Linux
Release binaries with OpenSSL 3, Argon2, and the PQ master path.
Maintained containers / three runtimes
BaseFWX Authenticated containers across C++, Python, and Java
BaseFWX encrypts payloads with AES-256-GCM. Keys come from Argon2id or PBKDF2; the optional master path wraps the content key with ML-KEM. C++, Python, and Java share the portable fwxAES, b512, and pb512 variants; the compatibility reference records the C++ stream and Java packing exceptions. This portal holds the binaries, signatures, hashes, and scan reports.
FWX1magic
MODEalgorithm + KDF
KEYwrap header or salt
NONCEIV bytes
CIPHERTEXTAES-256-GCM
TAG16 bytes
Field order is schematic and widths are not to scale. fwxAES uses a fixed domain string as AAD; its format and key headers are outside the payload tag. Parsers check their structure and bounds, and release plaintext only after the payload tag verifies.
Download the CLI
One row per build. Every binary ships a detached signature and a SHA-256 sidecar.
Windows
Bundles that carry the required runtime DLLs alongside the executable.
macOS
Separate Intel and Apple Silicon builds. Same crypto stack as Linux.
Java
The JVM artifact. Reads and writes the portable fwxAES, b512, and pb512 variants.
Verify a download
Two independent checks. The signature proves who built the file, the checksum proves it arrived intact.
Detached signatures
Published for every binary in the release.
Verify
gpg --verify basefwx-linux-amd64.sig basefwx-linux-amd64
SHA-256 checksums
Every asset ships a sidecar. MD5 stays on the hash page for file identification, not for security.
Check
sha256sum -c basefwx-linux-amd64.sha256
Automated release pipeline
Artifacts are built, signed, and verified by the release workflow rather than by hand.
Stages
build → sign → verify → publish
VirusTotal reports
One submitted VirusTotal report link per release artifact. Windows links cover the executable inside each ZIP. These scans are informational and do not gate publication.
Reading a report
Engines disagree, and a binary that few people have downloaded yet often draws heuristic flags on its own.
For direct binaries and the Java archive, compare the report SHA-256 with the checksum page. A Windows report covers the inner executable, so verify its release ZIP separately with the ZIP checksum.
Documentation inventory
Container formats, runtime use, failure handling, and release checks.
Understand
Start with BaseFWX
Maintained formats, installation, recovery boundaries, and links to each runtime.
Open
BaseFWX explained
File encryption, unlock paths, portable variants, live streams, and failure handling.
Open
Security policy
Cryptographic boundaries, password work, recovery policy, plugins, and private reporting.
Open
Use
Reference
Compatibility
Portable variants, runtime exceptions, KDF limits, plugins, and retired-data recovery.
Open
Native ABI policy
The frozen plugin C boundary and the pre-stable C++ library policy.
Open
BaseFWX library manual
C++ cryptographic codec library and container family
Open
Testing
Focused checks, cross-runtime qualification, benchmark method, and supported overrides.
Open
BaseFWX 3.7.0 release notes
The 3.7.0 plugin ABI, wire tag, compatibility boundary, and upgrade notes.
Open
BaseFWX 3.6.4 release notes
KDF hardening, security-normalized benchmarks, JNI changes, and upgrade notes.
Open