GhostWire — desktop downloads

Signed desktop companion tools for the GhostWire / Pharoah Technology estate.

GhostWire the messenger is not here. It is a zero-identity field messenger that ships pre-installed to Pixel / GrapheneOS handsets — there is no app-store listing and no desktop download for it. This page lists the separate desktop products below.

GhostDNS v0.1.0

Privacy-first encrypted DNS resolver, policy engine and local filter. Forwards only over encrypted DoT/DoH transports, fail-closed — never a silent plaintext fallback.

Trust files for this release: SHA256SUMS · SHA256SUMS.sig.json · release-signing-key.pub.json

GhostKey v0.1.0

One place to generate, protect, use, rotate, back up and revoke your cryptographic keys — no escrow, no universal recovery key, no administrator who can open your vault.

Trust files for this release: SHA256SUMS · SHA256SUMS.sig.json · release-signing-key.pub.json

Ghostwire Vault v0.1.0

A local-first, end-to-end encrypted store for passwords, secrets, documents, identity records and files. No account, no email address, no telemetry — works fully offline.

Trust files for this release: SHA256SUMS · SHA256SUMS.sig.json · release-signing-key.pub.json

Authenticity: none of these builds are Apple- or Windows-notarised yet, so your OS will warn on first launch ("unidentified developer" / SmartScreen). That warning is expected, not a red flag — the real trust anchor is independent of the OS: every release is signed with the product's Ed25519 release-signing key, and SHA256SUMS is the record of exactly what should be inside the artifact. Verify it yourself below before you trust the warning away.

Verify a download yourself

Every release directory publishes three trust files alongside the artifact: SHA256SUMS (the hash of every file in the release), SHA256SUMS.sig.json (an Ed25519 signature over the raw bytes of SHA256SUMS), and release-signing-key.pub.json (the public key — safe to publish; the private key never leaves the signer's machine).

1. Check the artifact you downloaded matches the manifest:

shasum -a 256 "<downloaded file>"
grep "<downloaded file>" SHA256SUMS   # hash must match

2. Check SHA256SUMS itself was signed by the release key (needs only openssl + xxd, both standard on macOS/Linux — download the script or run it inline):

PUBHEX=$(grep -o '"public_key_hex"[^,}]*' release-signing-key.pub.json | sed -E 's/.*"([0-9a-f]+)"/\1/')
SIGHEX=$(grep -o '"signature_hex"[^,}]*'   SHA256SUMS.sig.json         | sed -E 's/.*"([0-9a-f]+)"/\1/')
echo -n "302a300506032b6570032100${PUBHEX}" | xxd -r -p > pub.der
xxd -r -p <<< "$SIGHEX" > sig.bin
openssl pkey -pubin -inform DER -in pub.der -outform PEM -out pub.pem
openssl pkeyutl -verify -pubin -inkey pub.pem -rawin -in SHA256SUMS -sigfile sig.bin
# -> "Signature Verified Successfully" means the manifest is authentic

If both checks pass, the file you have is byte-for-byte what the release key signed off on — independent of anything your OS says about the publisher.