon; logs to /var/log. |
scarecrow |
Canary tokens, sandbox spoofing, and three optional duress PINs for the login prompt. | Needs the pam_exec line to be installed or the PINs never fire. |
aur-guard |
Reads a PKGBUILD before makepkg runs it and reports what is worth reading yourself. | Read-only. Never needs root. Never says a package is safe. |
unix-security-suite |
The five daemons linked into a single binary, for people who want all of them. | aur-guard stays standalone — it never needs root. |
Install
The installer verifies each binary's SHA-512 and its GPG signature, pins the
signing key by fingerprint, and fails closed if either check does not pass.
curl -fsSL https://raw.githubusercontent.com/tilas01/unix-guides-dynamic/main/scripts/install-security-suite.sh -o install.sh
less install.sh # read it before running it as root
sudo bash install.sh # interactive picker
sudo bash install.sh --only scarecrow,aur-guardIt installs the daemons but does not enable them. Several of these can lock
you out of your own machine, which is the point of them, so arming each one is a
separate and deliberate decision you make on the machine itself.
Verify a binary yourself
Do this rather than trusting the installer, if you prefer:
gpg --recv-keys 5CC1B2BED4D05F65E9E965423AA74BEC12F3D5ED
gpg --fingerprint 5CC1B2BED4D05F65E9E965423AA74BEC12F3D5ED # compare against the repository README
gpg --verify anti-ducky.sig anti-ducky
sha512sum -c anti-ducky.sha512The signing key's UID is the bare string tilas01 — no email, deliberately.
An earlier key,
4C0383A1…, is revoked: its private half was committed to
public git history. Anything signed with it should be treated as unsigned.
Documentation
- Full wiki: https://tilas01.github.io/unix-guides-dynamic/wiki.html
- Security tools overview: https://tilas01.github.io/unix-guides-dynamic/security-tools.html
- Per-tool README, including an Honest limitations section for every one:
security-tools/<tool>/README.md
Those limitation sections are not marketing hedging. They name what each tool
cannot do — that anti-evil-maid's software hashing is not a hardware root of
trust, that anti-ducky's timing thresholds have never been measured on real
hardware, that aur-guard is a substring scanner and not a shell parser, and
that the LUKS unlock backoff is not comparable to a phone's secure element.
Read them before relying on any of this.
Changes since v2026.08.09-1316-main
Assets
anti-duckyanti-ducky.ascanti-ducky.sha256anti-ducky.sha512anti-ducky.siganti-evil-maidanti-evil-maid.ascanti-evil-maid.sha256anti-evil-maid.sha512anti-evil-maid.sigaur-guardaur-guard.ascaur-guard.sha256aur-guard.sha512aur-guard.sigkernel-watcherkernel-watcher.asckernel-watcher.sha256kernel-watcher.sha512kernel-watcher.siglibre-otplibre-otp.asclibre-otp.sha256libre-otp.sha512libre-otp.sigpi-boot-guardpi-boot-guard.ascpi-boot-guard.sha256pi-boot-guard.sha512pi-boot-guard.sigscarecrowscarecrow.ascscarecrow.sha256scarecrow.sha512scarecrow.sigunix-security-suiteunix-security-suite.ascunix-security-suite.sha256unix-security-suite.sha512unix-security-suite.sig
Each <tool> ships with a .sha512, a detached .sig, and an armoured
.asc.
Issues and suggestions are welcome: https://github.com/tilas01/unix-guides-dynamic/issues
Built with Claude Code.
Unix Security Suite v2026.08.09-1316-main
Unix Security Suite — v2026.08.09-1316-main
Six independent Rust tools for hardening an Arch Linux install, plus a combined
binary. Every binary below is reproducible-built and GPG-signed.
Built from commit a009cd8 with the toolchain pinned in
security-tools/rust-toolchain.toml.
What is in this release
| Tool | What it does | Worth knowing |
|---|---|---|
libre-otp |
TOTP/HOTP second factor for boot, login and SSH, with no cloud account and no blobs. | Dual-OTP: one code verifies, one is displayed. |
anti-ducky |
Blocks BadUSB keystroke injection by watching HID timing, and captures the payload. | Enrol your own keyboards first: --enroll |
anti-evil-maid |
Hashes the boot chain so you know if it changed, and suspends LUKS so the master key leaves RAM. | --lock-now is a real boundary; a screen lock is not. |
kernel-watcher |
Filesystem monitor for infostealers touching browser profiles, SSH keys and wallets. | Runs as a daemon; logs to /var/log. |
scarecrow |
Canary tokens, sandbox spoofing, and three optional duress PINs for the login prompt. | Needs the pam_exec line to be installed or the PINs never fire. |
aur-guard |
Reads a PKGBUILD before makepkg runs it and reports what is worth reading yourself. | Read-only. Never needs root. Never says a package is safe. |
unix-security-suite |
The five daemons linked into a single binary, for people who want all of them. | aur-guard stays standalone — it never needs root. |
Install
The installer verifies each binary's SHA-512 and its GPG signature, pins the
signing key by fingerprint, and fails closed if either check does not pass.
curl -fsSL https://raw.githubusercontent.com/tilas01/unix-guides-dynamic/main/scripts/install-security-suite.sh -o install.sh
less install.sh # read it before running it as root
sudo bash install.sh # interactive picker
sudo bash install.sh --only scarecrow,aur-guardIt installs the daemons but does not enable them. Several of these can lock
you out of your own machine, which is the point of them, so arming each one is a
separate and deliberate decision you make on the machine itself.
Verify a binary yourself
Do this rather than trusting the installer, if you prefer:
gpg --recv-keys 5CC1B2BED4D05F65E9E965423AA74BEC12F3D5ED
gpg --fingerprint 5CC1B2BED4D05F65E9E965423AA74BEC12F3D5ED # compare against the repository README
gpg --verify anti-ducky.sig anti-ducky
sha512sum -c anti-ducky.sha512The signing key's UID is the bare string tilas01 — no email, deliberately.
An earlier key,
4C0383A1…, is revoked: its private half was committed to
public git history. Anything signed with it should be treated as unsigned.
Documentation
- Full wiki: https://tilas01.github.io/unix-guides-dynamic/wiki.html
- Security tools overview: https://tilas01.github.io/unix-guides-dynamic/security-tools.html
- Per-tool README, including an Honest limitations section for every one:
security-tools/<tool>/README.md
Those limitation sections are not marketing hedging. They name what each tool
cannot do — that anti-evil-maid's software hashing is not a hardware root of
trust, that anti-ducky's timing thresholds have never been measured on real
hardware, that aur-guard is a substring scanner and not a shell parser, and
that the LUKS unlock backoff is not comparable to a phone's secure element.
Read them before relying on any of this.
Changes since v2026.08.08-1455-main
Assets
anti-duckyanti-ducky.ascanti-ducky.sha256anti-ducky.sha512anti-ducky.siganti-evil-maidanti-evil-maid.ascanti-evil-maid.sha256anti-evil-maid.sha512anti-evil-maid.sigaur-guardaur-guard.ascaur-guard.sha256aur-guard.sha512aur-guard.sigkernel-watcherkernel-watcher.asckernel-watcher.sha256kernel-watcher.sha512kernel-watcher.siglibre-otplibre-otp.asclibre-otp.sha256libre-otp.sha512libre-otp.sigpi-boot-guardpi-boot-guard.ascpi-boot-guard.sha256pi-boot-guard.sha512pi-boot-guard.sigscarecrowscarecrow.ascscarecrow.sha256scarecrow.sha512scarecrow.sigunix-security-suiteunix-security-suite.ascunix-security-suite.sha256unix-security-suite.sha512unix-security-suite.sig
Each <tool> ships with a .sha512, a detached .sig, and an armoured
.asc.
Issues and suggestions are welcome: https://github.com/tilas01/unix-guides-dynamic/issues
Built with Claude Code.
Unix Security Suite v2026.08.08-1455-main
Unix Security Suite — v2026.08.08-1455-main
Six independent Rust tools for hardening an Arch Linux install, plus a combined
binary. Every binary below is reproducible-built and GPG-signed.
Built from commit 5c09c25 with the toolchain pinned in
security-tools/rust-toolchain.toml.
What is in this release
| Tool | What it does | Worth knowing |
|---|---|---|
libre-otp |
TOTP/HOTP second factor for boot, login and SSH, with no cloud account and no blobs. | Dual-OTP: one code verifies, one is displayed. |
anti-ducky |
Blocks BadUSB keystroke injection by watching HID timing, and captures the payload. | Enrol your own keyboards first: --enroll |
anti-evil-maid |
Hashes the boot chain so you know if it changed, and suspends LUKS so the master key leaves RAM. | --lock-now is a real boundary; a screen lock is not. |
kernel-watcher |
Filesystem monitor for infostealers touching browser profiles, SSH keys and wallets. | Runs as a daemon; logs to /var/log. |
scarecrow |
Canary tokens, sandbox spoofing, and three optional duress PINs for the login prompt. | Needs the pam_exec line to be installed or the PINs never fire. |
aur-guard |
Reads a PKGBUILD before makepkg runs it and reports what is worth reading yourself. | Read-only. Never needs root. Never says a package is safe. |
unix-security-suite |
The five daemons linked into a single binary, for people who want all of them. | aur-guard stays standalone — it never needs root. |
Install
The installer verifies each binary's SHA-512 and its GPG signature, pins the
signing key by fingerprint, and fails closed if either check does not pass.
curl -fsSL https://raw.githubusercontent.com/tilas01/unix-guides-dynamic/main/scripts/install-security-suite.sh -o install.sh
less install.sh # read it before running it as root
sudo bash install.sh # interactive picker
sudo bash install.sh --only scarecrow,aur-guardIt installs the daemons but does not enable them. Several of these can lock
you out of your own machine, which is the point of them, so arming each one is a
separate and deliberate decision you make on the machine itself.
Verify a binary yourself
Do this rather than trusting the installer, if you prefer:
gpg --recv-keys 5CC1B2BED4D05F65E9E965423AA74BEC12F3D5ED
gpg --fingerprint 5CC1B2BED4D05F65E9E965423AA74BEC12F3D5ED # compare against the repository README
gpg --verify anti-ducky.sig anti-ducky
sha512sum -c anti-ducky.sha512The signing key's UID is the bare string tilas01 — no email, deliberately.
An earlier key,
4C0383A1…, is revoked: its private half was committed to
public git history. Anything signed with it should be treated as unsigned.
Documentation
- Full wiki: https://tilas01.github.io/unix-guides-dynamic/wiki.html
- Security tools overview: https://tilas01.github.io/unix-guides-dynamic/security-tools.html
- Per-tool README, including an Honest limitations section for every one:
security-tools/<tool>/README.md
Those limitation sections are not marketing hedging. They name what each tool
cannot do — that anti-evil-maid's software hashing is not a hardware root of
trust, that anti-ducky's timing thresholds have never been measured on real
hardware, that aur-guard is a substring scanner and not a shell parser, and
that the LUKS unlock backoff is not comparable to a phone's secure element.
Read them before relying on any of this.
Changes since v2026.08.08-1444-main
Assets
anti-duckyanti-ducky.ascanti-ducky.sha256anti-ducky.sha512anti-ducky.siganti-evil-maidanti-evil-maid.ascanti-evil-maid.sha256anti-evil-maid.sha512anti-evil-maid.sigaur-guardaur-guard.ascaur-guard.sha256aur-guard.sha512aur-guard.sigkernel-watcherkernel-watcher.asckernel-watcher.sha256kernel-watcher.sha512kernel-watcher.siglibre-otplibre-otp.asclibre-otp.sha256libre-otp.sha512libre-otp.sigpi-boot-guardpi-boot-guard.ascpi-boot-guard.sha256pi-boot-guard.sha512pi-boot-guard.sigscarecrowscarecrow.ascscarecrow.sha256scarecrow.sha512scarecrow.sigunix-security-suiteunix-security-suite.ascunix-security-suite.sha256unix-security-suite.sha512unix-security-suite.sig
Each <tool> ships with a .sha512, a detached .sig, and an armoured
.asc.
Issues and suggestions are welcome: https://github.com/tilas01/unix-guides-dynamic/issues
Built with Claude Code.
Unix Security Suite v2026.08.08-1444-main
Unix Security Suite — v2026.08.08-1444-main
Six independent Rust tools for hardening an Arch Linux install, plus a combined
binary. Every binary below is reproducible-built and GPG-signed.
Built from commit 436d387 with the toolchain pinned in
security-tools/rust-toolchain.toml.
What is in this release
| Tool | What it does | Worth knowing |
|---|---|---|
libre-otp |
TOTP/HOTP second factor for boot, login and SSH, with no cloud account and no blobs. | Dual-OTP: one code verifies, one is displayed. |
anti-ducky |
Blocks BadUSB keystroke injection by watching HID timing, and captures the payload. | Enrol your own keyboards first: --enroll |
anti-evil-maid |
Hashes the boot chain so you know if it changed, and suspends LUKS so the master key leaves RAM. | --lock-now is a real boundary; a screen lock is not. |
kernel-watcher |
Filesystem monitor for infostealers touching browser profiles, SSH keys and wallets. | Runs as a daemon; logs to /var/log. |
scarecrow |
Canary tokens, sandbox spoofing, and three optional duress PINs for the login prompt. | Needs the pam_exec line to be installed or the PINs never fire. |
aur-guard |
Reads a PKGBUILD before makepkg runs it and reports what is worth reading yourself. | Read-only. Never needs root. Never says a package is safe. |
unix-security-suite |
The five daemons linked into a single binary, for people who want all of them. | aur-guard stays standalone — it never needs root. |
Install
The installer verifies each binary's SHA-512 and its GPG signature, pins the
signing key by fingerprint, and fails closed if either check does not pass.
curl -fsSL https://raw.githubusercontent.com/tilas01/unix-guides-dynamic/main/scripts/install-security-suite.sh -o install.sh
less install.sh # read it before running it as root
sudo bash install.sh # interactive picker
sudo bash install.sh --only scarecrow,aur-guardIt installs the daemons but does not enable them. Several of these can lock
you out of your own machine, which is the point of them, so arming each one is a
separate and deliberate decision you make on the machine itself.
Verify a binary yourself
Do this rather than trusting the installer, if you prefer:
gpg --recv-keys 5CC1B2BED4D05F65E9E965423AA74BEC12F3D5ED
gpg --fingerprint 5CC1B2BED4D05F65E9E965423AA74BEC12F3D5ED # compare against the repository README
gpg --verify anti-ducky.sig anti-ducky
sha512sum -c anti-ducky.sha512The signing key's UID is the bare string tilas01 — no email, deliberately.
An earlier key,
4C0383A1…, is revoked: its private half was committed to
public git history. Anything signed with it should be treated as unsigned.
Documentation
- Full wiki: https://tilas01.github.io/unix-guides-dynamic/wiki.html
- Security tools overview: https://tilas01.github.io/unix-guides-dynamic/security-tools.html
- Per-tool README, including an Honest limitations section for every one:
security-tools/<tool>/README.md
Those limitation sections are not marketing hedging. They name what each tool
cannot do — that anti-evil-maid's software hashing is not a hardware root of
trust, that anti-ducky's timing thresholds have never been measured on real
hardware, that aur-guard is a substring scanner and not a shell parser, and
that the LUKS unlock backoff is not comparable to a phone's secure element.
Read them before relying on any of this.
Changes since v2026.08.08-1433-main
Assets
anti-duckyanti-ducky.ascanti-ducky.sha256anti-ducky.sha512anti-ducky.siganti-evil-maidanti-evil-maid.ascanti-evil-maid.sha256anti-evil-maid.sha512anti-evil-maid.sigaur-guardaur-guard.ascaur-guard.sha256aur-guard.sha512aur-guard.sigkernel-watcherkernel-watcher.asckernel-watcher.sha256kernel-watcher.sha512kernel-watcher.siglibre-otplibre-otp.asclibre-otp.sha256libre-otp.sha512libre-otp.sigpi-boot-guardpi-boot-guard.ascpi-boot-guard.sha256pi-boot-guard.sha512pi-boot-guard.sigscarecrowscarecrow.ascscarecrow.sha256scarecrow.sha512scarecrow.sigunix-security-suiteunix-security-suite.ascunix-security-suite.sha256unix-security-suite.sha512unix-security-suite.sig
Each <tool> ships with a .sha512, a detached .sig, and an armoured
.asc.
Issues and suggestions are welcome: https://github.com/tilas01/unix-guides-dynamic/issues
Built with Claude Code.
Unix Security Suite v2026.08.08-1433-main
Unix Security Suite — v2026.08.08-1433-main
Six independent Rust tools for hardening an Arch Linux install, plus a combined
binary. Every binary below is reproducible-built and GPG-signed.
Built from commit 0468397 with the toolchain pinned in
security-tools/rust-toolchain.toml.
What is in this release
| Tool | What it does | Worth knowing |
|---|---|---|
libre-otp |
TOTP/HOTP second factor for boot, login and SSH, with no cloud account and no blobs. | Dual-OTP: one code verifies, one is displayed. |
anti-ducky |
Blocks BadUSB keystroke injection by watching HID timing, and captures the payload. | Enrol your own keyboards first: --enroll |
anti-evil-maid |
Hashes the boot chain so you know if it changed, and suspends LUKS so the master key leaves RAM. | --lock-now is a real boundary; a screen lock is not. |
kernel-watcher |
Filesystem monitor for infostealers touching browser profiles, SSH keys and wallets. | Runs as a daemon; logs to /var/log. |
scarecrow |
Canary tokens, sandbox spoofing, and three optional duress PINs for the login prompt. | Needs the pam_exec line to be installed or the PINs never fire. |
aur-guard |
Reads a PKGBUILD before makepkg runs it and reports what is worth reading yourself. | Read-only. Never needs root. Never says a package is safe. |
unix-security-suite |
The five daemons linked into a single binary, for people who want all of them. | aur-guard stays standalone — it never needs root. |
Install
The installer verifies each binary's SHA-512 and its GPG signature, pins the
signing key by fingerprint, and fails closed if either check does not pass.
curl -fsSL https://raw.githubusercontent.com/tilas01/unix-guides-dynamic/main/scripts/install-security-suite.sh -o install.sh
less install.sh # read it before running it as root
sudo bash install.sh # interactive picker
sudo bash install.sh --only scarecrow,aur-guardIt installs the daemons but does not enable them. Several of these can lock
you out of your own machine, which is the point of them, so arming each one is a
separate and deliberate decision you make on the machine itself.
Verify a binary yourself
Do this rather than trusting the installer, if you prefer:
gpg --recv-keys 5CC1B2BED4D05F65E9E965423AA74BEC12F3D5ED
gpg --fingerprint 5CC1B2BED4D05F65E9E965423AA74BEC12F3D5ED # compare against the repository README
gpg --verify anti-ducky.sig anti-ducky
sha512sum -c anti-ducky.sha512The signing key's UID is the bare string tilas01 — no email, deliberately.
An earlier key,
4C0383A1…, is revoked: its private half was committed to
public git history. Anything signed with it should be treated as unsigned.
Documentation
- Full wiki: https://tilas01.github.io/unix-guides-dynamic/wiki.html
- Security tools overview: https://tilas01.github.io/unix-guides-dynamic/security-tools.html
- Per-tool README, including an Honest limitations section for every one:
security-tools/<tool>/README.md
Those limitation sections are not marketing hedging. They name what each tool
cannot do — that anti-evil-maid's software hashing is not a hardware root of
trust, that anti-ducky's timing thresholds have never been measured on real
hardware, that aur-guard is a substring scanner and not a shell parser, and
that the LUKS unlock backoff is not comparable to a phone's secure element.
Read them before relying on any of this.
Changes since v2026.08.07-1858-main
- Give each system its own install model, and rename the suite for what it targets
- Add pi-boot-guard: Raspberry Pi boot integrity, reported honestly
- Teach the suite installer which system it is running on
- Call them Install Guides
Assets
anti-duckyanti-ducky.ascanti-ducky.sha256anti-ducky.sha512anti-ducky.siganti-evil-maidanti-evil-maid.ascanti-evil-maid.sha256anti-evil-maid.sha512anti-evil-maid.sigaur-guardaur-guard.ascaur-guard.sha256aur-guard.sha512aur-guard.sigkernel-watcherkernel-watcher.asckernel-watcher.sha256kernel-watcher.sha512kernel-watcher.siglibre-otplibre-otp.asclibre-otp.sha256libre-otp.sha512libre-otp.sigpi-boot-guardpi-boot-guard.ascpi-boot-guard.sha256pi-boot-guard.sha512pi-boot-guard.sigscarecrowscarecrow.ascscarecrow.sha256scarecrow.sha512scarecrow.sigunix-security-suiteunix-security-suite.ascunix-security-suite.sha256unix-security-suite.sha512unix-security-suite.sig
Each <tool> ships with a .sha512, a detached .sig, and an armoured
.asc.
Issues and suggestions are welcome: https://github.com/tilas01/unix-guides-dynamic/issues
Built with Claude Code.
Unix Security Suite v2026.08.08-1420-main
Unix Security Suite — v2026.08.08-1420-main
Six independent Rust tools for hardening an Arch Linux install, plus a combined
binary. Every binary below is reproducible-built and GPG-signed.
Built from commit 8a1ce0b with the toolchain pinned in
security-tools/rust-toolchain.toml.
What is in this release
| Tool | What it does | Worth knowing |
|---|---|---|
libre-otp |
TOTP/HOTP second factor for boot, login and SSH, with no cloud account and no blobs. | Dual-OTP: one code verifies, one is displayed. |
anti-ducky |
Blocks BadUSB keystroke injection by watching HID timing, and captures the payload. | Enrol your own keyboards first: --enroll |
anti-evil-maid |
Hashes the boot chain so you know if it changed, and suspends LUKS so the master key leaves RAM. | --lock-now is a real boundary; a screen lock is not. |
kernel-watcher |
Filesystem monitor for infostealers touching browser profiles, SSH keys and wallets. | Runs as a daemon; logs to /var/log. |
scarecrow |
Canary tokens, sandbox spoofing, and three optional duress PINs for the login prompt. | Needs the pam_exec line to be installed or the PINs never fire. |
aur-guard |
Reads a PKGBUILD before makepkg runs it and reports what is worth reading yourself. | Read-only. Never needs root. Never says a package is safe. |
unix-security-suite |
The five daemons linked into a single binary, for people who want all of them. | aur-guard stays standalone — it never needs root. |
Install
The installer verifies each binary's SHA-512 and its GPG signature, pins the
signing key by fingerprint, and fails closed if either check does not pass.
curl -fsSL https://raw.githubusercontent.com/tilas01/unix-guides-dynamic/main/scripts/install-security-suite.sh -o install.sh
less install.sh # read it before running it as root
sudo bash install.sh # interactive picker
sudo bash install.sh --only scarecrow,aur-guardIt installs the daemons but does not enable them. Several of these can lock
you out of your own machine, which is the point of them, so arming each one is a
separate and deliberate decision you make on the machine itself.
Verify a binary yourself
Do this rather than trusting the installer, if you prefer:
gpg --recv-keys 5CC1B2BED4D05F65E9E965423AA74BEC12F3D5ED
gpg --fingerprint 5CC1B2BED4D05F65E9E965423AA74BEC12F3D5ED # compare against the repository README
gpg --verify anti-ducky.sig anti-ducky
sha512sum -c anti-ducky.sha512The signing key's UID is the bare string tilas01 — no email, deliberately.
An earlier key,
4C0383A1…, is revoked: its private half was committed to
public git history. Anything signed with it should be treated as unsigned.
Documentation
- Full wiki: https://tilas01.github.io/unix-guides-dynamic/wiki.html
- Security tools overview: https://tilas01.github.io/unix-guides-dynamic/security-tools.html
- Per-tool README, including an Honest limitations section for every one:
security-tools/<tool>/README.md
Those limitation sections are not marketing hedging. They name what each tool
cannot do — that anti-evil-maid's software hashing is not a hardware root of
trust, that anti-ducky's timing thresholds have never been measured on real
hardware, that aur-guard is a substring scanner and not a shell parser, and
that the LUKS unlock backoff is not comparable to a phone's secure element.
Read them before relying on any of this.
Changes since v2026.08.08-1416-main
Assets
anti-duckyanti-ducky.ascanti-ducky.sha256anti-ducky.sha512anti-ducky.siganti-evil-maidanti-evil-maid.ascanti-evil-maid.sha256anti-evil-maid.sha512anti-evil-maid.sigaur-guardaur-guard.ascaur-guard.sha256aur-guard.sha512aur-guard.sigkernel-watcherkernel-watcher.asckernel-watcher.sha256kernel-watcher.sha512kernel-watcher.siglibre-otplibre-otp.asclibre-otp.sha256libre-otp.sha512libre-otp.sigpi-boot-guardpi-boot-guard.ascpi-boot-guard.sha256pi-boot-guard.sha512pi-boot-guard.sigscarecrowscarecrow.ascscarecrow.sha256scarecrow.sha512scarecrow.sigunix-security-suiteunix-security-suite.ascunix-security-suite.sha256unix-security-suite.sha512unix-security-suite.sig
Each <tool> ships with a .sha512, a detached .sig, and an armoured
.asc.
Issues and suggestions are welcome: https://github.com/tilas01/unix-guides-dynamic/issues
Built with Claude Code.
Unix Security Suite v2026.08.08-1416-main
Unix Security Suite — v2026.08.08-1416-main
Six independent Rust tools for hardening an Arch Linux install, plus a combined
binary. Every binary below is reproducible-built and GPG-signed.
Built from commit 13b2553 with the toolchain pinned in
security-tools/rust-toolchain.toml.
What is in this release
| Tool | What it does | Worth knowing |
|---|---|---|
libre-otp |
TOTP/HOTP second factor for boot, login and SSH, with no cloud account and no blobs. | Dual-OTP: one code verifies, one is displayed. |
anti-ducky |
Blocks BadUSB keystroke injection by watching HID timing, and captures the payload. | Enrol your own keyboards first: --enroll |
anti-evil-maid |
Hashes the boot chain so you know if it changed, and suspends LUKS so the master key leaves RAM. | --lock-now is a real boundary; a screen lock is not. |
kernel-watcher |
Filesystem monitor for infostealers touching browser profiles, SSH keys and wallets. | Runs as a daemon; logs to /var/log. |
scarecrow |
Canary tokens, sandbox spoofing, and three optional duress PINs for the login prompt. | Needs the pam_exec line to be installed or the PINs never fire. |
aur-guard |
Reads a PKGBUILD before makepkg runs it and reports what is worth reading yourself. | Read-only. Never needs root. Never says a package is safe. |
unix-security-suite |
The five daemons linked into a single binary, for people who want all of them. | aur-guard stays standalone — it never needs root. |
Install
The installer verifies each binary's SHA-512 and its GPG signature, pins the
signing key by fingerprint, and fails closed if either check does not pass.
curl -fsSL https://raw.githubusercontent.com/tilas01/unix-guides-dynamic/main/scripts/install-security-suite.sh -o install.sh
less install.sh # read it before running it as root
sudo bash install.sh # interactive picker
sudo bash install.sh --only scarecrow,aur-guardIt installs the daemons but does not enable them. Several of these can lock
you out of your own machine, which is the point of them, so arming each one is a
separate and deliberate decision you make on the machine itself.
Verify a binary yourself
Do this rather than trusting the installer, if you prefer:
gpg --recv-keys 5CC1B2BED4D05F65E9E965423AA74BEC12F3D5ED
gpg --fingerprint 5CC1B2BED4D05F65E9E965423AA74BEC12F3D5ED # compare against the repository README
gpg --verify anti-ducky.sig anti-ducky
sha512sum -c anti-ducky.sha512The signing key's UID is the bare string tilas01 — no email, deliberately.
An earlier key,
4C0383A1…, is revoked: its private half was committed to
public git history. Anything signed with it should be treated as unsigned.
Documentation
- Full wiki: https://tilas01.github.io/unix-guides-dynamic/wiki.html
- Security tools overview: https://tilas01.github.io/unix-guides-dynamic/security-tools.html
- Per-tool README, including an Honest limitations section for every one:
security-tools/<tool>/README.md
Those limitation sections are not marketing hedging. They name what each tool
cannot do — that anti-evil-maid's software hashing is not a hardware root of
trust, that anti-ducky's timing thresholds have never been measured on real
hardware, that aur-guard is a substring scanner and not a shell parser, and
that the LUKS unlock backoff is not comparable to a phone's secure element.
Read them before relying on any of this.
Changes since v2026.08.08-1405-main
Assets
anti-duckyanti-ducky.ascanti-ducky.sha256anti-ducky.sha512anti-ducky.siganti-evil-maidanti-evil-maid.ascanti-evil-maid.sha256anti-evil-maid.sha512anti-evil-maid.sigaur-guardaur-guard.ascaur-guard.sha256aur-guard.sha512aur-guard.sigkernel-watcherkernel-watcher.asckernel-watcher.sha256kernel-watcher.sha512kernel-watcher.siglibre-otplibre-otp.asclibre-otp.sha256libre-otp.sha512libre-otp.sigpi-boot-guardpi-boot-guard.ascpi-boot-guard.sha256pi-boot-guard.sha512pi-boot-guard.sigscarecrowscarecrow.ascscarecrow.sha256scarecrow.sha512scarecrow.sigunix-security-suiteunix-security-suite.ascunix-security-suite.sha256unix-security-suite.sha512unix-security-suite.sig
Each <tool> ships with a .sha512, a detached .sig, and an armoured
.asc.
Issues and suggestions are welcome: https://github.com/tilas01/unix-guides-dynamic/issues
Built with Claude Code.
Unix Security Suite v2026.08.08-1405-main
Unix Security Suite — v2026.08.08-1405-main
Six independent Rust tools for hardening an Arch Linux install, plus a combined
binary. Every binary below is reproducible-built and GPG-signed.
Built from commit ccfdfba with the toolchain pinned in
security-tools/rust-toolchain.toml.
What is in this release
| Tool | What it does | Worth knowing |
|---|---|---|
libre-otp |
TOTP/HOTP second factor for boot, login and SSH, with no cloud account and no blobs. | Dual-OTP: one code verifies, one is displayed. |
anti-ducky |
Blocks BadUSB keystroke injection by watching HID timing, and captures the payload. | Enrol your own keyboards first: --enroll |
anti-evil-maid |
Hashes the boot chain so you know if it changed, and suspends LUKS so the master key leaves RAM. | --lock-now is a real boundary; a screen lock is not. |
kernel-watcher |
Filesystem monitor for infostealers touching browser profiles, SSH keys and wallets. | Runs as a daemon; logs to /var/log. |
scarecrow |
Canary tokens, sandbox spoofing, and three optional duress PINs for the login prompt. | Needs the pam_exec line to be installed or the PINs never fire. |
aur-guard |
Reads a PKGBUILD before makepkg runs it and reports what is worth reading yourself. | Read-only. Never needs root. Never says a package is safe. |
unix-security-suite |
The five daemons linked into a single binary, for people who want all of them. | aur-guard stays standalone — it never needs root. |
Install
The installer verifies each binary's SHA-512 and its GPG signature, pins the
signing key by fingerprint, and fails closed if either check does not pass.
curl -fsSL https://raw.githubusercontent.com/tilas01/unix-guides-dynamic/main/scripts/install-security-suite.sh -o install.sh
less install.sh # read it before running it as root
sudo bash install.sh # interactive picker
sudo bash install.sh --only scarecrow,aur-guardIt installs the daemons but does not enable them. Several of these can lock
you out of your own machine, which is the point of them, so arming each one is a
separate and deliberate decision you make on the machine itself.
Verify a binary yourself
Do this rather than trusting the installer, if you prefer:
gpg --recv-keys 5CC1B2BED4D05F65E9E965423AA74BEC12F3D5ED
gpg --fingerprint 5CC1B2BED4D05F65E9E965423AA74BEC12F3D5ED # compare against the repository README
gpg --verify anti-ducky.sig anti-ducky
sha512sum -c anti-ducky.sha512The signing key's UID is the bare string tilas01 — no email, deliberately.
An earlier key,
4C0383A1…, is revoked: its private half was committed to
public git history. Anything signed with it should be treated as unsigned.
Documentation
- Full wiki: https://tilas01.github.io/unix-guides-dynamic/wiki.html
- Security tools overview: https://tilas01.github.io/unix-guides-dynamic/security-tools.html
- Per-tool README, including an Honest limitations section for every one:
security-tools/<tool>/README.md
Those limitation sections are not marketing hedging. They name what each tool
cannot do — that anti-evil-maid's software hashing is not a hardware root of
trust, that anti-ducky's timing thresholds have never been measured on real
hardware, that aur-guard is a substring scanner and not a shell parser, and
that the LUKS unlock backoff is not comparable to a phone's secure element.
Read them before relying on any of this.
Changes since v2026.08.08-1148-main
Assets
anti-duckyanti-ducky.ascanti-ducky.sha256anti-ducky.sha512anti-ducky.siganti-evil-maidanti-evil-maid.ascanti-evil-maid.sha256anti-evil-maid.sha512anti-evil-maid.sigaur-guardaur-guard.ascaur-guard.sha256aur-guard.sha512aur-guard.sigkernel-watcherkernel-watcher.asckernel-watcher.sha256kernel-watcher.sha512kernel-watcher.siglibre-otplibre-otp.asclibre-otp.sha256libre-otp.sha512libre-otp.sigpi-boot-guardpi-boot-guard.ascpi-boot-guard.sha256pi-boot-guard.sha512pi-boot-guard.sigscarecrowscarecrow.ascscarecrow.sha256scarecrow.sha512scarecrow.sigunix-security-suiteunix-security-suite.ascunix-security-suite.sha256unix-security-suite.sha512unix-security-suite.sig
Each <tool> ships with a .sha512, a detached .sig, and an armoured
.asc.
Issues and suggestions are welcome: https://github.com/tilas01/unix-guides-dynamic/issues
Built with Claude Code.