Lantern DSSE 0.3.0 — Experimental OSS

Lantern DSSE 0.3.0 — Experimental OSS

Lantern DSSE is an open-source, self-hosted Secure Service Edge with ZTNA, TLS inspection,
DNS control, DLP, SaaS tenant restrictions, regional failover, Connectors, and an admin console.
The source is available under Apache-2.0. This Experimental release is intended for evaluation.

Start here

• Installation and configuration
• Release overview and implementation limits
• Company and product website

Build the server and Connector from the tagged source, then follow the deployment guide.
Use the AdminConsole to create the organization and issue its onboarding configuration.

Endpoint downloads

Platform	Asset	Verification
macOS, Apple silicon	LanternDsseAgent-0.3.0-20260909070000.pkg	Apple Developer ID signature and notarization; Lantern Networks, Inc., team M4U8GSBL6C
Windows, x64	DsseAgent-0.3.0-windows-x64.msi	Authenticode signature and timestamp; LANTERN NETWORKS, INC.

Both packages are independent of tenant and deployment. The signed onboarding profile,
its verification key, and the enrollment token are separate inputs. No deployment credentials
are included in the packages. Follow the platform installation guide before enabling traffic steering.

SHA256SUMS contains file hashes. release-manifest.json records package identities, source
correspondence, the Windows payload inventory, and the service binary used for final evaluation.
The macOS package was checked on macOS 26.6.2 (25G83), arm64.

Verification scope

The service evaluation used three regions with one Edge node per region and two Connector sites,
with regional failover configured. Server transport certificates had a 12-hour lifetime.
Two overlapping approximately 30-hour observation windows each recorded 21,588 successful
fresh TLS/HTTP checks across both tenants and all three regions, with five distinct server
certificates per region/tenant lane. The windows overlap; they are not a combined 60-hour run.
These measurements cover transport-certificate rotation, not 60-day device-certificate endurance.

Subsequent service changes received separate regression and short deployment checks. They include
Connector backend-refusal isolation, recovery routing on the agent port, recovery names in
Console-issued profiles, organization-bound recovery verification, and Windows certificate
selection when applying a different organization's configuration. The final service binary is
not represented as having completed the earlier 30-hour observations.

Final package signatures and checksums were verified independently. Binary analysis of the seven
Windows Go executables found no called vulnerable symbols. See the source SBOM and module notices
for dependency scope; these checks are not an independent security audit or a production guarantee.

Dependency inventory and reporting

dsse-0.3.0-source-sbom.cdx.json is a CycloneDX inventory of the tagged source's Go module dependencies,
generated with Go 1.27.1. It does not inventory all native code, Windows driver components,
optional egress-broker native dependencies, or container OS packages. Their applicable license
notices remain in the source tree. The standard service build uses the Go upstream path;
browser-faithful forwarding through the optional broker requires separate integration.

Please report vulnerabilities through GitHub private vulnerability reporting,
as described in SECURITY.md.