v0.1.0

0.1.0 (2026-08-31)

⚠ BREAKING CHANGES

• spec: fileID is generated by the client and sent in Upload-Metadata at creation. The key schedule is unchanged and no test vectors are affected.

Features

• blob: add an S3-compatible backend and a blob conformance suite (43973e5)
• blob: add an S3-compatible backend and a blob conformance suite (d8dbba9), closes #20
• blob: add streaming blob storage with crypto-shredding (557650b)
• blob: add streaming blob storage with crypto-shredding (25b7832), closes #19 #21 #13
• blob: store chunked uploads as S3 multipart uploads (502c68c)
• blob: store chunked uploads as S3 multipart uploads (799dc1b), closes #111
• blob: support resumable writes on both backends (10b1f80)
• blob: support resumable writes on both backends (24489d6)
• cli: hide the password as it is typed, and let return mean none (4e9b9db)
• cli: password, expiry and download limit for uploads (0ff5d69)
• cli: password, expiry and download limit for uploads (ba6d9e1), closes #43
• cli: reproducible cross-platform builds with published checksums (d28c995)
• cli: reproducible cross-platform builds with published checksums (cdcc10a), closes #44 #45
• cli: require a signature on the client asset manifest (1b2c043)
• cli: require a signature on the client asset manifest (fdc9b16), closes #104
• cli: send and receive from the command line (f857b46)
• cli: send and receive from the command line (a64dcf4), closes #42
• cli: sendan verify - check an instance serves the published client (a29fe21), closes #103
• cli: sendan verify — check an instance serves the published client (ca40af6)
• compat: apply the bounded-upload rule here too (0e2e8e0)
• compat: the password model, and marking what it protects (713134e)
• compat: the password model, and marking what it protects (e202360), closes #52
• compat: third-party client compatibility endpoints (21305f8)
• compat: third-party client compatibility endpoints (60f4f25), closes #51 #53
• crypto: add streaming content encryption and decryption (8cffe31)
• crypto: add streaming content encryption and decryption (ad8710b), closes #3
• crypto: add the key schedule, password derivation and wrapping (3d6aa48)
• crypto: add the key schedule, password derivation and wrapping (d046eaf), closes #15 #2 #4 #5 #6
• deploy: compose example, and the proxy settings that make it work (8bb0a0d)
• deploy: compose example, and the proxy settings that make it work (27bd309), closes #58
• docker: multi-stage Dockerfile producing a scratch-based image (e749e8e)
• docker: multi-stage Dockerfile producing a scratch-based image (595b7dc), closes #46
• http: accept resumable uploads over tus (db56ea2)
• http: accept resumable uploads over tus (c4e21ee)
• http: allow the client's inline bootstrap by hash (dc7c6d5)
• http: allow the client's inline bootstrap by hash (10ce0a4)
• http: apply security headers to every response (337b3fb)
• http: apply security headers to every response (b176653)
• http: rate limit requests per client address (ec106f7)
• http: rate limit requests per client address (084c5e0)
• http: report the running build at /api/source (67cf858)
• http: report the running build at /api/source (e7140de)
• http: serve encrypted upload metadata (7a6a3b5)
• http: serve encrypted upload metadata (f87238a)
• http: stream ciphertext with range support (81cd74c)
• http: stream ciphertext with range support (7e37c95)
• http: verify download tokens before serving anything (e3437ee)
• http: verify download tokens before serving anything (6d674b0)
• let an operator display a banner (24ff59e), closes #198
• publish what an instance permits, and show it before an upload (2733a06), closes #195
• ratelimit: add structural abuse controls (fc9aa30)
• ratelimit: add structural abuse controls (0dcb871), closes #25
• server: add the module layout, configuration and structured logging (175c054)
• server: add the module layout, configuration and structured logging (98110d9), closes #15 #16 #26
• server: open the configured backends and run the reaper (3233938)
• server: open the configured backends and run the reaper (d327ae5), closes #79
• signature: require a post-quantum signature on the release manifest (cf49402)
• signature: require a post-quantum signature on the release manifest (dd1f19c), closes #60
• store: add a PostgreSQL backend and a store conformance suite (e4609ce)
• store: add a PostgreSQL backend and a store conformance suite (589da8a), closes #18 #73
• store: add the metadata store with a SQLite backend and migrations (9bf02a3)
• store: add the metadata store with a SQLite backend and migrations (b25d45c), closes #17
• store: count downloads by volume served, not by request (6529c6c)
• store: count downloads by volume served, not by request (8c8c77a)
• store: distinguish an upload that is still being written (6cffa18)
• store: distinguish an upload that is still being written (35c7349)
• store: optionally wrap at-rest keys under an operator-held master key (f5c1754)
• store: optionally wrap at-rest keys under an operator-held master key (7b378fc), closes #73
• store: storage for third-party compatibility uploads (b827851)
• store: storage for third-party compatibility uploads (652f4c7), closes #51
• upload: add the expiry engine, reaper and deletion guarantee (06ddcb6)
• upload: add the expiry engine, reaper and deletion guarantee (0fd133f), closes #22 #23 #24
• upload: make the owner token usable (9941487)
• upload: make the owner token usable (f2dee85), closes #54
• upload: require a deadline or a download limit, configurably (fbaa50b)
• upload: require a deadline or a download limit, configurably (8b0ca4e)
• web: a code to scan for the link (43007e5), closes #197
• web: choosing light, dark or the system theme (a0a45d7), closes #176
• web: delete an upload from the list (780b67a)
• web: delete an upload from the list (84ab5db), closes #56
• web: design tokens and light and dark themes (eddb07f), closes #175
• web: download flow with password prompt (75df21c)
• web: download flow with password prompt (8c8b868), closes #36
• web: encrypted export and import of the upload list (c8efacc)
• web: encrypted export and import of the upload list (b0195e6), closes #57
• web: keep a list of this browser's uploads (e6ee553)
• web: keep a list of this browser's uploads (8ef4f4d), closes #55
• web: mark the source link (91b9503), closes #199
• web: name the retention the instance actually applies (2e8717f), closes #190 #191
• web: offer to generate a password worth using (a10128d), closes #196
• web: port the key schedule, password derivation and wrapping (d04399a)
• web: port the key schedule, password derivation and wrapping (8a7e22f), closes #7 #9 #10 #65
• web: port the streaming content encoding (11681b4)
• web: port the streaming content encoding (9048dd4), closes #8 #11 #13
• web: save through a service worker where there is no file picker (0c7f4b0)
• web: save through a service worker where there is no file picker (31297b3), closes #37
• web: say how large a file may be, before one is chosen (ec8778c), closes #189
• web: say what protected a file in words, not only in parameters (e08ca3f), closes #194
• web: scaffold the client and embed it in the binary (de6f1b8)
• web: scaffold the client and embed it in the binary (dd61acf)
• web: serve the notices for the code the client ships (fb0dbfa), closes #201
• web: show the running build and its source in the footer (ad0d3a9)
• web: show the running build and its source in the footer (4e8d71e)
• web: state what the published client hashes to (955ad4f)
• web: state what the published client hashes to (3669409), closes #102
• web: stream a download straight to disk where the browser allows (98d8c46)
• web: stream a download straight to disk where the browser allows (296ff56), closes #38
• web: stream the upload body where the browser and connection allow it (bd46b7d)
• web: stream the upload body where the browser and connection allow it (bc3a1df), closes #28
• web: style the three pages (f375b6c), closes #178 #179 #180
• web: the layout shell (4ed9432), closes #177
• web: transparency card reporting what actually protected a file (083a124)
• web: transparency card reporting what actually protected a file (64bd5cb), closes #39
• web: upload flow with progress and per-upload options (983be7b)
• web: upload flow with progress and per-upload options (970e2d9), closes #35

Bug Fixes

• api: answer a taken upload identifier with 409, not 500 (3933bd5)
• api: answer a taken upload identifier with 409, not 500 (2a2a49b), closes #133
• api: answer with a Location that describes the client's request (b7435d7)
• api: answer with a Location that describes the client's request (46b209f), closes #132
• build: hold the container image to the same Go as everything else (60423cd)
• build: run the checks against the toolchain go.mod names (3f1b221), closes #183
• ci: have the release commit sign itself off (875e3ce), closes #172
• ci: keep releases in 0.x until 1.0.0 is earned (a8f1a11)
• ci: keep releases in 0.x until 1.0.0 is earned (c98eb80)
• ci: make the asset audit test what it claims, and survive a clean checkout (3422fc6)
• ci: name the first release, since a manifest alone does not (165c387), closes #172
• ci: pin the Go toolchain to 1.25.13 (cd0240f)
• ci: repair the coverage advisory and raise the floor it flagged (9fabeab)
• ci: restore a green security scan (56ad887)
• ci: stop naming the package, and apply the pre-1.0 rule where it is read (92e0bde)
• ci: take the image name down to lowercase before pushing it (3ddebb1)
• crypto: bound metadata size to JavaScript-safe integers (f58b075)
• deps: update nanoid to 3.3.18 (abf885a)
• http: inject the client so serving it can be tested without a build (46cf018)
• http: stop logging the request path on a server error (40aae9b)
• spec: the client generates the file identifier (2a49c21)
• stop .gitignore excluding scripts/coverage.sh (ef04ea1)
• upload: bound integer conversions where the analyser can see it (72bdcf2)
• web: check the browser can do this, and say so plainly when it cannot (f804cde)
• web: check the browser can do this, and say so plainly when it cannot (6415c59), closes #130
• web: make the theme control quieter, and name its states in words (ccc4fc6)
• web: one icon button, two themes (a21cdfb), closes #192
• web: open the source link in a new tab (f85d9d4), closes #193
• web: rename a test binding that shadows a global (d7580ed)
• web: three theme choices instead of one control that cycles (72b1892), closes #192
• web: wait for the write to commit before saying it is done (daeccbf), closes #171