Development samples — 0.8.0-rc3

Development sample apps — not a library or production release.

Built from the same source as Maven Central version 0.8.0-rc3. Verified Maven publisher: https://github.com/p2pKit/P2pKit/actions/runs/39130949171 (attempt 1, tag v0.8.0-rc3).

Download the Android .apk, Windows .msi, macOS .dmg or Linux .deb for your platform. Verify SHA256SUMS before opening the package. License/notice material is in sample-notices.zip.

These are development packages: no production signing/notarization, installation test, app-launch, LAN or physical-device qualification is claimed. Do not disable OS security controls. The Desktop UI includes its Java runtime; separate CLI archives remain in the producer's Actions artifacts. The ongoing audit is NOT_READY; advisory exceptions are not vulnerability fixes.

Source: db5d6c01e9a5f0c46fdb51ed0d885a5a394bbe5c / tree 4fccd01ecbac953a9934d5325bd84913e3fc6885.
Qualification: https://github.com/p2pKit/P2pKit/actions/runs/39118439498 (attempt 2).
Reviewed PR: #470.
Manifest SHA-256: d5d4856d65cf44cf2a748e70f887a5111c05d4e14c89a596e0d227c97c055e6e.

Development samples — 0.8.0-rc2

Development sample apps — not a library or production release.

Built from the same source as Maven Central version 0.8.0-rc2. Verified Maven publisher: https://github.com/p2pKit/P2pKit/actions/runs/38986454729 (attempt 1, tag v0.8.0-rc2).

Download the Android .apk, Windows .msi, macOS .dmg or Linux .deb for your platform. Verify SHA256SUMS before opening the package. License/notice material is in sample-notices.zip.

These are development packages: no production signing/notarization, installation test, app-launch, LAN or physical-device qualification is claimed. Do not disable OS security controls. The Desktop UI includes its Java runtime; separate CLI archives remain in the producer's Actions artifacts. The ongoing audit is NOT_READY; advisory exceptions are not vulnerability fixes.

Source: bd98deeb6ab44b5f5126d88742aa69b57f290c32 / tree 917b0ebf6c170ead754d50df698c4ecaf582d50c.
Qualification: https://github.com/p2pKit/P2pKit/actions/runs/38976015179 (attempt 1).
Reviewed PR: #468.
Manifest SHA-256: e1df4541326d5e68ec7008f1929fc13f837017dbb9a95367720b0968b38100c6.

Development preview apps — 2026-09-16 (8e4ca8383f5f)

Development preview — existing 16 September 2026 builds

These four downloads are now being distributed from the successful existing preview build. They are not a qualified main/library release, a new build, or a production distribution.

Platform	Download	Installation target
Android	P2pKit-preview-android-8e4ca8383f5f.apk	Debug APK; Android 7.0 / API 24+ as declared by the sample, subject to OS policy.
Windows	P2pKit-preview-windows-x64-8e4ca8383f5f.msi	x64 Desktop UI installer; Java runtime included.
macOS	P2pKit-preview-macos-arm64-8e4ca8383f5f.dmg	Apple Silicon / ARM64 Desktop UI; Java runtime included. Not an Intel build.
Linux	P2pKit-preview-linux-x64-8e4ca8383f5f.deb	x64 Desktop UI package for compatible Debian/Ubuntu systems; Java runtime included.

Download and install

1. Download the matching installer from Assets below. No GitHub login or CI-evidence key is required.
2. Compare its SHA-256 with SHA256SUMS before opening it. Keep sample-notices.zip when redistributing.
3. Use the operating system's normal installer. On macOS, open the DMG and copy the application to Applications; on Linux, use the package manager for the local DEB.

These are development packages. Production signing/notarization has not been qualified, and OS security policy may warn or block installation. Do not disable OS security protections. No installation, application-launch or LAN-runtime test is claimed for these downloads, so successful packaging does not guarantee operation on every machine.

For sample networking, use a controlled, trusted LAN and the same AppId on both peers. These are deliberately permissive development harnesses, not production peer-authorization policy. See the source-bound sample guide for pairing and security limitations. Physical-device qualification remains deferred.

Provenance and limits

• Original source commit: 8e4ca8383f5f54a03f7b64f3c8f92225c00deb5b.
• Original source tree: 7978ccd6ae89b478a2ff45ab89349adc6764c932.
• Original Desktop cross-host preview run 35070982169, attempt 1, completed successfully on 2026-09-16.
• The explicit sample-apps operation was build/packaging-only; it did not run the omitted CLI/UI test suites.
• Installers are byte-for-byte copies from those original Actions bundles. No rebuild, re-signing or binary modification was performed. Original archive SHA-256, every retained member checksum, exact source/run bindings, and selected installer SHA-256 were checked before upload.
• sample-preview.json records the exact artifact IDs, original archive hashes and installer hashes. sample-notices.zip contains the source-matched P2pKit/JmDNS license and notice files.
• This preview contains the 16 September source, not subsequent campaign changes or current main. It is a separate owner-authorized preview redistribution, not a successful execution of the gated main publisher.
• Full qualification/audit remains NOT_READY. Existing main-release HOLDs, required checks, trusted-main/custody work and approval requirements remain in place; that lane is paused, not completed.
• Known Kotlin advisory GHSA-r937-wjx7-w2jp / CVE-2026-53914 remains EXCEPTED_NOT_FIXED (recorded exception expiry 2026-10-31). This preview does not claim a fresh vulnerability qualification or remediation.
• No Maven Central, Store or production publication is performed, and published RC history is unchanged.

These public Release assets are separate from encrypted private CI evidence and do not inherit Actions artifacts' 14-day expiration. The original Actions bundles expire on 30 September; these Release assets remain available unless explicitly removed.

P2pKit 0.7.0-rc3

P2pKit 0.7.0-rc3 is the immutable release-candidate artifact set for the remaining external validation campaigns.

Published coordinates use io.github.apdelrahman1911 and are available from Maven Central. Keep all P2pKit modules on version 0.7.0-rc3.

Highlights

• preserves the RC2 public API and secure-v2 wire format
• incorporates coordinated JVM, Android, and Apple LAN recovery and lifecycle fixes
• includes curated dependency and Kotlin 2.4.10 toolchain updates while retaining the explicit iOS 14 floor
• strengthens sample diagnostics, repository policy, release signing isolation, and publication-consumer verification

Publication evidence

• source/tag commit: deed9e7
• Central deployment: 97d4df9f-2f28-4ae2-aa44-d05d055d94dc
• publication workflow: https://github.com/p2pKit/P2pKit/actions/runs/31309371132
• release record: https://github.com/p2pKit/P2pKit/blob/main/docs/releases/0.7.0-rc3.md

Automated module/platform, ABI, Dokka, publication shape, isolated consumer, SBOM, signing, provenance, Swift warnings-as-errors, XCFramework, OSV, and dependency checks passed. This remains a release candidate, not a claim of complete production validation.

Still pending

• Android physical-device validation
• Apple device, AWDL, path-rotation, background, and restart validation
• two-machine hostile-network validation
• CLI fault injection and headful Desktop observation
• independent secure-v2 interoperability validation
• professional cryptographic audit

P2pKit 0.7.0-rc2

P2pKit 0.7.0-rc2 is a signed release candidate published to Maven Central under the verified namespace io.github.apdelrahman1911.

Maven Central coordinates

• io.github.apdelrahman1911:p2p-core:0.7.0-rc2
• io.github.apdelrahman1911:p2p-transport-lan:0.7.0-rc2
• io.github.apdelrahman1911:p2p-network-provisioning-android:0.7.0-rc2
• io.github.apdelrahman1911:p2p-network-provisioning-desktop:0.7.0-rc2

See the 0.7.0-rc2 release record for the verified source commit, publication evidence, and compatibility details.

Validation status

This is a release candidate. It must not be treated as fully production-validated. The following external validation areas remain pending:

• Android physical-device validation
• Apple device, AWDL, path-rotation, background, and process-restart validation
• Two-machine hostile-network validation
• CLI fault injection and headful Desktop observation
• Independent secure-v2 interoperability validation
• Professional cryptographic audit

These pending areas are documented in the repository validation plan and are not represented as verified or completed by this release.