Repository navigation
Releases
Releases · Akshay7273/sendbeam
SendBeam v2.2.0 — Repeatable Handoffs
SendBeam v2.2.0
Cryptographic Verification
All release binaries and installer packages are cryptographically signed and verifiable end-to-end:
- Minisign (Ed25519):
# Verify SHA256SUMS.txt using the official SendBeam public key:
minisign -Vm SHA256SUMS.txt -P RWTcyDWHWbxnuo3LVM5mWoZrx0HDwSQzAZvXK1lPRcdtJxshUDxJh+rE- Sigstore Cosign (Keyless OIDC):
# Verify the GitHub Actions OIDC identity attestation:
cosign verify-blob --bundle SHA256SUMS.txt.sigstore.json --certificate-identity-regexp 'github.com/Akshay7273/sendbeam' --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS.txt- SHA-256 Checksums:
# Verify downloaded asset checksum against the signed manifest:
sha256sum -c SHA256SUMS.txt --ignore-missingChanges
SendBeam v2.2 — Release Gate
The v2.2 milestone (Repeatable Handoffs) gates release on the checks below, each verified against merged main.
Theme: save a handoff workflow, preview it, and optionally run it on a schedule or when selected local files become ready. A routine is a one-way delivery, not a shared folder or backup system: it does not mirror deletions, overwrite existing files by default, pull arbitrary remote files, or promise that all historical versions will be retained.
Automation posture: saved recipes start disabled or approval-required. Automated dispatch (watch/schedule) needs a separate explicit auto-send grant on a native user-scoped runner. Sender auto-send permission and receiver auto-accept permission are distinct; neither implies the other.
1. Gate Checks
| # | Requirement | Result | Evidence |
|---|---|---|---|
| 1 | Saved handoff recipe schema and explicit automation grants (V22-PR01) Small, local, reviewable workflow model: explicit local source roots/selections, fixed authenticated recipients, allowed network/privacy mode, filters, trigger, expiry, budgets. Default new/imported/changed recipes to disabled or approval-required. Material changes invalidate prior automation consent. No secrets embedded in recipe files; imported recipes never run automatically. |
PASS | packages/engine/recipes/ (schema, store, grants). Merged via PR #218 (1bf0f616). |
| 2 | Manual one-shot recipe runs and secret-free dry-run preview (V22-PR02) Save/edit/duplicate recipes; dry-run plan (sources, recipients, filters, limits, estimated bytes) with no transfers or remote effects; explicit Run enqueues ordinary jobs. Preview distinguished from execution; revalidation at enqueue/send. No second job queue. |
PASS | Recipe resolver/runner, CLI recipe preview/run, versioned DTO output. Merged via PR #219 (f009e5e5). |
| 3 | Bounded user-scoped routine runner with AutoSend grant enforcement (V22-PR03) Explicitly enabled, bounded host for automated triggers. Single ownership, restart reconciliation, bounded admission/resources, disable-all, per-user startup controls; autostart off by default. Locked credential store pauses visibly rather than falling back to plaintext. No privileged system-wide service. |
PASS | Runner, ownership lease, CLI/desktop controls. Merged via PR #220 (b641d0e3). |
| 4 | Watched-folder one-way handoffs (V22-PR04) Explicitly selected new/changed stable files become ordinary one-way delivery jobs. Default discovered changes to an approval-required queue; automatic dispatch needs a separate explicit grant. Debounce/coalesce bursts, stability revalidation, bounded reconciliation, symlink-escape and receive-folder feedback-loop protection. No mirror deletion, no two-way sync. |
PASS | fsnotify watcher adapter, debounce/cooldown. Merged via PR #221 (04d9102d). |
| 5 | Explicit schedules with bounded catch-up (V22-PR05) Intervals and daily local-time schedules with persisted timezone and next-run semantics. DST gaps/repeats, clock jumps, sleep, missed runs defined: default skip or one bounded catch-up ( max_catchup_runs, 0–10, default 3), never every missed occurrence. Durable idempotency cursor; single active execution per recipe. |
PASS | Scheduler, durable cursor, deterministic-clock tests. Merged via PR #222 (bbe5fa8c). |
| 6 | Provenance, receiver auto-accept policy, pause/disable controls (V22-PR06) Local cause/provenance attached to normal transfer jobs (advisory label, no file contents, no reusable secrets); sender byte/file/run/concurrency ceilings independent of receiver quotas. Receiver auto-accept policy stays separate from sender auto-send. Run now / Preview / Pause / Disable / Reapprove; widening recipe scope requires reapproval. |
PASS | Provenance on jobs + wire manifest, receiver policy, CLI/desktop controls. Merged via PR #223 (676febd5). |
| 7 | Isolation, failure recovery, chaos/resource evidence (V22-PR07) End-to-end recipes against real listeners and real filesystems: overlapping recipes, receive-folder loops, event floods, changed sources, large directories, offline periods, disk-full, locked credentials, revoked recipients, policy changes, crashes around enqueue/receiver-commit/ack. No unauthorized source inclusion, automatic overwrite, remote deletion, unbounded queue growth, or secret exposure. |
PASS | Integration/chaos harness, resource budgets. Merged via PR #224 (84c1ee45). |
| 8 | Release evidence, upgrade/rollback checks, release notes (V22-PR08) This document. Upgrade proved additive, rollback proved safe, wire interop proved byte-exact, final hygiene sweep clean. |
PASS | This PR. Evidence in §7. |
2. v2.2 PR Table (verified against main and the GitHub API, 2026-09-20)
| Logical ID | PR (number + URL) | Merge SHA | One-line description |
|---|---|---|---|
| V22-PR01 | #218 | 1bf0f6163ffa611608d7da7e3b1a9ee6d389b366 |
Saved handoff recipe schema and explicit automation grants |
SendBeam v2.1.0 - Nearby & Offline
SendBeam v2.1.0
Cryptographic Verification
All release binaries and installer packages are cryptographically signed and verifiable end-to-end:
- Minisign (Ed25519):
# Verify SHA256SUMS.txt using the official SendBeam public key:
minisign -Vm SHA256SUMS.txt -P RWTcyDWHWbxnuo3LVM5mWoZrx0HDwSQzAZvXK1lPRcdtJxshUDxJh+rE- Sigstore Cosign (Keyless OIDC):
# Verify the GitHub Actions OIDC identity attestation:
cosign verify-blob --bundle SHA256SUMS.txt.sigstore.json --certificate-identity-regexp 'github.com/Akshay7273/sendbeam' --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS.txt- SHA-256 Checksums:
# Verify downloaded asset checksum against the signed manifest:
sha256sum -c SHA256SUMS.txt --ignore-missingChanges
SendBeam v2.1 — Release Gate
The v2.1 milestone (Nearby & Offline) gates release on the checks below, each verified against merged main.
Theme: pair and transfer between supported native clients on a reachable local network without public rendezvous, STUN or relay services. Native CLI and desktop are the mandatory offline clients. Browser/PWA retains its v2.0 capabilities; no browser offline promise is made.
Network policies (separate from the padding policy): online (default), prefer-local (try the LAN route first, fall back online explicitly), and local-only (never touch the public path). Local-only means no public rendezvous, STUN, TURN, relay, update check, telemetry, or other app-initiated internet request while that mode is active. OS traffic outside SendBeam is outside the claim.
1. Gate Checks
| # | Requirement | Result | Evidence |
|---|---|---|---|
| 1 | Local-only architecture & threat model (V21-PR01) Reviewed ADR specifying the no-public-service route: bounded local bootstrap/signaling, corrected trusted authentication, first-pair ceremony, policy/egress matrix, listener exposure and interface-selection rules. |
PASS | docs/adr/ local-only design. Merged via PR #210 (632f3c48). |
| 2 | Bounded native local rendezvous service (V21-PR02) Explicit interface binding, limited connections/message sizes, deadlines, cancellation, clean shutdown. Unpaired sessions admitted only through a user-opened short-lived pairing window. No file listing, path serving, or remote administration. |
PASS | packages/engine/localrendezvous/. Merged via PR #211 (dddeed2d). |
| 3 | Nearby discovery → validated route candidates (V21-PR03) Bounded candidate tables with expiry and endpoint validation; explicit manual local connection for blocked-multicast networks. A beacon is never authentication; only the selected identity becomes the connected peer. |
PASS | packages/engine/discovery/. Merged via PR #212 (6226d48c). |
| 4 | Local-only direct transfer over native local rendezvous (V21-PR04) Authenticated local sessions drive the existing encrypted transfer machinery and durable sinks. Policy enforced on candidate gathering and actual connections, not just a UI flag. Prohibited egress fails the transfer even if bytes would move. |
PASS | packages/engine/localtransfer/. Merged via PR #213 (fe22b57b — merged without the automatic (#213) suffix; recorded incident, see §6). |
| 5 | First-time offline pairing over local rendezvous (V21-PR05) Fresh native profiles pair and send with internet unavailable, using the reviewed ceremony. Wrong/expired/reused invitations, substituted endpoints, and declined fingerprints leave no usable partial trust. |
PASS | packages/engine/localpairing/, CLI pairing commands, desktop ceremony. Merged via PR #214 (9bd2d1d6). |
| 6 | Truthful offline workflows in CLI and desktop (V21-PR06) Persistent user-selected network policy with visible per-job route. sendbeam send --network-policy, local-only receive, desktop settings/policy UI, offline listener controls. Updater and optional network operations deferred in local-only. |
PASS | CLI send/receive/outbox flags; desktop TransferService + frontend. Merged via PR #215 (2968b6ef). |
| 7 | Interruption recovery and policy-change handling (V21-PR07) Per-job network policies bound at enqueue ( online default, prefer-local, local-only); DispatchableUnder matrix; outbox holds unsatisfiable jobs without leasing, sending, or spending retry budget. Interrupted local sends resume with an authenticated resume context (offerer role, decoded credential) via the shared resume contract; local-only never falls back online; changed sources fail before bytes move. Desktop settings save via SaveConfigPatch so partial saves preserve unrelated settings. |
PASS | packages/engine/{jobs,netpolicy,outbox,transfercenter,localtransfer}, CLI outbox/dispatch, desktop SendToDevicePreferLocal. Merged via PR #216 (7c094ad3). |
| 8 | Release evidence, regressions, artifacts (V21-PR08) This document. Final-commit CI green, measured evidence below, artifact checksums, regression suites re-run, honest limitations recorded. |
PASS | This PR. Evidence in §5. |
2. Release Artifacts Matrix
The standard SendBeam distribution artifact set is produced and cryptographically signed on release tags (v*):
| Category | Artifact Name / Path | Platform / Target | Packaging / Format |
v2.0.0
SendBeam v2.0.0
Cryptographic Verification
All release binaries and installer packages are cryptographically signed and verifiable end-to-end:
- Minisign (Ed25519):
# Verify SHA256SUMS.txt using the official SendBeam public key:
minisign -Vm SHA256SUMS.txt -P RWTcyDWHWbxnuo3LVM5mWoZrx0HDwSQzAZvXK1lPRcdtJxshUDxJh+rE- Sigstore Cosign (Keyless OIDC):
# Verify the GitHub Actions OIDC identity attestation:
cosign verify-blob --bundle SHA256SUMS.txt.sigstore.json --certificate-identity-regexp 'github.com/Akshay7273/sendbeam' --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS.txt- SHA-256 Checksums:
# Verify downloaded asset checksum against the signed manifest:
sha256sum -c SHA256SUMS.txt --ignore-missingChanges
SendBeam v1.7 — Release Gate
The v1.7 milestone (Mesh Maturity & Wire Privacy: signed revocation records with opportunistic mesh sync, multi-device broadcast send with independent failure domains, negotiated wire traffic padding with power-of-two bucket quantization, relay metadata defenses with sender timing jitter, and zero-cost package manager distribution across Homebrew, Scoop, WinGet, and Arch Linux AUR) gates release on the checks below, each verified against merged main.
Evidence is a deterministic unit/integration test, a verified cross-platform build fixture, or a cryptographic testbed; every binary, manifest, and transfer across the matrix satisfies strict verification standards.
1. Gate Checks
| # | Requirement | Result | Evidence |
|---|---|---|---|
| 1 |
Signed Revocation Records & Opportunistic Mesh Sync (ADR 0008) Generate canonical, domain-separated revocation statements signed by the revoking device's Ed25519 identity key ( RevocationRecord). Propagate opportunistically over authenticated sendbeam/2 trusted sessions. Validate signature against stored revoker public key, enforce strict sequence number monotonicity (Seq > StoredSeq), reject timestamp skew (> ±5 min), and fail closed on distrusted revokers (ErrUntrustedPeer / ErrTrustedPeerRevoked). Expand attack matrix to 12 vectors. |
PASS | Design in docs/adr/0008-revocation-sync.md. Wire codec and cross-language test vectors in packages/wire/revocation.go, revocation_test.go, packages/wire/testdata/revocation_vectors.json, and packages/protocol/src/revocation.ts, revocation.test.ts. Trust store sync engine in packages/engine/trust/revocation_sync.go and revocation_sync_test.go (TestRevocationSync_ThreeDevicePropagation, TestRevocationSync_MonotonicSequenceEnforced, TestRevocationSync_UntrustedRevokerRejected). Attack matrix test suites in packages/wire/attack_matrix_test.go, packages/engine/trust/attack_matrix_test.go, and packages/protocol/src/attack-matrix.test.ts (12/12 vectors passing in Go and TypeScript). Documented in docs/trust-model.md. |
| 2 |
Multi-Device Broadcast Send & Independent Failure Isolation Support concurrent transfer fan-out to multiple paired targets ( sendbeam send <files...> @device1 @device2 @device3). Bounded concurrency, per-target progress reporting, and stable --json output (ok, offline, refused, failed). Enforce strict partial-failure isolation (one target failure never aborts or corrupts concurrent transfers to other peers). Process exit code is zero only if all targets succeed. Desktop and Web UI multi-select send flows with per-device retry. |
PASS | Broadcast coordinator in packages/engine/transfer/broadcast.go and broadcast_test.go (TestBroadcastCoordinator_AllSucceed, TestBroadcastCoordinator_PartialFailure, TestBroadcastCoordinator_OfflineTargetIgnored, TestBroadcastCoordinator_DigestVerifiedPerTarget). CLI argument parsing, progress table, and JSON telemetry in apps/cli/cmd/sendbeam/main.go and apps/cli/cmd/sendbeam/main_test.go (TestSendBroadcast_CLIArguments, TestSendBroadcast_ExitCodes, TestSendBroadcast_JSONOutput). Web/Desktop multi-select UI in apps/web/src/lib/trust/DevicesModal.svelte and apps/web/src/lib/trust/devices.test.ts. |
| 3 |
Wire Privacy: Negotiated Traffic Padding (ADR 0009) Negotiate optional padding feature flag during caps exchange. Quantize frame payloads into discrete power-of-two bucket sizes (--private flag and settings toggle. Backward and forward compatible with unpadded v1.6 peers (unpadded fallback). Measured overhead <0.05% CPU. |
PASS | Design in docs/adr/0009-negotiated-traffic-padding.md. Wire padding codec, validation, and cross-language test vectors in packages/wire/padding.go, padding_test.go, packages/wire/testdata/padding_vectors.json, and packages/protocol/src/padding.ts, padding.test.ts, padding-vector.test.ts. Engine transfer integration in packages/engine/transfer/padding_test.go and packages/protocol/src/transfer-sender.ts. Caps negotiation tests in packages/wire/transfer_set_test.go and packages/protocol/src/transfer-set.test.ts. Performance benchmarks documented in docs/BENCHMARKS.md and docs/compat-matrix.md. |
| 4 |
Relay Metadata Defenses & Sender Timing Jitter Enforce uniform power-of-two frame sizing across the WebSocket relay path when padding is negotiated. Provide optional sender-side randomized scheduling jitter (configurable window up to 15ms) to disrupt burst timing correlation without impacting throughput. Audit server logs and Prometheus metrics to verify zero per-frame payload, tag, or header logging. Document coarse-grain residual metadata (socket correlation, macro session duration) in threat model without overclaiming. |
PASS | Relay uniform framing and jitter scheduling in packages/engine/transfer/driver.go and driver_test.go (TestDriver_RelayWithPaddingAndJitter, TestDriver_TimingJitterBounds). Server log and metrics audit in apps/server/internal/signal/metrics_test.go and apps/server/internal/signal/hub_test.go (TestHub_RelayZeroLoggingAudit, TestMetrics_ZeroPIIInvariant). Threat model before/after metadata comparison table in docs/threat-model.md. |
| 5 |
Zero-Cost Package-Manager Distribution (Homebrew, Scoop, WinGet, AUR) Publish automated, cryptographically validated package manifests and formulas: Homebrew formula ( Formula/sendbeam.rb, `packaging/homebrew/Formula/sendbeam.rb... |
SendBeam 1.9.0
SendBeam v1.9.0
Cryptographic Verification
All release binaries and installer packages are cryptographically signed and verifiable end-to-end:
- Minisign (Ed25519):
# Verify SHA256SUMS.txt using the official SendBeam public key:
minisign -Vm SHA256SUMS.txt -P RWTcyDWHWbxnuo3LVM5mWoZrx0HDwSQzAZvXK1lPRcdtJxshUDxJh+rE- Sigstore Cosign (Keyless OIDC):
# Verify the GitHub Actions OIDC identity attestation:
cosign verify-blob --bundle SHA256SUMS.txt.sigstore.json --certificate-identity-regexp 'github.com/Akshay7273/sendbeam' --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS.txt- SHA-256 Checksums:
# Verify downloaded asset checksum against the signed manifest:
sha256sum -c SHA256SUMS.txt --ignore-missingChanges
SendBeam v1.9 — Release Gate
The v1.9 milestone (Trusted Handoffs: forward-secret authenticated ephemeral Diffie-Hellman key exchange sendbeam/3, authorized signed tombstones and mesh revocation lifecycle, ephemeral opaque blind rendezvous with truthful presence, shared native receiver with real consent for CLI and desktop, CLI targeted and broadcast delivery with bound peer identity, foreground browser pairing with transactional IndexedDB persistence, browser targeted send & incoming consent, desktop trusted-device flows with typed Wails v3 adapters and native smoke tests, production strict require-padding policy across all clients, and comprehensive cross-client integration) gates release on the checks below, each verified against merged main.
Every gate check requires deterministic test evidence, green CI execution across all platforms, and complete documentation synchronization.
1. Gate Checks
| # | Requirement | Result | Evidence |
|---|---|---|---|
| 1 | Reviewed Trusted-Session & Authorization ADR (ADR 0010 / V19-PR01) Formally specify sendbeam/3: authenticated ephemeral Diffie-Hellman key agreement using X25519 (RFC 7748) and HKDF-SHA256 (RFC 5869), memory zeroization of ephemeral private keys, transcript and capability binding, replay/timestamp skew bounds (±5 min), mutual confirmation tags, downgrade defense (ErrProtocolDowngradeForbidden), and the authorization hierarchy distinguishing self-tombstones, pairwise unpairing, and cluster authority. |
PASS | Design established in docs/adr/0010-trusted-session-auth.md. Formalized mathematical derivations, state machine diagrams, error taxonomy, and authorization rules. Merged via PR #180 (3893766). |
| 2 | Forward-Secret Key Agreement Implementation (sendbeam/3 / V19-PR02)Parallel implementation in Go ( packages/wire/trusted_auth.go) and TypeScript (packages/protocol/src/trusted-auth.ts). Low-order curve point validation, memory zeroization, domain-separated mutual confirmation tags (NewTrustedAuthConfirmV3), replay cache (NonceReplayCache), cross-language canonical test vectors (packages/wire/testdata/trusted-session-v3-vectors.json), and adversarial test suites. |
PASS | Implementation in packages/wire/trusted_auth.go, trusted_auth_test.go, and packages/protocol/src/trusted-auth.ts, trusted-auth-v3.test.ts. Cross-language vectors passing byte-for-byte parity. Engine integration in packages/engine/trust/trusted_session.go. Merged via PR #181 (22b842b). |
| 3 | Unified Pairing Identity Persistence & Protected Credential Adapters (V19-PR03) Non-destructive atomic migration ( write -> verify -> switch), relationship (cluster_member vs contact) schema evolution, OS secret store abstraction with file secret resolver fallback (0600), and IndexedDB persistent storage in the browser. |
PASS | Credential adapters in packages/engine/trust/credential_store.go, identity_manager.go, trust_store.go, and packages/protocol/src/indexeddb-secret-store.ts, indexeddb-trust-store.ts. Test suites credential_store_test.go, identity_manager_test.go, indexeddb-stores.test.ts. Merged via PR #182 (a4abf87). |
| 4 | Real User-Triggered Revocation & Authorized Signed Tombstones (V19-PR04) Authorized tombstone signing, monotonic sequence validation, active-session revocation checks, and transitive cluster revocation authorization rules. |
PASS | Tombstone storage in packages/engine/trust/tombstone_store.go, packages/protocol/src/tombstone-store.ts. Monotonic sequence validation in packages/wire/revocation.go. Revocation sync in packages/engine/trust/revocation_sync.go and revocation_sync_test.go. Merged via PR #183 (8bbff52). |
| 5 | Ephemeral Opaque Blind Rendezvous & Truthful Presence (V19-PR05) 15-minute epoch-rotated blind handles derived via HMAC from pairwise secret, opaque room orchestration, concurrency limits, and truthful presence without directory harvesting. |
PASS | Opaque rendezvous session in packages/engine/rendezvous/opaque_session.go, packages/protocol/src/opaque-rendezvous.ts. Handle rotation tests in opaque_session_test.go and opaque-rendezvous.test.ts. Truthful presence coordinator in presence_coordinator.go. Merged via PR #184 (76b1387). |
| 6 | Shared Native Receiver for CLI and Desktop (V19-PR06) Unified packages/engine/receiver/listener.go powering both CLI listen and Desktop native background listener. Real interactive consent prompts, durable receive, and --once mode exiting after exactly one verified delivery. |
PASS | Native receiver engine in packages/engine/receiver/listener.go, types.go, policy.go. Comprehensive test suite in receiver_test.go (TestReceiverPolicyAutoAccept, TestReceiverConsentPromptAccept, TestReceiverConsentPromptDecline, TestReceiverOnceModeSingleDelivery). Merged via PR #191 (8dc9c11). |
| 7 | CLI Targeted & Broadcast Delivery with Bound Peer Identity (V19-PR07) CLI @device resolution against trusted store, bounded concurrent dial/transfer orchestration, independent failure domains, table summary, and secret-free `-... |
SendBeam 1.8.0
SendBeam v1.8.0
Cryptographic Verification
All release binaries and installer packages are cryptographically signed and verifiable end-to-end:
- Minisign (Ed25519):
# Verify SHA256SUMS.txt using the official SendBeam public key:
minisign -Vm SHA256SUMS.txt -P RWTcyDWHWbxnuo3LVM5mWoZrx0HDwSQzAZvXK1lPRcdtJxshUDxJh+rE- Sigstore Cosign (Keyless OIDC):
# Verify the GitHub Actions OIDC identity attestation:
cosign verify-blob --bundle SHA256SUMS.txt.sigstore.json --certificate-identity-regexp 'github.com/Akshay7273/sendbeam' --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS.txt- SHA-256 Checksums:
# Verify downloaded asset checksum against the signed manifest:
sha256sum -c SHA256SUMS.txt --ignore-missingChanges
SendBeam v1.8 — Release Gate
The v1.8 milestone (Protocol Assurance & Mobile Hardening: continuous native fuzzing across all untrusted input boundaries, deterministic cross-language differential parity harness, mobile WebKit / iOS Safari transfer hardening with dedicated CI profiling, expanded 20-vector adversarial attack matrix, and enhanced repository supply-chain posture with OpenSSF Scorecard and SHA-pinned GitHub Actions) gates release on the checks below, each verified against merged main.
Every gate check requires deterministic test evidence, green CI execution, and complete documentation synchronization.
1. Gate Checks
| # | Requirement | Result | Evidence |
|---|---|---|---|
| 1 | Continuous Fuzzing Infrastructure Establish comprehensive continuous fuzzing covering every untrusted byte boundary across Go packages ( packages/wire, packages/engine, apps/server). Commit deterministic seed corpora under standard testdata/fuzz/ paths. Integrate fast corpus replay smoke gate into pull request CI. Schedule matrix-parallel nightly fuzzing via GitHub Actions (fuzz.yml) with automated crash artifact retention and manual dispatch. Provide developer runner scripts (scripts/run_fuzz.sh), just recipes (just fuzz-smoke, just fuzz), and Google OSS-Fuzz container build script (scripts/oss-fuzz-build.sh). Document fuzzing architecture in docs/fuzzing.md. |
PASS | 22 native Go fuzz targets implemented in packages/wire/fuzz_test.go, journal_fuzz_test.go, padding_fuzz_test.go, pairing_fuzz_test.go, trusted_auth_fuzz_test.go, words_fuzz_test.go, revocation_fuzz_test.go; packages/engine/transfer/journal_fuzz_test.go, packages/engine/trust/trust_fuzz_test.go, packages/engine/updater/manifest_fuzz_test.go; apps/server/internal/signal/fuzz_test.go. Committed seed corpora across all targets under testdata/fuzz/. Fuzz smoke replay integrated in .github/workflows/ci.yml. Nightly matrix workflow .github/workflows/fuzz.yml. Runner script scripts/run_fuzz.sh and OSS-Fuzz container build script scripts/oss-fuzz-build.sh. Documented in docs/fuzzing.md and README. Merged via PR #161 (c305f9c). |
| 2 | Differential Cross-Language Parity Harness (Go ↔ TS) Build automated, deterministic differential testing harness synthesizing identical inputs across Go and TypeScript wire codecs. Generate 2,000 cases per surface per run using deterministic pseudo-random seeds. Verify byte-for-byte serialization identity and identical fail-closed rejection on invalid inputs across frame headers, revocation records, SPAKE2+ credentials, trusted-auth session challenges, invite codes, and safe transfer paths. Verify sensitivity via deliberate 1-byte encoder mutations. Gate CI on differential parity and run 10,000 cases nightly. |
PASS | Go vector generator packages/wire/differential_vector_gen_test.go synthesizing 2,000 cases per codec. TypeScript consumer suite packages/protocol/src/differential.test.ts. TS reverse generator exporting to packages/wire/testdata/diffgen-ts.jsonl and Go consumer suite packages/wire/differential_test.go. Verified deliberate 1-byte mutation pinpointing exact case ID fh_edge_0. CI differential gate in .github/workflows/ci.yml (2,000 cases/codec) and nightly workflow in .github/workflows/fuzz.yml (10,000 cases/codec). Developer tooling scripts/run_differential.sh and just differential. Documented in docs/fuzzing.md (Section 9). Merged via PR #162 (e192311). |
| 3 | Mobile WebKit & iOS Safari Hardening + Dedicated CI Profile Harden mobile transfer path against iOS Safari and WebKit browser engine constraints. Add dedicated Playwright mobile-webkit profile (iPhone 14 viewport, WebKit engine) to CI test matrix. Test mobile layout, responsive touch targets (>= 44x44px), PWA app-shell join flows, WebKit DataChannel backpressure (bufferedAmountLowThreshold) throttling, Page Visibility API suspension handling, and memory-bounded OPFS stream sink fallback. Enforce WebRTC trickle candidate sequencing and resolve engine supervisor lock inversions. |
PASS | Playwright mobile WebKit project added to apps/web/playwright.config.ts. 11 targeted end-to-end tests in apps/web/e2e/mobile-transfer.spec.ts passing green under mobile WebKit. Memory-bounded stream sink fallback in apps/web/src/lib/transfer/sink.ts. Worker-to-host streaming fix in apps/web/src/lib/transfer/transfer-core.ts. Receiver session teardown race fix in apps/web/src/lib/session/transfer.ts. Trickle candidate SDP serialization in packages/engine/rtc/peer.go. Supervisor relay cutover deadlock resolution in packages/engine/supervisor/supervisor.go and adaptive_conn.go. Updated docs/compat-matrix.md. Merged via PR #163 (e111e41). |
| 4 | Adversarial Attack Matrix Expansion (12 → 20+ Vectors) Expand the adversarial security attack matrix to 20 vectors across Go and TypeScript packages, enforcing existing protocol rules against malformed inputs and hostile peers: padding-oracle probe (13), bucket-downgrade coercion (14), update-manifest replay rejection (15), revocation race condition (16), revocation sequence rollback & domain monotonicity (17), relay frame corruption/reordering/truncation (18), durable transfer journal tampering (19), and pairing confirmation misuse (20). Update threat model with full 20-vector matrix table. |
PASS | New adversarial test suites implemented in packages/wire/attack_matrix_test.go (Vectors ... |
SendBeam 1.7.0
SendBeam v1.7.0
Cryptographic Verification
All release binaries and installer packages are cryptographically signed and verifiable end-to-end:
- Minisign (Ed25519):
# Verify SHA256SUMS.txt using the official SendBeam public key:
minisign -Vm SHA256SUMS.txt -P RWTcyDWHWbxnuo3LVM5mWoZrx0HDwSQzAZvXK1lPRcdtJxshUDxJh+rE- Sigstore Cosign (Keyless OIDC):
# Verify the GitHub Actions OIDC identity attestation:
cosign verify-blob --bundle SHA256SUMS.txt.sigstore.json --certificate-identity-regexp 'github.com/Akshay7273/sendbeam' --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS.txt- SHA-256 Checksums:
# Verify downloaded asset checksum against the signed manifest:
sha256sum -c SHA256SUMS.txt --ignore-missingChanges
SendBeam v1.7 — Release Gate
The v1.7 milestone (Mesh Maturity & Wire Privacy: signed revocation records with opportunistic mesh sync, multi-device broadcast send with independent failure domains, negotiated wire traffic padding with power-of-two bucket quantization, relay metadata defenses with sender timing jitter, and zero-cost package manager distribution across Homebrew, Scoop, WinGet, and Arch Linux AUR) gates release on the checks below, each verified against merged main.
Evidence is a deterministic unit/integration test, a verified cross-platform build fixture, or a cryptographic testbed; every binary, manifest, and transfer across the matrix satisfies strict verification standards.
1. Gate Checks
| # | Requirement | Result | Evidence |
|---|---|---|---|
| 1 |
Signed Revocation Records & Opportunistic Mesh Sync (ADR 0008) Generate canonical, domain-separated revocation statements signed by the revoking device's Ed25519 identity key ( RevocationRecord). Propagate opportunistically over authenticated sendbeam/2 trusted sessions. Validate signature against stored revoker public key, enforce strict sequence number monotonicity (Seq > StoredSeq), reject timestamp skew (> ±5 min), and fail closed on distrusted revokers (ErrUntrustedPeer / ErrTrustedPeerRevoked). Expand attack matrix to 12 vectors. |
PASS | Design in docs/adr/0008-revocation-sync.md. Wire codec and cross-language test vectors in packages/wire/revocation.go, revocation_test.go, packages/wire/testdata/revocation_vectors.json, and packages/protocol/src/revocation.ts, revocation.test.ts. Trust store sync engine in packages/engine/trust/revocation_sync.go and revocation_sync_test.go (TestRevocationSync_ThreeDevicePropagation, TestRevocationSync_MonotonicSequenceEnforced, TestRevocationSync_UntrustedRevokerRejected). Attack matrix test suites in packages/wire/attack_matrix_test.go, packages/engine/trust/attack_matrix_test.go, and packages/protocol/src/attack-matrix.test.ts (12/12 vectors passing in Go and TypeScript). Documented in docs/trust-model.md. |
| 2 |
Multi-Device Broadcast Send & Independent Failure Isolation Support concurrent transfer fan-out to multiple paired targets ( sendbeam send <files...> @device1 @device2 @device3). Bounded concurrency, per-target progress reporting, and stable --json output (ok, offline, refused, failed). Enforce strict partial-failure isolation (one target failure never aborts or corrupts concurrent transfers to other peers). Process exit code is zero only if all targets succeed. Desktop and Web UI multi-select send flows with per-device retry. |
PASS | Broadcast coordinator in packages/engine/transfer/broadcast.go and broadcast_test.go (TestBroadcastCoordinator_AllSucceed, TestBroadcastCoordinator_PartialFailure, TestBroadcastCoordinator_OfflineTargetIgnored, TestBroadcastCoordinator_DigestVerifiedPerTarget). CLI argument parsing, progress table, and JSON telemetry in apps/cli/cmd/sendbeam/main.go and apps/cli/cmd/sendbeam/main_test.go (TestSendBroadcast_CLIArguments, TestSendBroadcast_ExitCodes, TestSendBroadcast_JSONOutput). Web/Desktop multi-select UI in apps/web/src/lib/trust/DevicesModal.svelte and apps/web/src/lib/trust/devices.test.ts. |
| 3 |
Wire Privacy: Negotiated Traffic Padding (ADR 0009) Negotiate optional padding feature flag during caps exchange. Quantize frame payloads into discrete power-of-two bucket sizes (--private flag and settings toggle. Backward and forward compatible with unpadded v1.6 peers (unpadded fallback). Measured overhead <0.05% CPU. |
PASS | Design in docs/adr/0009-negotiated-traffic-padding.md. Wire padding codec, validation, and cross-language test vectors in packages/wire/padding.go, padding_test.go, packages/wire/testdata/padding_vectors.json, and packages/protocol/src/padding.ts, padding.test.ts, padding-vector.test.ts. Engine transfer integration in packages/engine/transfer/padding_test.go and packages/protocol/src/transfer-sender.ts. Caps negotiation tests in packages/wire/transfer_set_test.go and packages/protocol/src/transfer-set.test.ts. Performance benchmarks documented in docs/BENCHMARKS.md and docs/compat-matrix.md. |
| 4 |
Relay Metadata Defenses & Sender Timing Jitter Enforce uniform power-of-two frame sizing across the WebSocket relay path when padding is negotiated. Provide optional sender-side randomized scheduling jitter (configurable window up to 15ms) to disrupt burst timing correlation without impacting throughput. Audit server logs and Prometheus metrics to verify zero per-frame payload, tag, or header logging. Document coarse-grain residual metadata (socket correlation, macro session duration) in threat model without overclaiming. |
PASS | Relay uniform framing and jitter scheduling in packages/engine/transfer/driver.go and driver_test.go (TestDriver_RelayWithPaddingAndJitter, TestDriver_TimingJitterBounds). Server log and metrics audit in apps/server/internal/signal/metrics_test.go and apps/server/internal/signal/hub_test.go (TestHub_RelayZeroLoggingAudit, TestMetrics_ZeroPIIInvariant). Threat model before/after metadata comparison table in docs/threat-model.md. |
| 5 |
Zero-Cost Package-Manager Distribution (Homebrew, Scoop, WinGet, AUR) Publish automated, cryptographically validated package manifests and formulas: Homebrew formula ( Formula/sendbeam.rb, `packaging/homebrew/Formula/sendbeam.rb... |
SendBeam 1.6.0
SendBeam v1.6.0
Cryptographic Verification
All release binaries and installer packages are cryptographically signed and verifiable end-to-end:
- Minisign (Ed25519):
# Verify SHA256SUMS.txt using the official SendBeam public key:
minisign -Vm SHA256SUMS.txt -P RWTcyDWHWbxnuo3LVM5mWoZrx0HDwSQzAZvXK1lPRcdtJxshUDxJh+rE- Sigstore Cosign (Keyless OIDC):
# Verify the GitHub Actions OIDC identity attestation:
cosign verify-blob --bundle SHA256SUMS.txt.sigstore.json --certificate-identity-regexp 'github.com/Akshay7273/sendbeam' --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS.txt- SHA-256 Checksums:
# Verify downloaded asset checksum against the signed manifest:
sha256sum -c SHA256SUMS.txt --ignore-missingChanges
SendBeam v1.6 — Release Gate
The v1.6 milestone (Public Release Readiness: formal signed distribution pipelines, zero-cost Minisign & Sigstore cryptographic verification, signed update manifests with downgrade prevention, desktop & CLI self-update engine with atomic rollback, mobile web PWA with responsive transfer UX and Playwright mobile CI, and hardened signaling server with per-IP rate limiting, anti-brute-force room enumeration defense, trusted reverse-proxy resolution, health/readiness endpoints, and zero-PII Prometheus metrics) gates release on the checks below, each verified against merged main.
Evidence is a deterministic unit/integration test, a verified cross-platform build fixture, or a cryptographic testbed; every binary, manifest, and transfer across the matrix satisfies strict verification standards.
1. Gate Checks
| # | Requirement | Result | Evidence |
|---|---|---|---|
| 1 | Formal GitHub Releases Pipeline & Multi-Platform Packaging Produce deterministic release packages across 6 CLI targets ( linux/amd64, linux/arm64, darwin/amd64, darwin/arm64, windows/amd64, windows/arm64) and 4 desktop packaging formats (Windows NSIS + portable ZIP, macOS Universal DMG + ZIP, Linux Debian .deb + AppImage) with canonical SHA256SUMS.txt, in-toto build provenance attestations (actions/attest-build-provenance@v2), and SPDX 2.3 SBOMs (sendbeam-cli.spdx.json, sendbeam-desktop.spdx.json). Staged safely via draft releases. |
PASS | Workflow .github/workflows/release.yml, version metadata engine in scripts/version-metadata.sh, and unit test suite scripts/version-metadata_test.sh (10/10 test cases passing). Packaging build verified in .github/workflows/distribution.yml and documented in docs/distribution.md. |
| 2 | Zero-Cost Binary Signing & Supply-Chain Verification Dual cryptographic signature generation on all release manifests using Minisign Ed25519 ( BA67BC598735C8DC in minisign.pub) and Sigstore Cosign keyless OIDC identity tokens (SHA256SUMS.txt.sigstore.json). Provide standalone verification script scripts/verify-release.sh and assert strict tamper rejection across all failure modes. |
PASS | Pure Go Minisign tool in scripts/minisign.go, release workflow in .github/workflows/release.yml, automated verification tool scripts/verify-release.sh, and unit test suite scripts/verify-release_test.sh (8/8 test cases passing asserting tamper rejection for corrupted payloads, tampered manifests, forged signatures, and mismatched keys). Documented in docs/supply-chain.md and docs/install.md. |
| 3 | Signed Update Manifest & Release Channels Publish canonical update channel manifests ( stable.json, beta.json) signed with Minisign Ed25519. Client updater strictly verifies cryptographic signature before parsing manifest contents or trusting hashes/download URLs, and enforces monotonic version advancement with strict downgrade rejection. |
PASS | Manifest generator in scripts/generate-update-manifest.go with test suite scripts/generate-update-manifest_test.sh (3/3 test cases passing). Pinned release public key in apps/cli/internal/updater/verify.go (RWTcyDWHWbxnuo3LVM5mWoZrx0HDwSQzAZvXK1lPRcdtJxshUDxJh+rE). Signature verification in verify.go and downgrade prevention in updater.go (TestVerifyMinisignSignature, TestUpdater_CheckForUpdate_DowngradeIgnored). Documented in docs/updater.md. |
| 4 | Desktop & CLI Self-Update Engine with Rollback Safety Shared engine updater package ( packages/engine/updater) providing platform-specific atomic apply strategies: Linux AppImage in-place replacement, macOS .app bundle staged swap, Windows NSIS installer relaunch flow. All update paths enforce same-filesystem atomic staging (.tmp-*), .old backup, automatic rollback on failure, and package manager detection (DetectPackageManager) preventing destructive self-update when managed by apt/deb, Homebrew, or WinGet. |
PASS | Shared updater core in packages/engine/updater/updater.go and apply.go. Unit test suite packages/engine/updater/updater_test.go (TestUpdater_Apply_Success, TestUpdater_Apply_RollbackOnFailure, TestDetectPackageManager). Desktop UpdateService in apps/desktop/internal/engine/update_service.go and update_service_test.go (TestUpdateService_CheckForUpdates, TestUpdateService_ApplyUpdate). Desktop web UI integration in apps/web/src/lib/settings/UpdateSettings.svelte and apps/web/src/lib/components/UpdateBanner.svelte. |
| 5 | Mobile Web PWA & Responsive Transfer UX Installable Progressive Web App (PWA) on mobile (Android Chrome & iOS Safari) with Web App Manifest ( manifest.webmanifest), maskable icons, Screen Wake Lock integration, native Web Share API (navigator.share), 1-tap invite link sharing, deep-link parameter parsing (?code=...), min 44px touch targets, mobile notch safe-area insets, and storage capability probing. Strict online-only transfer semantics in Service Worker (sw.js). |
PASS | Web App Manifest apps/web/public/manifest.webmanifest, touch icons in apps/web/public/icons/, service worker in apps/web/public/sw.js with online-only invariant. Capability probing in packages/protocol/src/capability.ts and capability.test.ts. Mobile responsive UI in apps/web/src/App.svelte and TransferView.svelte. Playwright mobile e2e test suite in apps/web/e2e/mobile-transfer.spec.ts executed under CI mobile-chrome profile. Documented in docs/compat-matrix.md. |
| 6 | Server Hardening for Public Operation Multi-dimensional per-IP rate limiting ( ConnBurst/ConnPerSec, RoomCreateBurst/RoomCreatePerSec), connection concurrency caps (MaxConnsPerIP, MaxConnections, MaxRooms), anti-brute-force room code guessing ... |
SendBeam v1.5 — Trusted Device Mesh & Automation
SendBeam v1.5 — Release Gate
The v1.5 milestone (Trusted Device Mesh & Automation: persistent pairwise device identity, mutual SPAKE2-authenticated pairing, forward-secret sendbeam/2 trusted session protocol, epoch-rotated privacy-preserving presence & LAN discovery, automated CLI/desktop transfer operations, scoped auto-accept policy containment, and browser IndexedDB participation with 9-vector adversarial attack matrix containment) gates release on the checks below, each verified against merged main.
Evidence is a deterministic unit/integration test, a verified cross-language vector fixture, or a cryptographic testbed; every transfer across the matrix terminates with an authenticated session transcript and cryptographically verified whole-file SHA-256 digest comparison.
1. Gate Checks
| # | Requirement | Result | Evidence |
|---|---|---|---|
| 1 | One-Time Authenticated Pairing Ceremony Pair once through an authenticated SPAKE2 ceremony with domain-separated Ed25519 signatures, canonical public key ordering, and mutually confirmed pair credentials ( k_pair). |
PASS | Go wire codec and handshake engine in packages/wire/pairing.go, pairing_test.go, and packages/engine/trust/pairing_coordinator.go (TestPairingCoordinator_InitiatorResponderHandshake, TestPairingCoordinator_SignatureVerificationFailureFailsClosed, TestPairingCoordinator_DeviceIDMismatchRejects). TypeScript in packages/protocol/src/pairing.ts and pairing.test.ts. Deterministic cross-language test vectors in packages/wire/testdata/pairing-vectors.json. |
| 2 | Repeat Cryptographic Connection Without Human Code (sendbeam/2)Repeat connections between paired devices authenticate cryptographically via forward-secret ephemeral ECDH ( SessionMaster, k_i2r, k_r2i) and domain-separated challenges with replay and clock skew protection. |
PASS | Go wire protocol and session coordinator in packages/wire/trusted_auth.go, trusted_auth_test.go, and packages/engine/trust/trusted_session.go (TestTrustedSession_InitiatorResponderMutualAuth, TestTrustedSession_ClockSkewRejection, TestTrustedSession_ReplayProtection, TestTrustedSession_RevokedPeerRefusal). TypeScript in packages/protocol/src/trusted-auth.ts and trusted-auth.test.ts. Deterministic vectors in packages/wire/testdata/trusted-session-vectors.json. |
| 3 | CLI Automation & Background Receiver Daemonsendbeam send <paths...> @<device> enables single-command sending to paired devices; sendbeam listen runs an automated background daemon with safe auto-accept policy enforcement; sendbeam devices, pair, and unpair manage mesh state with stable --json output. |
PASS | CLI commands in apps/cli/cmd/sendbeam (devices.go, pair.go, unpair.go, transfers.go, listen.go, trust_config.go). Suite coverage in devices_test.go, pair_test.go, unpair_test.go, transfers_test.go, listen_test.go, and trust_config_test.go (TestListen_AutoAcceptEnforcesDestDirContainment, TestPair_InteractiveAndNonTTY, TestDevices_JsonOutputFormat). Documented in docs/trust-model.md Section 9. |
| 4 | Privacy-Preserving Remote Presence & Blinded LAN Discovery Devices discover paired peers across the Internet via 15-minute epoch-rotated blind rendezvous handles (`HMAC(k_pair, "sendbeam/2 rendezvous-handle:" |
epoch)`), and on local subnets via blinded UDP multicast beacons without leaking device identity or IP addresses. | |
| 5 | Native Desktop Device Manager & System Integration Desktop UI provides honest... |