integrityz

A cross-platform filesystem integrity monitor in Zig. Baselines files with BLAKE3 and detects content, permission and metadata changes — on demand or in real time.

Zigfim · blake3 · inotify · kqueuehost monitoring source on github

Why

Detect unauthorized changes to files, permissions and metadata — tampering, malware, insider changes. A modern take on the job Tripwire and AIDE do.

How

init builds a baseline, check compares against it (optionally as JSON), watch monitors in real time.
The baseline is a compact binary database. Each record keeps a BLAKE3 content hash, a hash of canonicalized ACLs and xattrs, and — for directories — a manifest hash over the sorted children, so added or removed entries show up without rescanning content.
Real-time mode uses inotify on Linux and kqueue on macOS and the BSDs. Changes can be posted to a webhook.
Traversal runs on a worker pool with string interning and batched database I/O. A standalone HTML dashboard renders the JSON reports.

Limits

The baseline header reserves space for an Ed25519 signature, but signing isn’t implemented yet — protecting the baseline itself is the next step. No Windows support yet.

integrityz init /etc /usr/bin
integrityz check --json /etc /usr/bin
integrityz watch /etc /usr/bin

$ git clone https://github.com/zombocoder/integrityz

← all projects