Send a file out of your own cloud — encrypted, expiring, one command.
Sharing a largeish file is still annoying: stand up a bucket, mint a presigned URL, and remember to delete the thing afterward. dove makes it one command against infrastructure you own, and cleans up after itself.
dove share report.pdf --expires 3d # → a link that dies in 3 days
dove share build.zip --downloads 1 # → a one-time download linkIf git-ark is a write-only vault — encrypt to you, lock everything down — dove is git-ark turned inside out: encrypt to a link, hand out exactly as much access as you allow, then forget.
The full v1 design — architecture, encryption, threat model — is written up in docs/designs/dove-v1.md.
- Simple — just a bucket.
dove share f --expires 5duploads, prints a presigned URL, and a lifecycle rule auto-deletes it. Seconds to set up; no servers. (Presigned URLs cap at 7 days — that's an AWS limit, and the clean line into the full tier.) - Full — the works: files are encrypted client-side in chunks, the decryption key travels only in the URL fragment (never sent to any server), and an access-policy gate enforces one-time / N-time / expiry downloads — while being structurally unable to read a byte of your file. Optional custom domain.
Stand up the simple tier once — a private, auto-expiring bucket in your own AWS account (it asks which profile, and derives the rest):
dove provision simple
dove share report.pdf --expires 3d # uploads, prints a self-deleting linkFor the encrypted, download-limited full tier — a policy gate on your account, optionally behind your own subdomain:
dove provision full
dove domain add share.example.com # optional custom domain
dove share invoice.pdf --encrypt --downloads 1 --pin --from "Ada"
# → a short link (constant length, whatever the message). The key rides its
# #fragment and never reaches a server; the PIN is checked at the gate and
# folded into the key. Open it in a browser, or: dove get <link> --pin 4917Everyday commands: dove ls (what's live), dove revoke <id> (kill a link
early), dove status (what's provisioned), and dove gate disable|enable — a
manual panic switch that takes the gate offline at no cost (the built-in cost
breaker pulls the same lever automatically if traffic ever floods it).
The core guarantee: the infrastructure that stores and gates access to a file
can never read it. Files are encrypted with AES-256-GCM before upload; the key
lives in the URL fragment (…#key), which browsers and HTTP clients never send
to a server. So S3, CloudFront, and the policy Lambda hold ciphertext and
enforce how many times / how long — never what. See
docs/designs/dove-v1.md for the full model.
macOS / Linux — the installer script, or Homebrew:
curl -fsSL https://raw.githubusercontent.com/boomctl/dove/main/install.sh | sh
# or: brew install boomctl/tap/doveWindows — PowerShell, or Scoop:
irm https://raw.githubusercontent.com/boomctl/dove/main/install.ps1 | iex
# or: scoop bucket add boomctl https://github.com/boomctl/scoop-bucket; scoop install doveFrom source — needs Rust and the AWS CLI (provisioning shells out to it):
git clone https://github.com/boomctl/dove && cd dove
cargo install --path .With Cargo — from crates.io. The crate is dove-cli (it installs a dove
binary; the dove crate name belongs to an unrelated project):
cargo install dove-cliEvery release ships prebuilt binaries for macOS, Linux, and Windows from
dove.sh and
github.com/boomctl/dove/releases —
each checksummed and signed with Sigstore (keyless, publicly verifiable with
cosign verify-blob); the Homebrew and Scoop manifests are generated from those
same checksums. Never run an artifact you can't verify. (Packages land with the
first tagged release.)
dove is co-built with Claude (Anthropic's
Claude Code) working alongside its author. It's a sibling to
git-ark and shares its "your own cloud,
one command, get out of the way" spirit.