Skip to content

v1.12.0

Choose a tag to compare

View all tags
@proofoftrinity proofoftrinity released this 02 Oct 02:20
· 22 commits to main since this release
v1.12.0
This tag was signed with the committer’s verified signature.
proofoftrinity Trinity
SSH Key Fingerprint: HGWvk00cwVqxKXxfkwRIk/jUr3RiXz3WztzvWXKspq0
Verified
Learn about vigilant mode.
96e848c
This commit was signed with the committer’s verified signature.
proofoftrinity Trinity
SSH Key Fingerprint: HGWvk00cwVqxKXxfkwRIk/jUr3RiXz3WztzvWXKspq0
Verified
Learn about vigilant mode.

Katacomb VPN 1.12.0

A desktop client for the Sentinel decentralized VPN network. Pick a node, pay for a
session on-chain, and tunnel through WireGuard, AmneziaWG, OpenVPN, V2Ray, XRAY or
Hysteria2.

1.12.0 is a small feature release. You can now find nodes by the version of the node
software they run, and sort the node table by it.

Highlights

  • Search by version. The search box on the Nodes tab now matches a node's version as
    well as its name, address and location. Type 9.2 to list the nodes running 9.2.x,
    8.3.1 for that release, or 9. for every 9.x node. Node addresses never contain a
    dot, so a version query does not also match addresses the way a bare number does. The
    same search works on the Multi-hop tab.
  • Sort by version, with no new column. The Type header now has a ver button next
    to "Type". The first click puts the oldest versions at the top, and a second click the
    newest. Clicking "Type" still sorts by protocol. The version stays where it was, on the
    second line of each Type cell.
  • Nothing else changes. Connecting, sessions and the packaging are the same as in
    1.11.2.

Fixes in 1.12.0

  • Nodes tab: search and sort by node version

Known limitations

  • A chain has a hard life of about two hours. Measured on mainnet: exit hops report
    no usage to the chain, so the exit's idle deadline is pinned at purchase and never
    moves, even while the entry still has quota. This is node-side behaviour, not a client
    bug, but it is yours to plan around.
  • Chains can only be built from V2Ray and XRAY nodes. The other protocols have no
    equivalent of the relay mechanism a chain needs.
  • Expect roughly 2 to 3 MB/s and a large latency increase on a chain. Chains are for
    privacy, not speed.
  • Without systemd-resolved, a missing resolvconf still shows up after you pay. The
    app cannot safely install one on such a system, so a WireGuard or AmneziaWG connection
    there pays first, then offers Retry without VPN DNS on the same session, which sends
    your DNS queries outside the tunnel. To avoid it, set up a resolvconf provider such as
    openresolv the way your distribution documents.
  • Local-proxy mode tunnels only the apps you point at its SOCKS address. Everything else
    leaks, by design, and the kill switch does not apply.
  • The TLS and Reality wrapping does not authenticate the node. There is nothing on chain
    to verify a node's certificate against, so an attacker on your local network can answer
    a handshake in a node's place.

Platform support

Linux x86_64 only. Tested on Debian 11+, Ubuntu 20.04+, and derivatives (Mint,
Pop!_OS, Zorin). The packaging is unchanged since 1.11.2, whose .deb and AppImage were
checked on a clean Ubuntu 24.04 desktop, the .deb in containers on Debian 12 and 13 and
Ubuntu 22.04, 24.04 and 26.04, and the AppImage in containers on those and Fedora 44.

Installation

Recommended: .deb

sudo apt install ./katacomb-vpn_1.12.0_amd64.deb

Installs a root daemon, so connect and disconnect never prompt for a password. It needs
one log out and log back in after the first install before that takes effect.

Alternative: AppImage

chmod +x katacomb-vpn-1.12.0.AppImage
./katacomb-vpn-1.12.0.AppImage

No install needed. The first connection that needs the VPN helper installs it, with one
password prompt. After that each privileged operation prompts for a password, cached for
a few minutes.

Verifying your download

sha256sum -c SHA256SUMS --ignore-missing
gpg --verify SHA256SUMS.asc SHA256SUMS

Signed with key 740A F267 B0D8 162B E477 779D 7315 246A 6E67 F3C6. Import it first if
you have not already:

curl -sS https://github.com/trinitystake.gpg | gpg --import

Important

  • Connecting spends real funds. Sessions are blockchain transactions priced in
    udvpn, and a failed connection is refunded automatically, but an expired one is not.
  • The AppImage needs a fusermount before it starts, which stock desktops already
    have. If command -v fusermount3 fusermount prints nothing, install fuse3; on Arch,
    nss too. AppImageLauncher 2.2.0 cannot start it: upgrade to 3.0 or remove it. The
    APPIMAGE_EXTRACT_AND_RUN=1 workaround avoids needing FUSE. See the README.
  • AppImage on Ubuntu 24.04+ runs with the Chromium sandbox disabled. An AppImage can
    install neither an AppArmor profile nor a SUID sandbox helper, so prefer the .deb there.

Security model

Node operators are treated as adversaries. Everything a node sends is validated before it
reaches a privileged operation, because a VPN config can otherwise run shell commands as
root. See CLAUDE.md
for the full threat model and architecture.

License

GPL-3.0-or-later. Bundled binaries (v2ray, xray, hysteria) and the libraries compiled
into the app and its VPN helper are under their own licenses, whose texts ship in the
packages. See
THIRD-PARTY-LICENSES.md.

Assets 6
Loading