Vigil Baseline

What Vigil Baseline is

Vigil Baseline is a free file integrity monitor for one Linux desktop or laptop. It records a known-good snapshot of watched files, including hashes, permissions, ownership, inode, capabilities, extended attributes, and SELinux or AppArmor context. It then watches filesystem events with kernel fanotify, falling back to inotify, and compares changes against the baseline. BLAKE3 hashing and a crash-safe write-ahead log with an HMAC-chained audit log record changes. Vigil stays silent unless a watched file changes; optional desktop notifications can use notify-send. FID-capable Linux 5.1+ kernels support real-time coverage across event classes, while scheduled scans detect some event types on older kernels. The interactive welcome configuration takes about ninety seconds and can be rerun. The vigil-baseline package is installed with apt or dnf after repository setup; signed packages and repository metadata are delivered through the package manager. The project says it has no telemetry, auto-updates, or network calls. Vigil does not kill, quarantine, or block processes or files, and is not an EDR. It is intended for a single desktop operator, not server or fleet deployment.