Skip to content

v2.0.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Sep 11:45
· 43 commits to main since this release
v2.0.0
27ff753

PureSend v2.0.0 🚀

An end-to-end encrypted, direct peer-to-peer (P2P) file and directory transfer system built with Go.

⚠️ Breaking Changes (Why v2.0.0?)

This is a major release resulting from a comprehensive security audit of version 1.0.0. The rendezvous protocol has been upgraded to /puresend/rendezvous/2.0.0 and is not backward-compatible with v1.0.0 clients/servers.

🛡️ Security and Architectural Updates:

  • Server No Longer Sees the Password (Magic-Wormhole Model): Codes are now split; the server only sees the public room number (nameplate: 42), while the secret words (kiraz-liman) are never transmitted to the server and are strictly used in the peer-to-peer PAKE handshake. The risk of server-side MITM is completely eliminated.
  • Dynamic Room Scaling: Room numbers start at a minimum of 2 digits (10..99) and dynamically expand to 3, 4, 5+ digits as server occupancy increases to preserve sparsity rules. The concurrent room limit has been removed.
  • Brute-Force Protection: After 3 incorrect code attempts, the room deletes itself from the server and self-destructs. The confirmation tag is not presented until the remote peer verifies their key.
  • DoS and Resource Protection: The server-wide global minute registration budget (-register-budget) has been removed; when the table is full, disconnected rooms are evicted.
  • Integrity and Signature Verification: puresend -update, install.sh, and install.ps1 now perform SHA-256 integrity checks via checksums.txt and digital signature verification via minisign.
  • Filesystem Security: Prevented downloading directly to the home directory (CheckDestination), blocked file exfiltration through symlinks (checkNoLinks), and mitigated TOCTOU race conditions via atomic hard links (place()).

⚡ Quick Install (One-Liner)

  • Linux & macOS (Arch, Ubuntu, Fedora, Debian, macOS):
curl -fsSL https://raw.githubusercontent.com/Baaaki/PureSend/main/install.sh | sh
  • Windows (PowerShell):
irm https://raw.githubusercontent.com/Baaaki/PureSend/main/install.ps1 | iex

📦 Manual Installation & Direct Downloads (Assets)

  • 🪟 Windows (x86_64): Download the .zip archive, extract it, and run puresend.exe.
  • 📦 Debian / Ubuntu (amd64): Download the .deb package and install it via double-click or run sudo dpkg -i puresend_*.deb.
  • 🐧 Linux (x86_64): Extract the .tar.gz archive and run it directly from the terminal (./puresend).
  • 🍏 macOS (Apple Silicon - M1/M2/M3/M4): Extract the .tar.gz archive and run it from the terminal (./puresend).

💡 macOS Note: If macOS Gatekeeper shows an "unverified developer" warning on first launch, remove the quarantine flag by running the following command in your terminal:
xattr -d com.apple.quarantine puresend

Assets 7
Loading