# DriverGuard (CLI prototype)

DriverGuard is a working file-integrity watchdog with real restore-point
copies for any critical directory — a drivers folder, a system config
folder, or anything else you point it at. It snapshots a directory by
hashing every file (SHA-256) and copying its actual current bytes into a
snapshot store, later detects exactly what changed, was removed, or was
added compared to that snapshot, and can roll back a specific file to
precisely the bytes it had at snapshot time by restoring the backup copy.
This is a genuine, working "every change is reversible" mechanism. The
full DriverGuard product concept additionally covers real Windows driver
store inventory, update-source verification, and OS-level driver rollback
via the SetupAPI — those require privileged, Windows-only APIs that a
portable, dependency-free Go CLI cannot provide, so they are not
implemented here and are tracked as roadmap items. See ../plan.md for the
full product plan.

## Build from source

Requires Go 1.24+, no external dependencies.

    go build -o driverguard .

Cross-compile for another platform:

    GOOS=windows GOARCH=amd64 go build -o driverguard.exe .
    GOOS=darwin  GOARCH=arm64 go build -o driverguard .

## Usage

    driverguard snapshot <dir> --store <storedir> [--label mylabel]

        Walks <dir> recursively (regular files only). For each file,
        computes a SHA-256 hash and copies the file's current bytes into
        the snapshot store, preserving its relative path. Writes a
        manifest.json describing the snapshot. If --label is omitted, a
        UTC timestamp (e.g. 20260810-014801) is used as the label.

    driverguard check <dir> --store <storedir> [--against <label-or-latest>] [--json]

        Compares <dir>'s CURRENT state against a specific snapshot in
        <storedir>. --against latest (the default) picks the most
        recently created snapshot; pass a specific label to compare
        against an older one. Reports:
          CHANGED - path exists in both, but its hash differs
          REMOVED - path was in the snapshot but is missing now
          ADDED   - path exists now but was not in the snapshot
        ADDED alone is informational. Exits non-zero if there are any
        CHANGED or REMOVED files.

    driverguard rollback <dir> --store <storedir> --file <relative-path> [--against <label-or-latest>] [--apply]

        Restores ONE file (identified by its path relative to <dir>) from
        the chosen snapshot's backup copy. Without --apply this is a dry
        run: it reports the current state at that path (e.g. "would
        overwrite CHANGED file" / "would recreate REMOVED file") and
        touches nothing. With --apply it copies the snapshot's backup
        bytes into place at <dir>/<relative-path>, creating parent
        directories as needed and overwriting or recreating the file. A
        path that was never part of the snapshot produces a clean error,
        not a crash.

    driverguard list --store <storedir> [--json]

        Lists every snapshot found in <storedir> with its label, creation
        time (UTC), file count, and total backed-up size.

### Snapshot storage layout

    <storedir>/
      <label>/
        manifest.json          {created_at_utc, source_dir, label,
                                 files: [{path, size, sha256}, ...]}
        files/
          <relative-path...>   real backup copy of each file's bytes
                                at snapshot time, mirroring <dir>'s
                                directory structure

## Prebuilt binaries

See ../downloads/ for prebuilt binaries (Windows/macOS/Linux) and
CHECKSUMS.txt for their SHA-256 hashes. These are unsigned indie builds —
Windows SmartScreen and macOS Gatekeeper will warn on first run, which is
expected until a code-signing certificate is in place.