Colitu VPN for Linux v1.4.4

Colitu VPN for Linux 1.4.4

• API certificate pinning: the Colitu API, mirrors, endpoint list and updater accept only certificates whose validated chain ends at the ISRG or Google Trust Services roots (checks end 2027-12-31).
• Update manifest freshness: latest.json keeps the old signature for older versions and adds signature_v2 over issued_at/expires_at; 1.4.4+ refuse a manifest older than 30 days or past its expiry.
• Security review fixes: the local proxy never listens on the LAN; Shadowsocks link parsing has a time limit; import accepts share links only; notice links are encoded; DNS of apps in "only selected apps" mode goes to the tunnel's resolver.
• Adaptive Connect: 90 s mid-session penalty for a transport proven on the current network, misses keep counting inside the switch gap, dead warm spares replaced after at most 2 minutes of light traffic. Adaptive Connect 3.0 parts are in the code but switched off.

Download: https://colitu.com/download/linux · Release notes: https://docs.colitu.com/changelog/linux

---

Colitu VPN for Linux. Install on Debian/Ubuntu/Mint with the .deb, on Fedora/RHEL with the .rpm, or unpack the .tar.gz on any distribution.
Guide: https://colitu.com/download/linux · Checksums: SHA256SUMS.

Colitu VPN for Linux v1.4.3

Colitu VPN for Linux 1.4.3

• Warm spare on every connection method: a configuration check refused the spare server on Xray-based connection methods (a leftover stats rule for an inbound the config does not have), so they ran without one.

Colitu VPN for Linux. Install on Debian/Ubuntu/Mint with the .deb, on Fedora/RHEL with the .rpm, or unpack the .tar.gz on any distribution.
Guide: https://colitu.com/download/linux · Checksums: SHA256SUMS.

Colitu VPN for Linux v1.4.2

Colitu VPN for Linux 1.4.2

• Tunnel checks never take another route: the check that confirms the VPN carries traffic (at connect, while connected, after sleep and after a restart) now always goes through the tunnel itself. Before, a split-tunnelling setting ("only selected apps use the VPN", or a bypassed site list) could send that check around a broken tunnel, so the app could report a working connection that was not. Found with a test suggested by an outside reviewer: the tunnel connects but drops everything inside it.

Colitu VPN for Linux. Install on Debian/Ubuntu/Mint with the .deb, on Fedora/RHEL with the .rpm, or unpack the .tar.gz on any distribution.
Guide: https://colitu.com/download/linux · Checksums: SHA256SUMS.

Colitu VPN for Linux v1.4.1

Colitu VPN for Linux 1.4.1

• Local network (precaution): If a connection to a device on your own network (a printer, a network drive, another computer, the router's settings page) ever ends up inside the VPN, it now goes out directly instead of to the VPN server, which cannot reach it. Name lookups still go through the VPN. If the kill switch is set to block the local network, it stays blocked.

Colitu VPN for Linux. Install on Debian/Ubuntu/Mint with the .deb, on Fedora/RHEL with the .rpm, or unpack the .tar.gz on any distribution.
Guide: https://colitu.com/download/linux · Checksums: SHA256SUMS.

Colitu VPN for Linux v1.4.0

Colitu VPN for Linux. Install on Debian/Ubuntu/Mint with the .deb, on Fedora/RHEL with the .rpm, or unpack the .tar.gz on any distribution.
Guide: https://colitu.com/download/linux · Checksums: SHA256SUMS.

Colitu VPN for Linux v1.3.0

Colitu VPN for Linux. Install on Debian/Ubuntu/Mint with the .deb, on Fedora/RHEL with the .rpm, or unpack the .tar.gz on any distribution.
Guide: https://colitu.com/download/linux · Checksums: SHA256SUMS.

Colitu VPN for Linux v1.2.2

Colitu VPN for Linux. Install on Debian/Ubuntu/Mint with the .deb, on Fedora/RHEL with the .rpm, or unpack the .tar.gz on any distribution.
Guide: https://colitu.com/download/linux · Checksums: SHA256SUMS.

Colitu VPN for Linux v1.2.1

Colitu VPN for Linux. Install on Debian/Ubuntu/Mint with the .deb, on Fedora/RHEL with the .rpm, or unpack the .tar.gz on any distribution.
Guide: https://colitu.com/download/linux · Checksums: SHA256SUMS.

Colitu VPN for Linux v1.2.0

Colitu VPN for Linux. Install on Debian/Ubuntu/Mint with the .deb, on Fedora/RHEL with the .rpm, or unpack the .tar.gz on any distribution.
Guide: https://colitu.com/download/linux · Checksums: SHA256SUMS.

Colitu VPN for Linux v1.1.2

Colitu VPN for Linux 1.1.2: security and reliability update (full audit of the Linux app).

Fixes

• Updates now refresh the VPN cores and rule files. Package upgrades used to leave the cores of the first installed version in ~/.local/share/ColituVPN/bin.
• Signing out: a token renewal in flight can no longer bring the session back, a request started before sign-out can no longer wipe the next sign-in or show a false "session expired"; sign-out also removes the imported server profiles and the sudo password.
• Proxy mode on desktops the proxy script can't configure (Sway, Hyprland, bare window managers) no longer reports "connected"; the app asks for TUN mode.
• The watchdog notices when the root sing-box that holds the TUN adapter dies and reconnects.
• Kill switch: the nftables table is replaced in one transaction and the previous root watcher is stopped first; uninstalling removes a left-over table.

Security

• Data folders in the home directory are owner-only (0700) for packaged installs too, and the app runs with umask 077.
• sudo, pkexec, the package managers, xdg-open and notify-send are run by absolute path; the root kill script no longer comes from a user-writable file.
• The core bundle is pinned to a commit of 2dust/v2rayN-core-bin and verified with SHA-256 (Xray 26.9.30, sing-box 1.14.2).
• Share links reject host names that could inject parameters; pings never dial loopback or private addresses; attachment ids are sanitised and downloads size-limited; support diagnostics mask query secrets, e-mails and URL credentials.
• CI: read-only token outside the release job, actions pinned to commits.

Packages

• .deb depends on libssl and the X11 libraries and prefers the newest ICU.

Install

Debian/Ubuntu/Mint: .deb · Fedora/RHEL: .rpm · any distribution: .tar.gz. Also at https://colitu.com/downloads/linux/ · guide: https://colitu.com/download/linux · checksums: SHA256SUMS.
Installed 1.0.0+ apps offer this update by themselves (x64).