The Digital Bunker: Sovereignty via Script

Build your own encryption tools with 50 lines of Bash.

Real privacy is built on transparency, not on shiny apps or black boxes. This guide gives you two auditable Bash scripts to encrypt and decrypt sensitive folders using standard GPG and AES256. No cloud, no subscription — just pure mathematics and Linux.

"Don't trust, verify."
We say that about Bitcoin nodes. We should say it about our security tools too.

Many people rely on complex apps with glossy interfaces to hide their data. But complexity is the enemy of security. Every line of code you didn't write (and can't read) is a potential security risk.

The most robust encryption often comes from tools that have been battle-tested for decades: GPG and Tar.

Below you'll find two scripts I use to secure data. They turn any folder into an encrypted .tar.gz.gpg archive. They work on your high-end Linux desktop and even on your smartphone (via Termux).

Why use scripts?

• Auditability: You can read every line. No hidden backdoors.
• Standardization: The output is standard OpenPGP. You can still decrypt it 20 years from now, even if these scripts are long gone.
• Speed: It combines archiving, compression, and encryption in a single stream.

1. The Concept

We're not reinventing the wheel. We're chaining standard tools together:

• Tar: Bundles files together.
• Gzip: Compresses them.
• GPG (AES256): Encrypts them symmetrically.

2. Part 1: The Shield (Encryption)

Save this code as a file named encrypt-folder.sh.

#!/bin/bash
# 🔒 Unified encryption script (TUXEDO + Termux)
# Output: ~/Encrypted_<folder>.tar.gz.gpg (+ .sha256)
#
# S2K hardening: SHA512 + AES256 + maximum hash effort (65011712 bytes)
# → every guess costs the maximum computation everywhere.

set -Eeuo pipefail
umask 077

read -p "📁 Please enter the folder name: " ORDNERNAME
if [ -z "${ORDNERNAME:-}" ]; then
  echo "❌ No name entered. Aborting."
  exit 1
fi

SRC="$HOME/$ORDNERNAME"
if [ ! -d "$SRC" ]; then
  echo "❌ Folder not found: $SRC"
  exit 1
fi

# Choose target path (PC vs. Termux)
if [ -d "$HOME/storage/downloads" ]; then
  # Termux storage (Android)
  OUTDIR="$HOME/storage/downloads"
else
  # TUXEDO OS / Linux Desktop
  OUTDIR="$HOME"
fi

ZIEL="$OUTDIR/Encrypted_${ORDNERNAME}.tar.gz.gpg"
if [ -f "$ZIEL" ]; then
  ZIEL="$OUTDIR/Encrypted_${ORDNERNAME}_$(date +%F_%H%M).tar.gz.gpg"
fi

echo "📦 Packing & encrypting → $ZIEL"

# Pack and encrypt in a stream (no plaintext intermediate step)
# S2K hardening:
#   --s2k-cipher-algo AES256   → encryption with AES256 (fallback if --cipher-algo is not set)
#   --s2k-digest-algo SHA512   → SHA512 as hash (stronger than the older default SHA1)
#   --s2k-count 65011712       → maximum: 65,011,712 bytes are hashed
#   --no-symkey-cache          → password is not cached in the GPG agent
tar -C "$HOME" -cf - -- "$ORDNERNAME" \
  | gzip -9 \
  | gpg --symmetric \
      --cipher-algo AES256 \
      --s2k-cipher-algo AES256 \
      --s2k-digest-algo SHA512 \
      --s2k-count 65011712 \
      --compress-level 0 \
      --no-symkey-cache \
      -o "$ZIEL"

# Checksum with relative name
( cd "$(dirname "$ZIEL")" && sha256sum "$(basename "$ZIEL")" > "$(basename "$ZIEL").sha256" )

# Optional desktop notification (Linux only)
if command -v notify-send >/dev/null 2>&1; then
  notify-send "✅ Encrypted" "Archive: $(basename "$ZIEL")"
fi

echo "✅ Done: $(basename "$ZIEL")"
echo "🧩 SHA256 file: $(basename "$ZIEL").sha256"

3. Part 2: The Key (Decryption)

The decryption script offers three modes — depending on what you need:

• [T] Write TAR (default): Writes the decrypted .tar.gz to your home directory — without unpacking.
• [E] Extract: Decrypts and extracts directly into ~/Restore/.
• [L] List: Shows the contents of the archive without writing anything.

Before that, the script checks the checksum. If it doesn't match, the script asks and aborts unless you explicitly confirm with y. The passphrase is not cached in the GPG agent.

Save this code as a file named decrypt-folder.sh.

#!/usr/bin/env bash
# decrypt-folder.sh – Decrypts <NAME>[.tar.gz].gpg from ~ or ~/Downloads.
# Modes: SHA256 check, loopback fallback, extract (E), list (L), default: write TAR (T)

set -Eeuo pipefail
umask 077
export GPG_TTY="${GPG_TTY:-$(tty 2>/dev/null || true)}"

die(){ printf "❌ %s\n" "$*" >&2; exit 1; }

# --- Input: name or path, with/without .gpg ---
NAME="${1-}"
if [ -z "$NAME" ]; then
  printf "What is the encrypted file called (without .gpg)? "
  IFS= read -r NAME
fi
[ -n "$NAME" ] || die "No name."

# If the user did pass .gpg → strip it
NAME="${NAME%.gpg}"

# Find candidate paths for the .gpg
CAND=(
  "$HOME/${NAME}.gpg"
  "$HOME/Downloads/${NAME}.gpg"
  "$PWD/${NAME}.gpg"
)
INPUT=""
for p in "${CAND[@]}"; do
  [ -f "$p" ] && INPUT="$p" && break
done
[ -n "$INPUT" ] || die "Not found: ${NAME}.gpg (in ~ or ~/Downloads)."

# Targets
OUT_TAR="$HOME/${NAME}"                                # e.g. ~/Encrypted_SAP.tar.gz
STAMP="$(date +%F_%H%M%S)"
RESTORE="$HOME/Restore/${NAME}_${STAMP}"
mkdir -p "$HOME/Restore"

# Optional SHA check (compare independent of path)
if [ -f "${INPUT}.sha256" ]; then
  echo "🔎 Checking SHA256 ..."
  exp="$(awk '{print $1}' "${INPUT}.sha256")"
  act="$(sha256sum "$INPUT" | awk '{print $1}')"
  if [ "$exp" = "$act" ]; then
    echo "✅ SHA256 OK"
  else
    echo "❌ SHA256 MISMATCH!"
    echo "   Expected:   $exp"
    echo "   Calculated: $act"
    echo "   The file differs from its checksum — damaged or altered."
    echo "   Note: the .sha256 sits next to it and is no proof of authenticity;"
    echo "   it catches transfer errors, not a deliberate swap."
    printf "   Continue anyway? [y/N] "
    read -r answer </dev/tty || answer=""
    if [[ "$answer" =~ ^[yYjJ]$ ]]; then
      echo "   ⚠️  Continuing at your explicit request."
    else
      die "Aborted because of SHA256 mismatch."
    fi
  fi
fi

# Ask for mode
printf "Mode: [T]write TAR (default) / [E]xtract / [L]ist: "
read -r -n1 MODE || true; echo
MODE=${MODE:-T}

# Helper functions (with loopback fallback)
decrypt_to_tar() {
  gpg --no-symkey-cache --decrypt "$INPUT" | tar -xz -C "$RESTORE" && return 0
  echo "⚠️  Trying loopback …"
  gpg --no-symkey-cache --pinentry-mode loopback --decrypt "$INPUT" | tar -xz -C "$RESTORE"
}
decrypt_to_file() {
  gpg --no-symkey-cache --output "$OUT_TAR" --decrypt "$INPUT" && return 0
  echo "⚠️  Trying loopback …"
  gpg --no-symkey-cache --pinentry-mode loopback --output "$OUT_TAR" --decrypt "$INPUT"
}

case "$MODE" in
  L|l)
    gpg --no-symkey-cache --decrypt "$INPUT" | tar -tz || \
    gpg --no-symkey-cache --pinentry-mode loopback --decrypt "$INPUT" | tar -tz
    ;;
  E|e)
    mkdir -p "$RESTORE"
    echo "📦 Extracting to: $RESTORE"
    decrypt_to_tar
    command -v notify-send >/dev/null && notify-send "✅ Extracted" "$RESTORE"
    echo "✅ Done: $RESTORE"
    ;;
  T|t|*)
    # Default: write decrypted .tar.gz to HOME
    [ -f "$OUT_TAR" ] && rm -f "$OUT_TAR"
    echo "📝 Writing: $OUT_TAR"
    decrypt_to_file
    command -v notify-send >/dev/null && notify-send "✅ Decrypted" "$OUT_TAR"
    echo "✅ Done: $OUT_TAR"
    ;;
esac