19 Releases 19 Tags

RSS Feed

• v1.3.5 43e9860b41

  Compare

  Guará 1.3.5 Stable

  gitea-actions released this 2026-10-31 13:20:43 +00:00 | 0 commits to main since this release

  Added

  • One-click desktop update. The "Update now" button actually downloads, verifies (SHA-256) and installs the new version now, instead of only linking to the Releases page. Works for all three desktop packages: AppImage (atomic self-replace), .deb (dpkg -i, no new password prompt — the app is already running as root/administrator by the time you click it), and the Windows installer (silent /S install). On Linux, the app restarts itself automatically; on Windows, the installer runs silently but the app does not reopen on its own yet — start it again once the install finishes.

  Changed

  • The repository moved to the Ciberfauna organization (ciberfauna/guara, was lucasrguerra/guara). Important notice for existing installations: versions up to 1.3.4 have the old location baked into their update check; they will not find this release automatically. Download 1.3.5 once manually from the new Releases page, and future update checks will work through the new location.

  Downloads

  • Guará_1.3.5_aarch64.AppImage
    78 MiB

    2026-10-31 13:32:29 +00:00
  • Guará_1.3.5_aarch64.AppImage.sha256
    96 B

    2026-10-31 13:32:29 +00:00
  • Guará_1.3.5_amd64.AppImage
    81 MiB

    2026-10-31 13:28:45 +00:00
  • Guará_1.3.5_amd64.AppImage.sha256
    94 B

    2026-10-31 13:28:46 +00:00
  • Guará_1.3.5_amd64.deb
    5.6 MiB

    2026-10-31 13:28:46 +00:00
  • Guará_1.3.5_amd64.deb.sha256
    89 B

    2026-10-31 13:28:46 +00:00
  • Guará_1.3.5_arm64.deb
    5.4 MiB

    2026-10-31 13:32:29 +00:00
  • Guará_1.3.5_arm64.deb.sha256
    89 B

    2026-10-31 13:32:30 +00:00
  • Guará_1.3.5_x64-setup.exe
    4.8 MiB

    2026-10-31 13:33:06 +00:00
  • Guará_1.3.5_x64-setup.exe.sha256
    93 B

    2026-10-31 13:33:06 +00:00
  • guara-v1.3.5-linux-aarch64.tar.gz
    3.6 MiB

    2026-10-31 13:27:13 +00:00
  • guara-v1.3.5-linux-aarch64.tar.gz.sha256
    100 B

    2026-10-31 13:27:14 +00:00
  • guara-v1.3.5-linux-x86_64.tar.gz
    3.7 MiB

    2026-10-31 13:23:02 +00:00
  • guara-v1.3.5-linux-x86_64.tar.gz.sha256
    99 B

    2026-10-31 13:23:02 +00:00
  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• v1.3.4 21eb4eafae

  Compare

  Guará 1.3.4 Stable

  gitea-actions released this 2026-10-31 11:09:24 +00:00 | 3 commits to main since this release

  Fixed

  • Desktop app: only one window on startup. The main window used to be visible from launch, so the unprivileged instance's normal window would show, flash while the system asked for the administrator password, and only then get replaced by the elevated relaunch's window a moment later. The window now stays hidden until elevation is resolved — either already elevated, elevation failed (the window then shows the warning), or this is the already-elevated relaunched instance — so only one window ever appears, matching Sabiá.

  Downloads

  • Guará_1.3.4_aarch64.AppImage
    78 MiB

    2026-10-31 11:21:42 +00:00
  • Guará_1.3.4_amd64.AppImage
    81 MiB

    2026-10-31 11:16:08 +00:00
  • Guará_1.3.4_amd64.deb
    5.6 MiB

    2026-10-31 11:16:08 +00:00
  • Guará_1.3.4_arm64.deb
    5.4 MiB

    2026-10-31 11:21:43 +00:00
  • Guará_1.3.4_x64-setup.exe
    4.8 MiB

    2026-10-31 11:19:52 +00:00
  • guara-v1.3.4-linux-aarch64.tar.gz
    3.6 MiB

    2026-10-31 11:13:33 +00:00
  • guara-v1.3.4-linux-aarch64.tar.gz.sha256
    100 B

    2026-10-31 11:13:33 +00:00
  • guara-v1.3.4-linux-x86_64.tar.gz
    3.7 MiB

    2026-10-31 11:11:11 +00:00
  • guara-v1.3.4-linux-x86_64.tar.gz.sha256
    99 B

    2026-10-31 11:11:11 +00:00
  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• v1.3.3 803346469b

  Compare

  Guará 1.3.3 Stable

  gitea-actions released this 2026-10-31 10:13:21 +00:00 | 5 commits to main since this release

  Unified updater architecture with Sabiá: migrated from the signed tauri-plugin-updater to direct Gitea Releases API checking and self-updating with SHA-256 verification.

  Changed

  • New update mechanism: The updater was rewritten to match Sabiá's model. Updates now query the Gitea Releases API directly, verify package checksums via .sha256, and no longer rely on latest.json or minisign updater keys.
  • CLI self-update (guara update): The CLI now supports guara update (checks for new versions) and guara update --apply (downloads, verifies SHA-256 checksum, and atomically replaces the binary).
  • Desktop app notice: The desktop app checks Gitea on startup and links directly to the new release packages.
  • Important notice for existing installations: Versions up to 1.3.2 used the previous signed tauri-plugin-updater mechanism looking for latest.json. Because that mechanism has been retired, existing installs will not automatically find version 1.3.3: download version 1.3.3 once manually from Gitea Releases, and future update checks will work through the new unified mechanism.
  • Removed tauri-plugin-updater dependency, createUpdaterArtifacts configuration, and the updater (Build latest.json) CI job.

  Downloads

  • Guará_1.3.3_aarch64.AppImage
    78 MiB

    2026-10-31 10:19:54 +00:00
  • Guará_1.3.3_amd64.AppImage
    81 MiB

    2026-10-31 10:29:02 +00:00
  • Guará_1.3.3_amd64.deb
    5.6 MiB

    2026-10-31 10:29:02 +00:00
  • Guará_1.3.3_arm64.deb
    5.4 MiB

    2026-10-31 10:19:55 +00:00
  • Guará_1.3.3_x64-setup.exe
    4.8 MiB

    2026-10-31 10:38:43 +00:00
  • guara-v1.3.3-linux-aarch64.tar.gz
    3.6 MiB

    2026-10-31 10:15:57 +00:00
  • guara-v1.3.3-linux-aarch64.tar.gz.sha256
    100 B

    2026-10-31 10:15:57 +00:00
  • guara-v1.3.3-linux-x86_64.tar.gz
    3.7 MiB

    2026-10-31 10:16:48 +00:00
  • guara-v1.3.3-linux-x86_64.tar.gz.sha256
    99 B

    2026-10-31 10:16:48 +00:00
  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• v1.3.2 6328220c60

  Compare

  Guará 1.3.2 Stable

  lucasrguerra released this 2026-10-30 17:06:33 +00:00 | 14 commits to main since this release

  The project moved from GitHub to Gitea, and the update check followed it.

  Changed

  • Updates now come from Gitea. The desktop app's update card reads
    latest.json from git.lucasrguerra.dev.br instead of GitHub Releases.
    Versions up to 1.3.1 still look at GitHub, which is no longer reachable, so
    they cannot find this release: download 1.3.2 once, and later updates are
    automatic.
  • The CLI is published for Linux x86_64 and aarch64 only, built by the Gitea CI
    when a v* tag is pushed, with a .sha256 next to each package. There is
    no Windows CLI any more. The desktop app still ships for Linux (AppImage,
    .deb) and Windows (NSIS .exe, cross-compiled from Linux). There is no
    macOS build: it needs Apple's SDK and code signing, which this project's CI
    (one Linux runner) cannot provide.

  Downloads

  • Guara_1.3.2_aarch64.AppImage
    79 MiB

    2026-10-30 17:20:27 +00:00
  • Guara_1.3.2_aarch64.AppImage.sig
    436 B

    2026-10-30 17:20:27 +00:00
  • Guara_1.3.2_arm64.deb
    6.5 MiB

    2026-10-30 17:20:28 +00:00
  • Guara_1.3.2_x64-setup.exe
    5.7 MiB

    2026-10-30 17:21:24 +00:00
  • Guara_1.3.2_x64-setup.exe.sig
    432 B

    2026-10-30 17:21:24 +00:00
  • Guará_1.3.2_aarch64.AppImage
    79 MiB

    2026-10-31 00:04:38 +00:00
  • Guará_1.3.2_aarch64.AppImage.sig
    440 B

    2026-10-31 00:04:38 +00:00
  • Guará_1.3.2_amd64.AppImage
    82 MiB

    2026-10-31 00:09:27 +00:00
  • Guará_1.3.2_amd64.AppImage.sig
    436 B

    2026-10-31 00:09:27 +00:00
  • Guará_1.3.2_amd64.deb
    6.9 MiB

    2026-10-31 00:09:27 +00:00
  • Guará_1.3.2_arm64.deb
    6.6 MiB

    2026-10-31 00:04:38 +00:00
  • Guará_1.3.2_x64-setup.exe
    5.8 MiB

    2026-10-31 00:12:12 +00:00
  • Guará_1.3.2_x64-setup.exe.sig
    436 B

    2026-10-31 00:12:12 +00:00
  • guara-v1.3.2-linux-aarch64.tar.gz
    3.6 MiB

    2026-10-30 23:54:26 +00:00
  • guara-v1.3.2-linux-aarch64.tar.gz.sha256
    100 B

    2026-10-30 23:54:27 +00:00
  • guara-v1.3.2-linux-x86_64.tar.gz
    3.7 MiB

    2026-10-30 23:57:08 +00:00
  • guara-v1.3.2-linux-x86_64.tar.gz.sha256
    99 B

    2026-10-30 23:57:08 +00:00
  • latest.json
    4.5 KiB

    2026-10-31 00:22:37 +00:00
  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• v1.3.1 9c5df497a5

  Compare

  Guará 1.3.1 Stable

  lucasrguerra released this 2026-10-30 15:38:33 +00:00 | 19 commits to main since this release

  Changed

  • New official logo: the maned wolf (guará) inside the orange ring, drawn by the project's author, with a transparent background so the same art works in the light and dark themes. It replaces the old track-disc logo in the app (sidebar, top bar and home screen), the favicon, the desktop app icons and the README.
  • guara ui serves the new guara.png and guara-s.png; scripts/gerar-logo.py derives the small logo and the app icon from the official art.
  • Development: scripts/verificar.sh runs locally what the CI runs, with an optional pre-push hook (scripts/instalar-hooks.sh), and the CI no longer runs on documentation-only changes.

  Notes

  • No change to scanning, recovery, signing or any other behavior. This is the first release after the in-app updater: an app on 1.3.0 should offer Update now.
  • The screenshots in docs/img/ still show the old logo and will be redone.

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• v1.3.0 165f6a24f2

  Compare

  Guará 1.3.0 Stable

  lucasrguerra released this 2026-10-30 15:38:33 +00:00 | 29 commits to main since this release

  Added

  • Update from inside the desktop app. On startup the app asks GitHub for the release's latest.json; if there is a newer version, a card offers Update now. It downloads the package, verifies its minisign signature against the public key built into the app, installs and reopens (the AppImage is replaced in place; Windows and macOS use the installer). Installs from .deb or .rpm only show the notice. Settings can turn the startup check off and has a Check now button. The check is one HTTP request and sends nothing of yours.
  • Digital signatures (Ed25519): guara sign keygen | file | verify | recovery. With a key configured, recover and report sign the manifest and the report by themselves. guara sign recovery checks the manifest signature and the hash of every recovered file (and refuses manifest paths that leave the folder). The signature is plain Ed25519 over a documented message, so openssl verifies it too. Comparing the key fingerprint (--trust) says whose key it is; the signed time is the local clock, not a third-party timestamp.
  • Virtual disks: QCOW2 with a backing file, VMDK snapshots (parent by name or, in VirtualBox, by UUID; the child is refused if the parent's CID changed) and DMG with LZFSE chunks.
  • CI with real reference images on Linux, macOS and Windows (they were skipped before), and an XFS image deleted by the real kernel generated with sudo on the Linux runner.
  • Release pipeline: update packages are signed with a key kept in the repository's release environment (tags v* only), and latest.json is built in one step by scripts/make-latest-json.py.

  Changed

  • XFS is now 🟡. On a real XFS (v5, kernel deletion) the inode and extent list are wiped, so the metadata path finds nothing; the content of files with a recognizable structure comes back by carving, without name or folder. The earlier path only worked on simulated deletions. The name-and-folder test is kept ignored until the journal is read.
  • CI apt steps use cached .debs, a time limit per attempt and retries (they took up to 28 minutes on a slow mirror day).
  • Dependencies: ctutils 0.4.5 (RUSTSEC-2026-0385); new ed25519-compact, lzfse_rust, tauri-plugin-updater.
  • The README and ROADMAP now say the update check is the only network use by default.

  Notes

  • Versions before 1.3.0 do not have the updater: from 1.2.0, replace the AppImage by hand one last time. The first update inside the app is 1.3.0 to the next release.
  • Still missing: password-protected DMG, an identity check for VHD, VHDX and QCOW2 parents, third-party timestamps (RFC 3161), XFS journal reading, and APFS validation with real deletion (needs an image from a real Mac).
  • CLI output remains in Portuguese.

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• v1.2.0 cb38ad401a

  Compare

  Guará 1.2.0 Stable

  lucasrguerra released this 2026-10-30 15:38:32 +00:00 | 63 commits to main since this release

  Added

  • Virtual disk containers (read-only): QCOW2 (v2 and v3, compressed clusters with deflate or zstd), VMDK (sparse, streamOptimized, and text descriptors with flat and zero extents), VHD and VHDX (fixed, dynamic and differencing, following the parent chain) and DMG (UDIF with zero, raw, ADC, zlib and bzip2 chunks). They open through the same path as E01 and AFF4, so partitions, file systems and encrypted volumes work inside them. Images that would read wrong are refused with the reason: QCOW2 with a backing file or encryption, VMDK with a parent or in SEsparse, password-protected DMG, DMG with LZFSE chunks. The VHDX log is not replayed.
  • Audit trail (auditoria.jsonl, guara audit): every action on evidence (inspect, scan, recover, image, hash, search, verify, exports and sessions) is recorded with UTC time, system user, host, version and details, chained by SHA-256. guara audit --verify reports the entry where the chain breaks. Set GUARA_EXAMINER to record the examiner; passwords and keys are never written.
  • PDF report: guara report out.pdf (and the interface's report button, by file extension) writes an A4 PDF with the same sections as the HTML, using a built-in writer with the standard fonts and no new dependency. Both formats now show the audit trail status and the hash of its last entry.
  • APFS free-space map: the container's space manager (spaceman), chunk-info blocks and bitmaps are read, so deep scans of an APFS volume cover only unallocated blocks. Containers that use chunk-info address blocks fall back to the whole volume, with a warning.
  • scripts/fetch-testdata.sh also downloads the dfvfs virtual disk images used by the container tests.

  Changed

  • The APFS partition warning no longer says metadata is unsupported; it says the free-space map is read and that encrypted (FileVault) volumes need the key.
  • The interface's report dialog explains that the file extension chooses PDF or HTML.

  Notes

  • Containers were checked by hash against an independent reader (7-Zip) on real images from dfvfs and VirtualBox, including differencing VHD and VHDX; the small fixtures in tests/fixtures/vdisk run in CI.
  • APFS deletion is still tested only in simulation, so APFS stays 🟡 in the roadmap.
  • CLI output remains in Portuguese.

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• v1.1.0 cd0e647922

  Compare

  Guará 1.1.0 Stable

  lucasrguerra released this 2026-10-30 15:38:31 +00:00 | 72 commits to main since this release

  Added

  • Automated translation check (scripts/check-ui-i18n.mjs): scans the interface JS, HTML and the labels emitted by the Rust core, fails on Portuguese text without an English entry and on duplicate dictionary keys. It runs in the CI lint job.
  • Dependabot group for RustCrypto: sha2, sha1, md-5, hmac, pbkdf2, ripemd, aes, argon2, cipher and digest now arrive in one update, because their traits are only compatible when the versions move together.

  Changed

  • English interface for core messages: the most common errors from the core now have {n} patterns in the dictionary, so paths and sizes are translated too.
  • Notifications in the chosen language: the core formats scan/recovery notifications using the saved interface language (ui_lang follows lang or the system locale when unset).
  • ISO 8601 dates: EXIF, PDF and MP4 metadata dates are emitted as YYYY-MM-DDTHH:MM:SS (MP4 with Z) and formatted by the interface in the selected locale, instead of a pre-formatted Brazilian date.
  • RustCrypto on digest 0.11 / cipher 0.5: aes 0.9, sha2 0.11, sha1 0.11, md-5 0.11, hmac 0.13, pbkdf2 0.13, ripemd 0.2 and argon2 0.6. BitLocker, LUKS and FileVault 2 were checked against the reference images.
  • Release workflow: tauri-action updated to v1; the publish job restores the release name and the CHANGELOG notes after the desktop builds, so v1 cannot overwrite them.
  • Docker documentation: --device=...:r was verified with a loop device (inspect, scan, recover read; writes are refused). The SMART/SYS_RAWIO wording now states what was and was not verified.
  • Superset workspace: setup, Run and teardown were verified in real workspaces; two interfaces get different ports, and deleting a workspace stops its guara ui.

  Fixed

  • Eight duplicated keys in apps/gui/ui/i18n-en.js (the last one won silently).
  • Untranslated fragments split by inline tags, metadata labels and preview messages that the previous manual pass missed.

  Notes

  • No change to scanning or recovery logic. The encrypted-volume tests pass with GUARA_REQUIRE_FIXTURES=1.
  • CLI output remains in Portuguese.

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• v1.1.0-rc1 b4a85722a6

  Compare

  Guará 1.1.0-rc1 Pre-Release

  lucasrguerra released this 2026-10-30 15:38:31 +00:00 | 73 commits to main since this release

  Mudanças desde v1.0.1

  • release: 1.1.0 (b4a8572)

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• v1.0.1 5e43fa6d20

  Compare

  Guará 1.0.1 Stable

  lucasrguerra released this 2026-10-30 15:38:30 +00:00 | 74 commits to main since this release

  Added

  • Docker image of the command line tool (Dockerfile, docs/docker.md): for Linux hosts, servers without a desktop and forensic image files. The graphical interface is not served from the container.
  • Interface screenshots in the README and in the new docs/interface.md, taken from the real interface on a synthetic test image.
  • Superset workspace configuration (.superset/): setup, run and teardown scripts for parallel workspaces.

  Changed

  • Documentation: English is now the main language. Portuguese versions live in *.pt-BR.md and docs/pt-BR/, with a language switch at the top of each file.
  • English interface completed: scan options, the disk image dialog, metadata labels (EXIF, PDF, MP4), file kinds, disk health fields, selection counters and preview messages were still showing in Portuguese.
  • Language switch: the explorer now redraws after changing the language in Settings, so dates and month headings follow it.
  • Dependencies: getrandom 0.4 and windows-sys 0.61. GitHub Actions updated (checkout 7, setup-node 7, github-script 9).

  Fixed

  • White text on a white background in the Language and Sort drop-down lists with the dark theme (including Auto with the system in dark mode).
  • The "Format" field of the disk image dialog was translated as "Form factor" in English.

  Notes

  • No change to scanning or recovery logic. The dependency updates touch the token of the local interface server (getrandom) and the Windows device bindings (windows-sys).
  • Error messages from the core, notifications and the terminal output are still in Portuguese.

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)