Download LUKSbox
Binaries for Linux, macOS, and Windows, with SHA-256 checksums and build-provenance attestations for every file.
macOS
Apple Silicon (Intel: build from source)Self-contained .dmg with libfido2 bundled using kext-free FUSE-T for mount.
Codesigned + Apple-notarised (Developer ID Application: PENTHERTZ, team 456J2U7HQL). Both builds are the same Apple-notarised .app linked against a different FUSE backend at build time; pick one. FUSE-T (default) is kext-free, no Recovery Mode dance, recommended for a Mac only you use; mount requires brew tap macos-fuse-t/homebrew-cask && brew install --cask fuse-t. Its mount is served over an unauthenticated loopback NFS connection, so another local user or process could reach it. macFUSE, recommended for shared Macs and audited setups, restricts the mount to the user who made it but ships a kernel extension: install it before the app (without macFUSE that build quits before showing a window), and Apple Silicon Macs need a one-time Recovery Mode -> Startup Security Utility -> Reduced Security opt-in plus approval in System Settings -> Privacy & Security before the kext loads. Each variant also comes as a -portable.tar.gz of the bare CLI and GUI on the release page. CLI / GUI / extract all work without either backend; only mount needs FUSE.
Linux
x86_64 | aarch64Native .deb and .rpm packages with auto-resolved deps, a GUI AppImage and a static CLI for any distribution, plus a generic tarball with an install.sh for Arch / NixOS / Alpine.
Supports TPM 2.0. Native packages pull libfido2 + libfuse3 automatically. Generic tarball requires sudo apt install libfido2-1 libfuse3-3 (Debian/Ubuntu) or sudo dnf install libfido2 fuse3-libs (Fedora/RHEL) first. AppImage: the GUI with FIDO2, TPM 2.0 and mount included; chmod +x and run, needs glibc 2.35+ (LUKSbox-aarch64.AppImage for ARM). Static CLI: one binary with nothing to install, FIDO2 and TPM 2.0 built in (luksbox-x86_64-unknown-linux-musl.tar.gz is the passphrase-only build; replace x86_64 with aarch64 for ARM); mount needs fusermount3.
Windows
x86_64 | Windows 11 22H2+Self-extracting installer that bundles WinFsp 2.x + LUKSbox in one step. Routes FIDO2 through webauthn.dll and, since v0.5.0, supports TPM 2.0 keyslots via TBS. No admin required for the GUI.
Recommended: the -setup.exe bundle chains a WinFsp 2.0.23075 install (if not already present) and then installs LUKSbox. WinFsp is the kernel-mode filesystem driver required by the Mount as volume feature; the bundle ships the upstream Authenticode-signed WinFsp MSI. Plain .msi: for admins managing WinFsp separately (GPO / Chocolatey / Intune) or for unattended deploys via msiexec /i ... /qn; install WinFsp yourself first. Portable .zip: no installer, ships winfsp-x64.dll next to luksbox.exe for launch resolution but mount still needs WinFsp's kernel driver registered system-wide (run the WinFsp MSI separately). Windows SmartScreen will warn on first launch ('Windows protected your PC') because the Windows binaries are not yet Authenticode-signed (a SignPath Foundation OV signature is wired into CI but stays disabled until the production certificate is issued); click More info -> Run anyway. Subsequent launches are silent. See the Windows install guide for the full SmartScreen explainer.
Verify your download
Every release artifact is signed via GitHub Artifact Attestations (Sigstore-backed) and hashed in SHA256SUMS.txt. The attestation proves the artifact came from the exact tagged workflow run on a GPG-signed commit, no human had a chance to swap it after the fact. Always verify before running unfamiliar binaries.
# Cryptographic provenance check (recommended). Requires the # GitHub CLI: sudo apt install gh | sudo dnf install gh | brew install gh gh attestation verify <downloaded-file> --owner penthertz # Or an offline SHA-256 check, no `gh` needed: curl -LO https://github.com/penthertz/LUKSbox/releases/latest/download/SHA256SUMS.txt sha256sum -c --ignore-missing SHA256SUMS.txt # checks the files you downloaded
Source code
The source is published on GitHub under the Apache License 2.0. OSI-approved open source - read, audit, build, modify, redistribute, even use it in a competing product. The Penthertz brand is reserved separately; see TRADEMARK.md.
git clone https://github.com/penthertz/LUKSbox.git
cd LUKSbox
cargo build --release -p luksbox-cli
See Build from source for the full toolchain requirements and how to verify a release.
Release channels
| Channel | What you get | Where |
|---|---|---|
| Stable | Tagged releases, signed binaries, audit-tracked | GitHub Releases |
| Nightly | Built from main daily; for testing only |
GitHub Actions artifacts |
| Source | The canonical truth; build it yourself | GitHub repository |
Older versions
Every published release stays on GitHub Releases indefinitely. If you need an older version for compatibility with an existing vault file, it's there.
If you're upgrading and the on-disk format changed: LUKSbox vaults are backward-compatible by design. Older format slots (V1, V2 layout) remain readable by newer versions; new vaults default to the latest format. See the changelog for per-version notes.