Tunjo: Open-Source Tool Uses Merkle Trees and Hybrid Signatures to Seal Digital Files

Developer Juan Carlos Isaza has released Tunjo, an open-source command-line tool written in Rust under the AGPL-3.0 license, designed to cryptographically seal sets of digital files so their integrity can be independently verified. The tool builds a Merkle tree from file metadata and content, producing a root hash that is then signed using a triple hybrid signature combining Ed25519, ML-DSA-87 (FIPS 204), and SLH-DSA-SHA2-256s (FIPS 205) to guard against both current and future cryptographic threats. Each file leaf includes path, timestamps, and content hash rather than content alone, ensuring that renaming or moving a file is also detected as a change. When run, Tunjo recalculates the full tree before checking the signature, so any discrepancy between the sealed record and files on disk is reported explicitly rather than silently skipped. The project includes a test suite simulating 240 integrity checks, altering one byte across 120 files to verify the tool detects each change without producing false positives once files are restored.