🦀 Arch Security Tools

Every security tool this project can install. The first group is written from scratch in Rust by tilas01; the second is a set of well-established third-party tools packaged in the Arch repositories. Pick any combination and send it straight to the generator.

📊 Repository Statistics

Pulled live from the GitHub REST API when this page loads. No token is used and nothing is sent anywhere — the request goes from your browser straight to api.github.com.

Stars
Forks
Watchers
Open Issues
Latest Release
Asset Downloads
Loading statistics…

Releases

TagPublishedAssetsDownloads
Loading releases…

Every published binary is GPG-signed and SHA-512 hashed. Import the public key (tilas01.asc) and verify before running anything — see verification in the Wiki.

📦 Install the Whole Suite at Once

Rather than fetching and verifying five tools by hand, one installer does the lot: it downloads each binary, checks its SHA-512 hash and GPG signature, installs them, and writes hardened systemd units.

It fails closed — anything that does not verify aborts the whole run and nothing gets installed. There is no skip-verification flag. Daemons are installed but left stopped, so nothing starts watching or blocking until you have read its configuration and enabled it yourself.

curl -fsSLO https://raw.githubusercontent.com/tilas01/arch-guides-dynamic/main/scripts/install-security-suite.sh

# Always read a script before running it as root
less install-security-suite.sh

sudo bash install-security-suite.sh --all          # everything, daemons left stopped
sudo bash install-security-suite.sh --dry-run --all # show what it would do
sudo bash install-security-suite.sh --only libre-otp,anti-ducky
sudo bash install-security-suite.sh --from-source   # build with cargo instead
sudo bash install-security-suite.sh --uninstall

Read the installer on GitHub → · How it works →

🦀 tilas01's Security Suite (Rust)

🛡️ Third-Party Security Tools

Selected: 0 of mine, 0 third-party

⚠️ Several of these tools can lock you out of your own machine if misconfigured. Read what each one does, and what it cannot do, before you enable it — every tool's page has an "honest limitations" section.