Skip to content

Rampage 0.3.1 — Interface-aware nearby pairing

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 04 Aug 19:12
v0.3.1-recovery.3
41a091d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Rampage 0.3.1 Recovery Candidate 3

Your laptop should find your main PC—not your VPN adapter

This candidate turns a real two-machine failure into a stronger zero-copy pairing path. A physical Windows laptop remained on Looking for your main PC even though the owner listener, private network, and firewall rule were healthy. Rampage had trusted Windows to choose one interface for global broadcast and multicast; VPN and virtual adapters can win that routing decision and hide the actual Wi-Fi or Ethernet LAN.

Candidate 3 makes discovery interface-aware:

  • sends through multicast and global broadcast
  • sends every unique directed broadcast for every active LAN interface
  • joins the owner multicast group on every active LAN address
  • excludes loopback, link-local, and point-to-point tunnel interfaces
  • bounds the owner and laptop with their own local pairing lifetimes
  • no longer requires synchronized wall clocks for pre-enrollment discovery

The experience stays deliberately small: Find my fabric on the laptop, Add machine on the owner, compare four digits, approve.

The security boundary did not get wider

The owner still opens an explicit three-minute window. Laptop requests remain five-minute, bounded, rate-limited, and capped. Both devices independently derive the same four-digit transcript code from ephemeral X25519 material. The signed enrollment invitation is encrypted with AES-256-GCM under HKDF-SHA-256-derived material, completion is authenticated, and controller/job authority remains separate.

Remote timestamps are now advisory: they cannot extend the owner's local window and cannot silently reject a legitimate nearby laptop because one Windows clock is wrong.

Independently qualified

  • PR #43: Rust, dependency review, CodeQL, Windows/Linux/macOS native packages, Android/iOS candidates, UI, SDK, and Python jobs green
  • tag-bound distribution run 30940450467: Windows, Linux, macOS, provenance, and release assembly green
  • 22 desktop-native tests, including clock-independent loopback enrollment and directed multi-interface broadcast coverage
  • full Rust workspace tests and clippy with warnings denied
  • desktop 18, edge 2, TypeScript SDK 12, intelligence 17, and Python SDK 11 tests
  • RustSec: zero vulnerabilities; 18 target-reviewed warnings
  • isolated Windows installer smoke: six payloads, controller/intelligence ready, signed node/offer, desktop and shell shortcuts, clean uninstall, no sidecar leaks
  • Sigstore/SLSA provenance binds all 12 assets to tag v0.3.1-recovery.3 and commit 41a091dd02232a92238515996fee9387f40223c8

Windows download

Download Rampage 0.3.1 for Windows x64

SHA-256: 793cab7cd16e3c40d8ffe7e91e48729548c8f0b40fe124bf73c4ff0591ccf115

This remains an unsigned release candidate. Windows may show a reputation warning. Physical pairing and Remote Assist certification remain separate gates and will be recorded only after the owner and laptop both run this exact candidate.

Full changelog: v0.3.1-recovery.2...v0.3.1-recovery.3

Assets 14
Loading