tools.toml

# Helix Boot — tool manifest
#
# Every ISO, portable app and the Ventoy loader itself is described here.
# `helix fetch` resolves the newest upstream release of each enabled entry,
# downloads it, and verifies it before anything touches your USB stick.
#
# Personal tweaks go in `local.toml` (git-ignored), so this file stays clean:
#
#   [overrides.hirens]
#   enabled = true
#
#   [[tool]]            # add your own entries with the same schema as below
#   name = "my-tool"
#   ...
#
# ── Schema ─────────────────────────────────────────────────────────────────
#   name        unique id (also the cache folder name)
#   title       pretty name shown in the Ventoy menu / PE app list
#   kind        "iso" | "app" | "ventoy" | "file" (copied to `dest` on the stick)
#               | "tree" (unpacked with 7-Zip into `dest`, installed once: see portableapps)
#   category    one of the [[category]] ids below (iso only)
#               icon: theme/icons/<name>.png, or your own in byo/icons/<name>.png
#   enabled     include in fetch/sync (default true)
#   source      "github" | "sourceforge" | "url" | "local"
#     github:       repo = "owner/name"   (+ optional download_template when the
#                   release has no files: "https://site/v{version}/file-{version}.iso")
#     sourceforge:  project = "name", path = "/folder"
#     url:          url = "https://..."
#     local:        path = "relative/to/repo.iso"
#   asset       list of regexes tried in order against release file names;
#               the first regex that matches anything wins
#   version     optional regex applied to the file name (capture groups joined with -)
#               (falls back to the GitHub release tag, then to the fetch date)
#   version_pin fixed version string for hand-bumped `url` sources
#   extract     optional regex: pull a matching member out of a downloaded .zip
#   entry       (apps) the .exe the PE launcher should start
#   platform    (apps) "mac": a tool for a working Mac. It goes in Mac/<name>/ instead of
#               Apps/, as downloaded (.dmg, .pkg, .zip): an unpacked .app doesn't survive exFAT
#   checksum    list of strategies, tried in order; the first that produces a
#               hash is used. The download is rejected if it doesn't match.
#       "github-digest"            sha256 GitHub records for each release asset
#       { asset = "regex" }        another asset in the same GitHub release
#       { sibling = "file" }       a file next to the download ({name} = file name)
#       { url = "https://..." }    a checksum file anywhere
#       { url = "...", regex = "…(hex)…" }  a hash shown on a web page that names the file
#       { sha256 = "hex" }         pinned hash
#       "sf-md5"                   SourceForge's own MD5 (integrity only)
#       "tofu"                     trust on first use: no upstream hash exists,
#                                  so record ours and warn if it ever changes
#                                  without a version bump
#   user_agent  "browser" for sites that refuse anything but a browser (pages and hashes)
#   ventoy_mode "wimboot" | "grub2" | "memdisk": always boot this image in that Ventoy mode
#   description short tip shown at the bottom of the Ventoy menu

[settings]
cache_dir = "~/.cache/helix-boot"
iso_root  = "ISO"
apps_root = "Apps"
mac_root  = "Mac"     # apps with platform = "mac": tools to run on a working Mac
stick_label = "HelixBoot"   # the name a new stick gets (up to 11 letters, digits, - or _); "Ventoy" is Ventoy's own
theme     = "theme"   # Ventoy boot-menu theme (folder in this repo); remove for Ventoy's default

# ── Menu categories (folder order = boot menu order) ──────────────────────
# `description` is the tip under the menu; the icon is theme/icons/cat-<id>.png.
[[category]]
id = "antivirus"
dir = "1-Antivirus"
title = "Antivirus"
description = "Scan for viruses and malware."

[[category]]
id = "imaging"
dir = "2-Backup-and-Recovery"
title = "Backup and Recovery"
description = "Image, clone and restore disks; recover deleted files."

[[category]]
id = "boot-repair"
dir = "3-Boot-Repair"
title = "Boot Repair"
description = "Fix systems that won't boot."

[[category]]
id = "diagnostics"
dir = "4-Diagnostic-Tools"
title = "Diagnostic Tools"
description = "Test RAM and disks."

[[category]]
id = "wipe"
dir = "5-Disk-Wipe"
title = "Disk Wipe"
description = "Securely erase disks. DESTROYS DATA. SSD or NVMe? Use Parted Magic's Erase Disk instead (Partition Tools)."

[[category]]
id = "live"
dir = "6-Live-Operating-Systems"
title = "Live Operating Systems"
description = "Full Windows PE desktops that run from the stick."

[[category]]
id = "partitioning"
dir = "7-Partition-Tools"
title = "Partition Tools"
description = "Resize, move, copy and repair partitions."

[[category]]
id = "password"
dir = "8-Password-Removal"
title = "Password Removal"
description = "Reset or remove Windows account passwords."

[[category]]
id = "windows"
dir = "9-Windows-Recovery"
title = "Windows Recovery"
description = "Windows setup, repair and recovery environments."

# Your own folder for OS installers (Windows, Linux...): drop ISOs into ISO/OSimages on
# the stick, e.g. with a downloader kept there. `user = true`: it's always in the menu
# config, and Ventoy shows it only once it holds a bootable image.
[[category]]
id = "images"
dir = "OSimages"
title = "OS Images"
description = "Windows and Linux installers you add yourself."
user = true

# ── Boot loader ───────────────────────────────────────────────────────────
[[tool]]
name = "ventoy"
title = "Ventoy"
kind = "ventoy"
source = "github"
repo = "ventoy/Ventoy"
asset = ['^ventoy-[\d.]+-linux\.tar\.gz$']
version = 'ventoy-([\d.]+)-linux'
windows = { asset = ['^ventoy-[\d.]+-windows\.zip$'], version = 'ventoy-([\d.]+)-windows' }
checksum = [{ asset = '^sha256\.txt$' }, "github-digest"]

# Ventoy only lists .wim boot images (WinRE, WinPE tools) when this plugin is on the
# stick. Published on its own by the Ventoy project; its 2020 release has no GitHub
# digest, so the hash is pinned.
[[tool]]
name = "ventoy-wimboot"
title = "Ventoy wimboot plugin"
kind = "file"
dest = "ventoy/ventoy_wimboot.img"
source = "github"
repo = "ventoy/wimiso"
asset = ['^ventoy_wimboot\.img$']
checksum = [{ sha256 = "05e3aadd3374737546a8545c29405933cff5325b0e26cc605da942bf41a93137" }]

# ── Live operating systems ────────────────────────────────────────────────
[[tool]]
name = "lazarus-pe"
title = "Lazarus PE (Windows 11)"
kind = "iso"
category = "live"
source = "local"
path = "pe/out/LazarusPE.iso"
description = "Your own PhoenixPE build. Portable apps load from the USB's Apps folder."

[[tool]]
name = "hirens"
title = "Hiren's BootCD PE"
kind = "iso"
category = "live"
source = "url"
url = "https://www.hirensbootcd.org/files/HBCD_PE_x64.iso"
checksum = ["tofu"]
description = "Ready-made Win11 PE with its own tool set. The Apps launcher works here too."

# ── Imaging ───────────────────────────────────────────────────────────────
[[tool]]
name = "rescuezilla"
title = "Rescuezilla"
kind = "iso"
category = "imaging"
source = "github"
repo = "rescuezilla/rescuezilla"
# Prefer the newest Ubuntu LTS base; fall back to any 64-bit build.
asset = ['64bit\.noble\.iso$', '64bit\.[a-z]+\.iso$']
version = 'rescuezilla-([\d.]+)-'
checksum = ["github-digest", { asset = '(?i)sha256' }]
description = "Point-and-click backup, restore and clone (Clonezilla-compatible)."

[[tool]]
name = "clonezilla"
title = "Clonezilla"
kind = "iso"
category = "imaging"
source = "sourceforge"
project = "clonezilla"
path = "/clonezilla_live_stable"
asset = ['^clonezilla-live-[\d.]+-\d+-amd64\.iso$']
version = 'clonezilla-live-([\d.]+-\d+)-amd64'
checksum = [{ url = "https://clonezilla.org/downloads/stable/data/CHECKSUMS.TXT" }, { sibling = "CHECKSUMS.TXT" }, "sf-md5"]
description = "Disk and partition imaging, multicast deployment, bare-metal restore."

# ── Partitioning ──────────────────────────────────────────────────────────
[[tool]]
name = "gparted"
title = "GParted Live"
kind = "iso"
category = "partitioning"
source = "sourceforge"
project = "gparted"
path = "/gparted-live-stable"
asset = ['^gparted-live-[\d.]+-\d+-amd64\.iso$']
version = 'gparted-live-([\d.]+-\d+)-amd64'
checksum = [{ url = "https://gparted.org/gparted-live/stable/CHECKSUMS.TXT" }, { sibling = "CHECKSUMS.TXT" }, "sf-md5"]
description = "Resize, move, copy and repair partitions."

# ── Diagnostics ───────────────────────────────────────────────────────────
[[tool]]
name = "memtest86plus"
title = "Memtest86+"
kind = "iso"
category = "diagnostics"
source = "github"
repo = "memtest86plus/memtest86plus"
# Releases are tagged on GitHub but the ISOs are published on memtest.org.
download_template = "https://www.memtest.org/download/v{version}/mt86plus_{version}_x86_64.iso.zip"
extract = '\.iso$'
checksum = [{ sibling = "sha512sum.txt" }, { sibling = "sha256sum.txt" }]
description = "RAM tester (UEFI and BIOS)."


# ── Secure wipe ───────────────────────────────────────────────────────────
[[tool]]
name = "shredos"
title = "ShredOS"
kind = "iso"
category = "wipe"
source = "github"
repo = "PartialVolume/shredos.x86_64"
asset = ['x86-64.*\.iso$']
version = 'shredos-([\d.]+_\d+)_x86-64_v?([\d.]+)_'
checksum = ["github-digest", { asset = '{name}\.sha(1|256)$' }]
description = "Overwrites hard drives with nwipe. Not for SSDs: use Parted Magic's Erase Disk. DESTROYS DATA."

[[tool]]
name = "dban"
title = "DBAN"
kind = "iso"
category = "wipe"
source = "sourceforge"
project = "dban"
path = "/dban"
asset = ['^dban-[\d.]+_i586\.iso$']
version = 'dban-([\d.]+)_i586'
checksum = ["sf-md5"]
description = "Darik's Boot and Nuke, for hard drives only (not SSDs). BIOS/legacy boot only. DESTROYS DATA."

# ── Boot repair ───────────────────────────────────────────────────────────
[[tool]]
name = "supergrub2"
title = "Super GRUB2 Disk"
kind = "iso"
category = "boot-repair"
source = "sourceforge"
project = "supergrub2"
path = "/"
asset = ['^supergrub2-classic-[\d.]+s\d+-multiarch-CD\.iso$']
version = 'supergrub2-classic-([\d.]+s\d+)-multiarch'
checksum = [{ sibling = "{name}.sha256" }, "sf-md5"]
description = "Finds and boots installed Linux/Windows when their bootloader is broken."

[[tool]]
name = "boot-repair-disk"
title = "Boot-Repair-Disk"
kind = "iso"
category = "boot-repair"
source = "sourceforge"
project = "boot-repair-cd"
path = "/"
asset = ['^boot-repair-disk-64bit\.iso$']
checksum = ["sf-md5"]
description = "Live desktop with one-click GRUB/boot repair."

# ── Malware scan (bootable) ───────────────────────────────────────────────
# Neither publishes checksums, so both are trust-on-first-use. Their virus
# databases are baked in: refresh.sh keeps them current.
[[tool]]
name = "kaspersky-rd"
title = "Kaspersky Rescue Disk"
kind = "iso"
category = "antivirus"
enabled = false            # Kaspersky blocks downloads from the US; enable in local.toml elsewhere
source = "url"
url = "https://rescuedisk.s.kaspersky-labs.com/updatable/2018/krd.iso"
checksum = ["tofu"]
description = "Offline malware scan and cleanup. Black screen? Pick Limited graphic mode."

[[tool]]
name = "drweb-livedisk"
title = "Dr.Web LiveDisk"
kind = "iso"
category = "antivirus"
source = "url"
url = "https://download.geo.drweb.com/pub/drweb/livedisk/drweb-livedisk-900-cd.iso"
checksum = ["tofu"]
# A 2018 Linux (4.13 kernel): boots through Ventoy, but may not start on newer PCs.
description = "Second-opinion malware scanner. Older system: may not start on newer PCs."

# ── Bring your own ────────────────────────────────────────────────────────
# Paid or licence-restricted tools the project can't download or share.
# Put your own ISO at the path shown (byo/ is git-ignored), or point `path`
# at it in local.toml. Empty slots are skipped silently.

[[tool]]
name = "macrium-reflect"
title = "Macrium Reflect Rescue"
kind = "iso"
category = "imaging"
source = "local"
byo = true
path = "byo/macrium-reflect.iso"
description = "Macrium's WinPE rescue media, made from your licensed copy."

[[tool]]
name = "aomei-backupper"
title = "AOMEI Backupper"
kind = "iso"
category = "imaging"
source = "local"
byo = true
path = "byo/aomei-backupper.iso"
description = "AOMEI's bootable WinPE media (Backupper → Tools → Create Bootable Media → ISO)."

[[tool]]
name = "easeus-todo-backup"
title = "EaseUS Todo Backup"
kind = "iso"
category = "imaging"
source = "local"
byo = true
path = "byo/easeus-todo-backup.iso"
description = "EaseUS's emergency disk (Tools → Create Emergency Disk → ISO)."

[[tool]]
name = "easeus-data-recovery"
title = "EaseUS Data Recovery Wizard"
kind = "iso"
category = "imaging"
source = "local"
byo = true
path = "byo/easeus-data-recovery.iso"
description = "EaseUS's bootable data-recovery media."

[[tool]]
name = "active-data-studio"
title = "Active@ Data Studio"
kind = "iso"
category = "imaging"
source = "local"
byo = true
path = "byo/active-data-studio.iso"
description = "Active@ Boot Disk / Data Studio ISO."

[[tool]]
name = "aomei-pa"
title = "AOMEI Partition Assistant"
kind = "iso"
category = "partitioning"
source = "local"
byo = true
path = "byo/aomei-pa.iso"
description = "AOMEI's bootable media (Make Bootable Media → ISO)."

[[tool]]
name = "paragon-hdm"
title = "Paragon Hard Disk Manager"
kind = "iso"
category = "partitioning"
source = "local"
byo = true
path = "byo/paragon-hdm.iso"
description = "Paragon's WinPE recovery media."

[[tool]]
name = "parted-magic"
title = "Parted Magic"
kind = "iso"
category = "wipe"
source = "local"
byo = true
path = "byo/parted-magic.iso"
description = "Partitioning, cloning, and Erase Disk: firmware secure erase for SSDs and NVMe drives."

[[tool]]
name = "bootit-bm"
title = "BootIt Bare Metal"
kind = "iso"
category = "partitioning"
source = "local"
byo = true
path = "byo/bootit-bm.iso"
description = "TeraByte's BootIt Bare Metal ISO. BIOS (legacy) boot only."

[[tool]]
name = "hdat2"
title = "HDAT2"
kind = "iso"
category = "diagnostics"
source = "local"
byo = true
path = "byo/hdat2.iso"
description = "Disk diagnostics and repair: SMART, surface scan, HPA/DCO. BIOS (legacy) boot only."

[[tool]]
name = "memtest86"
title = "PassMark MemTest86 Free"
kind = "iso"
category = "diagnostics"
source = "local"
byo = true
path = "byo/memtest86.img"
description = "PassMark's RAM tester (UEFI). Free, but its site blocks automated downloads: grab memtest86-usb.zip, keep the .img."

[[tool]]
name = "spinrite"
title = "SpinRite"
kind = "iso"
category = "diagnostics"
source = "local"
byo = true
path = "byo/spinrite.iso"
description = "GRC's SpinRite 6.1 ISO (SpinRite.exe → create ISO). BIOS (legacy) boot only."

[[tool]]
name = "windows11"
title = "Windows 11 Setup"
kind = "iso"
category = "windows"
source = "local"
byo = true
path = "byo/windows11.iso"
description = "Install, or Repair your computer → WinRE. Free from microsoft.com/software-download/windows11."

[[tool]]
name = "windows10"
title = "Windows 10 Setup"
kind = "iso"
category = "windows"
source = "local"
byo = true
path = "byo/windows10.iso"
description = "Install, or Repair your computer → WinRE. Free from microsoft.com/software-download/windows10."

[[tool]]
name = "ms-dart"
title = "Microsoft DaRT"
kind = "iso"
category = "windows"
source = "local"
byo = true
path = "byo/ms-dart.iso"
description = "Your DaRT recovery image (Microsoft Desktop Optimization Pack, volume licence)."

[[tool]]
name = "lockpick"
title = "Jayro's Lockpick"
kind = "iso"
category = "password"
source = "local"
byo = true
path = "byo/lockpick.iso"
description = "Windows password removal. No official download to verify; supply the ISO yourself."

[[tool]]
name = "windows-login-unlocker"
title = "Windows Login Unlocker"
kind = "iso"
category = "password"
source = "local"
byo = true
path = "byo/Windows Login Unlocker.iso"
description = "Windows password removal. No official download to verify; supply the ISO yourself."

[[tool]]
name = "pcunlocker"
title = "pcunlocker"
kind = "iso"
category = "password"
source = "local"
byo = true
path = "byo/pcunlocker.iso"
description = "Windows password removal. No official download to verify; supply the ISO yourself."

[[tool]]
name = "pcunlocker-bitlocker"
title = "pcunlocker-bitlocker"
kind = "iso"
category = "password"
source = "local"
byo = true
path = "byo/pcunlocker-bitlocker.iso"
description = "Windows password removal. No official download to verify; supply the ISO yourself."

# ── PortableApps.com Platform ─────────────────────────────────────────────
# Start.exe and PortableApps\ at the root of the stick, like MediCat. It goes on
# once; after that you add apps from its App Store and it updates them (and
# itself), so refresh.sh never overwrites or prunes it. Lazarus PE opens it at
# startup. Unpacking the installer needs 7-Zip, so the Windows app skips it.
[[tool]]
name = "portableapps"
title = "PortableApps.com Platform"
kind = "tree"
dest = ""
once = "PortableApps/PortableApps.com/PortableAppsPlatform.exe"
# The Platform draws its PortableApps.com logo over the menu's bottom-right corner, on
# top of any theme. This makes that one image transparent (same size, nothing else
# changes; the original is kept in Data), re-applied after the Platform updates itself.
hide_logo = "PortableApps/PortableApps.com/PortableAppsPlatform.exe"
# Its search box icons are near-black, lost on the dark boxes of our themes: a mid teal
# reads on dark and light boxes alike (same shape, recoloured in place).
recolor = { imgLiveSearchIcon = "2AA9BE", imgLiveSearchClose = "2AA9BE" }
drop = ['^\$PLUGINSDIR(/|$)']
source = "page"
page = "https://portableapps.com/download"
user_agent = "browser"     # portableapps.com turns away other user agents
asset = ['(?<=downloads\.sourceforge\.net/portableapps/)PortableApps\.com_Platform_Setup_[\d.]+\.paf\.exe$']
version = 'Platform_Setup_([\d.]+)\.paf'
checksum = [{ url = "https://portableapps.com/download", regex = 'SHA256 Hash ?: ?([0-9a-fA-F]{64})' }]
windows = { enabled = false }

# The Helix menu themes (portableapps/make-theme.py). The Platform's picker only
# lists its built-in themes, so they take over the last five: Modern Dark =
# Helix Purple, Retro Light = Electric, Retro Dark = Teal, Smooth Light = Orange,
# Smooth Dark = Red. Copied on every refresh, so a Platform update can't undo them.
[[tool]]
name = "portableapps-themes"
title = "PortableApps.com Helix themes"
kind = "file"
dest = "PortableApps/PortableApps.com/App/Graphics/Themes"
source = "local"
path = "portableapps/themes"
windows = { enabled = false }

# Starting settings for a new stick: opens in Helix Teal. Only written while the
# Platform has no settings of its own, so your choices are never overwritten.
[[tool]]
name = "portableapps-settings"
title = "PortableApps.com starting settings"
kind = "tree"
dest = "PortableApps/PortableApps.com/Data"
once = "PortableAppsMenu.ini"
source = "local"
path = "portableapps/settings"
windows = { enabled = false }

# ── Portable apps (loaded by Lazarus PE from USB:\Apps) ───────────────────
[[tool]]
name = "sysinternals"
title = "Sysinternals Suite"
description = "Process Explorer, Autoruns, TCPView and 70 more Microsoft tools"
kind = "app"
source = "url"
url = "https://download.sysinternals.com/files/SysinternalsSuite.zip"
entry = "procexp64.exe"
checksum = ["tofu"]

[[tool]]
name = "explorerpp"
title = "Explorer++"
description = "Tabbed file manager, handy where File Explorer is limited"
kind = "app"
source = "github"
repo = "derceg/explorerplusplus"
asset = ['explorerpp_x64\.zip$']   # no version in the file name → release tag is used
entry = "Explorer++.exe"
checksum = ["github-digest", "tofu"]

[[tool]]
name = "notepadpp"
title = "Notepad++"
description = "Text and code editor for logs, configs and scripts"
kind = "app"
source = "github"
repo = "notepad-plus-plus/notepad-plus-plus"
asset = ['^npp\.[\d.]+\.portable\.x64\.zip$']
version = 'npp\.([\d.]+)\.portable'
entry = "notepad++.exe"
checksum = ["github-digest", { asset = 'checksums\.sha256$' }]

[[tool]]
name = "crystaldiskinfo"
title = "CrystalDiskInfo"
description = "Drive health: S.M.A.R.T. status, temperature and power-on hours"
kind = "app"
source = "sourceforge"
project = "crystaldiskinfo"
path = "/"
asset = ['^CrystalDiskInfo\d[\d_]*\.zip$']
version = 'CrystalDiskInfo([\d_]+)\.zip'
entry = "DiskInfo64.exe"
checksum = ["sf-md5"]

[[tool]]
name = "crystaldiskmark"
title = "CrystalDiskMark"
description = "Drive speed test for SSDs, NVMe and hard drives"
kind = "app"
source = "sourceforge"
project = "crystaldiskmark"
path = "/"
asset = ['^CrystalDiskMark\d[\d_]*\.zip$']
version = 'CrystalDiskMark([\d_]+)\.zip'
entry = "DiskMark64.exe"
checksum = ["sf-md5"]

[[tool]]
name = "hwinfo"
title = "HWiNFO"
description = "Hardware details and live sensors: temperatures, voltages, fans"
kind = "app"
source = "sourceforge"
project = "hwinfo"
path = "/"
asset = ['^hwi_?\d+\.zip$']
version = 'hwi_?(\d+)\.zip'
entry = "HWiNFO64.exe"
checksum = ["sf-md5"]

[[tool]]
name = "testdisk"
title = "TestDisk & PhotoRec"
description = "Recover lost partitions (TestDisk) and deleted files (PhotoRec)"
kind = "app"
source = "url"
url = "https://www.cgsecurity.org/testdisk-7.2.win64.zip"   # bump by hand
version_pin = "7.2"
entry = "testdisk-7.2/qphotorec_win.exe"
checksum = ["tofu"]

[[tool]]
name = "produkey"
title = "ProduKey"
description = "Show Windows and Office product keys, also from an offline Windows"
kind = "app"
source = "url"
url = "https://www.nirsoft.net/utils/produkey-x64.zip"
entry = "ProduKey.exe"
checksum = ["tofu"]

[[tool]]
name = "diskgenius"
title = "DiskGenius Free"
description = "Partitions, file recovery, disk cloning and bad sector checks"
kind = "app"
source = "page"
page = "https://www.diskgenius.com/download.php"
asset = ['DGEng\d+_x64\.zip$']
version = 'DGEng(\d+)_x64'
entry = "DiskGenius/DiskGenius.exe"
checksum = ["tofu"]

# For the repaired Windows, not the PE: run it from the stick's launcher once the
# PC boots again, to debloat, tweak or reinstall apps. The launcher runs .ps1 files
# with PowerShell, and WinUtil asks for admin rights itself.
[[tool]]
name = "winutil"
title = "Chris Titus Tech WinUtil (run in Windows)"
description = "Chris Titus Tech's tweak, debloat and install utility; run it in Windows"
kind = "app"
source = "github"
repo = "ChrisTitusTech/winutil"
asset = ['^winutil\.ps1$']
entry = "winutil.ps1"
checksum = ["github-digest"]

# Malware scanners that run inside Lazarus PE / Hiren's from USB:\Apps.
# Single self-contained .exe files with today's definitions.
[[tool]]
name = "kvrt"
title = "Kaspersky Virus Removal Tool"
description = "Kaspersky's free on-demand malware scanner"
kind = "app"
enabled = false            # Kaspersky blocks downloads from the US; enable in local.toml elsewhere
source = "url"
url = "https://devbuilds.s.kaspersky-labs.com/devbuilds/KVRT/latest/full/KVRT.exe"
entry = "KVRT.exe"
checksum = ["tofu"]

[[tool]]
name = "msert"
title = "Microsoft Safety Scanner"
description = "Microsoft's on-demand scanner for malware"
kind = "app"
source = "url"
url = "https://go.microsoft.com/fwlink/?LinkId=212732"   # x64; expires 10 days after download
file = "msert.exe"
entry = "msert.exe"
checksum = ["tofu"]

# ── Helix Boot itself, on the stick (USB:/HelixBoot, with a README.txt) ───
# The latest released apps, so the stick can be updated, or its look changed, from any PC.
[[tool]]
name = "helixboot-exe"
title = "Helix Boot for Windows"
kind = "file"
dest = "HelixBoot/HelixBoot.exe"
source = "github"
repo = "Commanderx-code/helix-boot"
asset = ['^HelixBoot\.exe$']
checksum = ["github-digest"]

[[tool]]
name = "helixboot-sh"
title = "Helix Boot for Linux"
kind = "file"
dest = "HelixBoot/HelixBoot.sh"
source = "github"
repo = "Commanderx-code/helix-boot"
asset = ['^HelixBoot\.sh$']
checksum = ["github-digest"]

# ── Tools for a Mac (USB:/Mac, with a README.txt) ─────────────────────────
# Nothing here boots a Mac: these run on a working one, Apple silicon included. Each stays
# as downloaded (.dmg, .pkg, .zip) in Mac/<name>/; copy it to the Mac, then open it.
[[tool]]
name = "etrecheck"
title = "EtreCheck"
description = "One-click report on what is slowing or breaking a Mac; free to run, some extras paid"
kind = "app"
platform = "mac"
source = "url"
url = "https://cdn.etrecheck.com/EtreCheckPro.zip"
checksum = ["tofu"]

# OnyX is built per macOS version: pick the one matching the Mac.
[[tool]]
name = "onyx-tahoe"
title = "OnyX for macOS 26 Tahoe"
description = "Maintenance and cleaning: rebuild caches and indexes, verify the startup disk"
kind = "app"
platform = "mac"
source = "url"
url = "https://www.titanium-software.fr/download/26/OnyX.dmg"
checksum = ["tofu"]

[[tool]]
name = "onyx-sequoia"
title = "OnyX for macOS 15 Sequoia"
description = "Maintenance and cleaning: rebuild caches and indexes, verify the startup disk"
kind = "app"
platform = "mac"
source = "url"
url = "https://www.titanium-software.fr/download/15/OnyX.dmg"
checksum = ["tofu"]

[[tool]]
name = "onyx-sonoma"
title = "OnyX for macOS 14 Sonoma"
description = "Maintenance and cleaning: rebuild caches and indexes, verify the startup disk"
kind = "app"
platform = "mac"
source = "url"
url = "https://www.titanium-software.fr/download/14/OnyX.dmg"
checksum = ["tofu"]

[[tool]]
name = "malwarebytes-mac"
title = "Malwarebytes for Mac"
description = "Malware and adware scan and removal; scanning is free"
kind = "app"
platform = "mac"
source = "url"
url = "https://downloads.malwarebytes.com/file/mb-mac"
file = "Malwarebytes-Mac.pkg"
checksum = ["tofu"]

[[tool]]
name = "knockknock"
title = "KnockKnock"
description = "Objective-See: lists everything set to start by itself, to spot persistent malware"
kind = "app"
platform = "mac"
source = "github"
repo = "objective-see/KnockKnock"
asset = ['^KnockKnock_[\d.]+\.zip$']
checksum = ["github-digest"]

[[tool]]
name = "taskexplorer"
title = "TaskExplorer"
description = "Objective-See: running processes with their signatures, open files and connections"
kind = "app"
platform = "mac"
source = "github"
repo = "objective-see/TaskExplorer"
asset = ['^TaskExplorer_[\d.]+\.zip$']
checksum = ["github-digest"]

[[tool]]
name = "lulu"
title = "LuLu"
description = "Objective-See: free firewall that asks before a program connects out"
kind = "app"
platform = "mac"
source = "github"
repo = "objective-see/LuLu"
asset = ['^LuLu_[\d.]+\.dmg$']
checksum = ["github-digest"]

[[tool]]
name = "grandperspective"
title = "GrandPerspective"
description = "Shows what is filling a disk, as a map of blocks"
kind = "app"
platform = "mac"
source = "sourceforge"
project = "grandperspectiv"
path = "/grandperspective"
asset = ['^GrandPerspective-[\d_]+\.dmg$']
version = 'GrandPerspective-([\d_]+)\.dmg'
checksum = ["sf-md5"]

[[tool]]
name = "testdisk-mac"
title = "TestDisk & PhotoRec for Mac"
description = "Recover lost partitions (TestDisk) and deleted files (PhotoRec); Intel build, runs under Rosetta"
kind = "app"
platform = "mac"
source = "url"
url = "https://www.cgsecurity.org/testdisk-7.2.mac_intel_x86_64.tar.bz2"   # bump by hand
version_pin = "7.2"
checksum = ["tofu"]

[[tool]]
name = "coconutbattery"
title = "coconutBattery"
description = "Battery health, cycle count and age, for the Mac and a connected iPhone or iPad"
kind = "app"
platform = "mac"
source = "url"
url = "https://coconut-flavour.com/downloads/coconutBattery_latest.zip"
checksum = ["tofu"]

[[tool]]
name = "stats"
title = "Stats"
description = "Menu bar monitor: CPU, memory, disks, temperatures and fan speeds"
kind = "app"
platform = "mac"
source = "github"
repo = "exelban/stats"
asset = ['^Stats\.dmg$']
checksum = ["github-digest"]

[[tool]]
name = "macs-fan-control"
title = "Macs Fan Control"
description = "Read every temperature sensor and set fan speeds by hand; the free edition"
kind = "app"
platform = "mac"
source = "github"
repo = "crystalidea/macs-fan-control"
asset = ['^macsfancontrol\.zip$']
checksum = ["github-digest"]

[[tool]]
name = "appcleaner"
title = "AppCleaner"
description = "Uninstall an app together with the files it left around the system"
kind = "app"
platform = "mac"
source = "page"
page = "https://freemacsoft.net/appcleaner/"
asset = ['AppCleaner_[\d.]+\.zip$']
version = 'AppCleaner_([\d.]+)\.zip'
checksum = ["tofu"]

[[tool]]
name = "superduper"
title = "SuperDuper!"
description = "Clone a Mac's disk to another drive; full copies are free"
kind = "app"
platform = "mac"
source = "url"
url = "https://www.shirt-pocket.com/downloads/SuperDuper!.dmg"
file = "SuperDuper.dmg"
checksum = ["tofu"]

[[tool]]
name = "mist"
title = "Mist"
description = "Download macOS installers and firmware, and make a bootable macOS installer"
kind = "app"
platform = "mac"
source = "github"
repo = "ninxsoft/Mist"
asset = ['^Mist\.[\d.]+\.dmg$']
checksum = ["github-digest"]

[[tool]]
name = "opencore-legacy-patcher"
title = "OpenCore Legacy Patcher"
description = "Install a newer macOS than Apple allows on an older Intel Mac"
kind = "app"
platform = "mac"
source = "github"
repo = "dortania/OpenCore-Legacy-Patcher"
asset = ['^OpenCore-Patcher\.pkg$']
checksum = ["github-digest"]

# On hold upstream: macOS no longer lets it change much. Unsigned, so macOS asks before opening it.
[[tool]]
name = "macutil"
title = "Chris Titus Tech MacUtil"
description = "Chris Titus Tech's utility to fix macOS defaults and remove animations; on hold upstream"
kind = "app"
platform = "mac"
source = "github"
repo = "ChrisTitusTech/macutil"
asset = ['^MacUtil-Universal\.app\.zip$']
checksum = ["github-digest"]