Download Bulwark

Looking up the latest release…

Linux, x86_64 and arm64. Built on Ubuntu 22.04 (glibc 2.35), so it runs on Ubuntu 22.04+, Debian 12+, and Fedora 36+. Every release is installed and scan-tested in a clean container on Ubuntu 22.04, 24.04 and 26.04, Debian 12, and Fedora 41 before it ships — including the current Ubuntu LTS. The arm64 builds are compiled and tested on native arm64 machines, not emulated, and the desktop app is launched and screenshotted on both architectures before release.

Which one do I need?

Run uname -m. x86_64 (also called amd64) is a typical desktop, laptop or cloud VM; aarch64 (also called arm64) is a Raspberry Pi 4/5, an Ampere or AWS Graviton server, or a Linux VM on Apple silicon. The download buttons below give you x86_64 — arm64 links are in the code blocks beneath each one.

Desktop app

The GUI: dashboard, ClamAV scanning with real-time protection, compliance view, and scan history.

Debian / Ubuntu.debFedora / RHEL.rpmAny distroAppImage

# Debian / Ubuntu
sudo dpkg -i bulwark-desktop_*_amd64.deb        # x86_64
sudo dpkg -i bulwark-desktop_*_arm64.deb        # arm64

# Fedora / RHEL
sudo rpm -i bulwark-desktop-*.x86_64.rpm        # x86_64
sudo rpm -i bulwark-desktop-*.aarch64.rpm       # arm64

# AppImage — portable, nothing to install
chmod +x bulwark-desktop-*-x86_64.AppImage      # x86_64 (arm64: -aarch64.AppImage)
./bulwark-desktop-*-x86_64.AppImage

Direct arm64 downloads: AppImage

Snap and Flatpak — not currently available

Bulwark is not published on the Snap Store or Flathub, and installing it from either is not possible today. Both stores sandbox applications, and both restrict the host access a security auditor needs: Flathub's inclusion policy excludes system utilities used on the host, and the Snap Store's classic-confinement criteria exclude reading /etc and using pkexec — which is how Bulwark's privileged scans work.

Packaging for both exists in the repository and builds correctly, so this may change. Until it does, use the .deb, .rpm, AppImage or PPA above. Those are unconfined, so they run the complete product: privileged scans, host ClamAV integration and all.

CLI

bulwarkctl scans from a terminal — no display session, so it works over plain SSH on a headless box. Same engine and same rule pack as the GUI.

Debian / Ubuntu.debFedora / RHEL.rpmAny distrotarball

# x86_64
sudo dpkg -i bulwarkctl_*_amd64.deb    # or: sudo rpm -i bulwarkctl-*.x86_64.rpm

# arm64
sudo dpkg -i bulwarkctl_*_arm64.deb    # or: sudo rpm -i bulwarkctl-*.aarch64.rpm

bulwarkctl scan

Direct arm64 downloads: tarball

Ubuntu PPA

For Ubuntu, install from the PPA to get automatic updates via apt:

sudo add-apt-repository ppa:vietanhng/bulwark
sudo apt update
sudo apt install bulwarkctl
bulwarkctl scan

Verify your download

Every release ships a SHA256SUMS file. Check what you downloaded against it before installing:

sha256sum -c SHA256SUMS --ignore-missing

Build from source

Bulwark is Apache-2.0. If you'd rather build it yourself — see the architecture guide and contributing guide:

git clone https://github.com/vietanhdev/bulwark
cd bulwark
cargo build --release --workspace                          # engine + CLI
cd apps/bulwark-app && npm install && cargo tauri build     # desktop app