Guardian Suite · Verify before you install

Downloads & verification

Every Guardian Desktop release is a signed .deb published as a GitLab Release. No binaries are served from this website — this page shows you how to verify the package you download so a swapped or tampered file is caught before you install it.

The promise we keep: no client agent is "unbreachable" — it runs on your machine and can be inspected. What we guarantee is narrower and is exactly what matters: the binary you install is provably the one we built, and installing it cannot hand an attacker a foothold (dedicated non-root account, hardened systemd unit, outbound-only).

1 · Get the release

Download three files from the latest Guardian Desktop GitLab Release: the package, the checksum file, and its signature.

guardian-desktop_<version>_amd64.deb SHA256SUMS SHA256SUMS.asc

2 · Import our release signing key

One time. Confirm the fingerprint below matches the key you import.

gpg --import guardian-release-pubkey.asc gpg --fingerprint security@neuralciberguard.org

Release signing key fingerprint (also published in SECURITY.md):

This is the release/artifact key. It is distinct from the per-device JWT issuer key.

3 · Verify, then install

gpg --verify SHA256SUMS.asc SHA256SUMS # must print: Good signature sha256sum -c SHA256SUMS # must print: OK sudo dpkg -i guardian-desktop_*.deb # only if BOTH checks pass

If either check fails, do not install — the file was altered in transit or on the mirror. Contact security@neuralciberguard.org.

What gets installed

The agent runs as a dedicated non-root guardian-desktop account.
A hardened systemd unit (NoNewPrivileges, ProtectSystem=strict, syscall filtering, capability bounding, CPU/memory ceilings).
Config at /etc/guardian-desktop/agent.env (root-owned, 0640) — set your dashboard URL, enrolment token, and tenant.
Automated host isolation is OFF by default (opt-in — ADR-036).

Full install guide ships in the package at /usr/share/doc/guardian-desktop/INSTALL.md.