Repository navigation
v2.0.0
SendBeam v2.0.0
Cryptographic Verification
All release binaries and installer packages are cryptographically signed and verifiable end-to-end:
- Minisign (Ed25519):
# Verify SHA256SUMS.txt using the official SendBeam public key:
minisign -Vm SHA256SUMS.txt -P RWTcyDWHWbxnuo3LVM5mWoZrx0HDwSQzAZvXK1lPRcdtJxshUDxJh+rE- Sigstore Cosign (Keyless OIDC):
# Verify the GitHub Actions OIDC identity attestation:
cosign verify-blob --bundle SHA256SUMS.txt.sigstore.json --certificate-identity-regexp 'github.com/Akshay7273/sendbeam' --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS.txt- SHA-256 Checksums:
# Verify downloaded asset checksum against the signed manifest:
sha256sum -c SHA256SUMS.txt --ignore-missingChanges
SendBeam v1.7 — Release Gate
The v1.7 milestone (Mesh Maturity & Wire Privacy: signed revocation records with opportunistic mesh sync, multi-device broadcast send with independent failure domains, negotiated wire traffic padding with power-of-two bucket quantization, relay metadata defenses with sender timing jitter, and zero-cost package manager distribution across Homebrew, Scoop, WinGet, and Arch Linux AUR) gates release on the checks below, each verified against merged main.
Evidence is a deterministic unit/integration test, a verified cross-platform build fixture, or a cryptographic testbed; every binary, manifest, and transfer across the matrix satisfies strict verification standards.
1. Gate Checks
| # | Requirement | Result | Evidence |
|---|---|---|---|
| 1 |
Signed Revocation Records & Opportunistic Mesh Sync (ADR 0008) Generate canonical, domain-separated revocation statements signed by the revoking device's Ed25519 identity key ( RevocationRecord). Propagate opportunistically over authenticated sendbeam/2 trusted sessions. Validate signature against stored revoker public key, enforce strict sequence number monotonicity (Seq > StoredSeq), reject timestamp skew (> ±5 min), and fail closed on distrusted revokers (ErrUntrustedPeer / ErrTrustedPeerRevoked). Expand attack matrix to 12 vectors. |
PASS | Design in docs/adr/0008-revocation-sync.md. Wire codec and cross-language test vectors in packages/wire/revocation.go, revocation_test.go, packages/wire/testdata/revocation_vectors.json, and packages/protocol/src/revocation.ts, revocation.test.ts. Trust store sync engine in packages/engine/trust/revocation_sync.go and revocation_sync_test.go (TestRevocationSync_ThreeDevicePropagation, TestRevocationSync_MonotonicSequenceEnforced, TestRevocationSync_UntrustedRevokerRejected). Attack matrix test suites in packages/wire/attack_matrix_test.go, packages/engine/trust/attack_matrix_test.go, and packages/protocol/src/attack-matrix.test.ts (12/12 vectors passing in Go and TypeScript). Documented in docs/trust-model.md. |
| 2 |
Multi-Device Broadcast Send & Independent Failure Isolation Support concurrent transfer fan-out to multiple paired targets ( sendbeam send <files...> @device1 @device2 @device3). Bounded concurrency, per-target progress reporting, and stable --json output (ok, offline, refused, failed). Enforce strict partial-failure isolation (one target failure never aborts or corrupts concurrent transfers to other peers). Process exit code is zero only if all targets succeed. Desktop and Web UI multi-select send flows with per-device retry. |
PASS | Broadcast coordinator in packages/engine/transfer/broadcast.go and broadcast_test.go (TestBroadcastCoordinator_AllSucceed, TestBroadcastCoordinator_PartialFailure, TestBroadcastCoordinator_OfflineTargetIgnored, TestBroadcastCoordinator_DigestVerifiedPerTarget). CLI argument parsing, progress table, and JSON telemetry in apps/cli/cmd/sendbeam/main.go and apps/cli/cmd/sendbeam/main_test.go (TestSendBroadcast_CLIArguments, TestSendBroadcast_ExitCodes, TestSendBroadcast_JSONOutput). Web/Desktop multi-select UI in apps/web/src/lib/trust/DevicesModal.svelte and apps/web/src/lib/trust/devices.test.ts. |
| 3 |
Wire Privacy: Negotiated Traffic Padding (ADR 0009) Negotiate optional padding feature flag during caps exchange. Quantize frame payloads into discrete power-of-two bucket sizes (--private flag and settings toggle. Backward and forward compatible with unpadded v1.6 peers (unpadded fallback). Measured overhead <0.05% CPU. |
PASS | Design in docs/adr/0009-negotiated-traffic-padding.md. Wire padding codec, validation, and cross-language test vectors in packages/wire/padding.go, padding_test.go, packages/wire/testdata/padding_vectors.json, and packages/protocol/src/padding.ts, padding.test.ts, padding-vector.test.ts. Engine transfer integration in packages/engine/transfer/padding_test.go and packages/protocol/src/transfer-sender.ts. Caps negotiation tests in packages/wire/transfer_set_test.go and packages/protocol/src/transfer-set.test.ts. Performance benchmarks documented in docs/BENCHMARKS.md and docs/compat-matrix.md. |
| 4 |
Relay Metadata Defenses & Sender Timing Jitter Enforce uniform power-of-two frame sizing across the WebSocket relay path when padding is negotiated. Provide optional sender-side randomized scheduling jitter (configurable window up to 15ms) to disrupt burst timing correlation without impacting throughput. Audit server logs and Prometheus metrics to verify zero per-frame payload, tag, or header logging. Document coarse-grain residual metadata (socket correlation, macro session duration) in threat model without overclaiming. |
PASS | Relay uniform framing and jitter scheduling in packages/engine/transfer/driver.go and driver_test.go (TestDriver_RelayWithPaddingAndJitter, TestDriver_TimingJitterBounds). Server log and metrics audit in apps/server/internal/signal/metrics_test.go and apps/server/internal/signal/hub_test.go (TestHub_RelayZeroLoggingAudit, TestMetrics_ZeroPIIInvariant). Threat model before/after metadata comparison table in docs/threat-model.md. |
| 5 |
Zero-Cost Package-Manager Distribution (Homebrew, Scoop, WinGet, AUR) Publish automated, cryptographically validated package manifests and formulas: Homebrew formula ( Formula/sendbeam.rb, packaging/homebrew/Formula/sendbeam.rb) for macOS and Linux (arm64, amd64); Scoop bucket manifest (bucket/sendbeam.json, packaging/scoop/sendbeam.json) for Windows (amd64, arm64); WinGet manifests (packaging/winget/manifests/s/SendBeam/SendBeam/<version>/); Arch Linux AUR package (packaging/aur/PKGBUILD, .SRCINFO). All manifests verified against signed SHA256SUMS.txt. |
PASS | Automated Go manifest generator & validator scripts/generate-package-manifests.go and comprehensive test suite scripts/generate-package-manifests_test.sh (assertions for brew, scoop, winget, aur, strict --validate mode, fail-closed tampered hash rejection, fail-closed missing hash rejection, and simulated binary execution). CI validation wired into .github/workflows/distribution.yml and release generation wired into .github/workflows/release.yml. Documented in docs/install.md, docs/distribution.md, and README.md. |
| 6 |
Milestone Gate Verification & Documentation Coherence All 6 PRs merged cleanly to main. CI runs 100% green with 0 failing checks across Go -race tests, TypeScript checks, ESLint, Prettier, Playwright e2e (including mobile profiles), and distribution builds. Full documentation synchronization across protocol, threat model, trust model, compatibility matrix, install guides, and benchmarks. |
PASS | Complete CI runs 33329900709 (CI) and 33329900780 (publish) verified 100% green on main. Full local validation gate passing cleanly (just fmt, just lint, just typecheck, pnpm format:check, just test, and all script test suites). |
2. Release Artifacts Matrix
The following artifacts and package manager manifests are produced and cryptographically signed on release tags (v*):
| Category | Artifact Name / Path | Platform / Target | Packaging / Format |
|---|---|---|---|
| CLI Binaries | sendbeam-cli-linux-amd64.tar.gz |
Linux (x86_64) |
Standalone tarball with license & readme |
sendbeam-cli-linux-arm64.tar.gz |
Linux (aarch64) |
Standalone tarball with license & readme | |
sendbeam-cli-darwin-amd64.tar.gz |
macOS (x86_64) |
Standalone tarball with license & readme |