Skip to content

Releases: riponcm/MeghXL

Release list

MeghXL 1.0.0

MeghXL 1.0.0 Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Sep 19:44
v1.0.0
9954d76

MeghXL turns one computer into a private file-transfer hub for your local network. Drop a file on one device and every other device on the same Wi-Fi can grab it from a browser, by link or QR — no app on the receiving device, no account, no cloud, no size limit.

This is the first public release.

Download

Platform File
macOS (Apple Silicon) MeghXL_1.0.0_aarch64.dmg
macOS (Intel) MeghXL_1.0.0_x64.dmg
Windows 10/11 (x64) MeghXL_1.0.0_x64-setup.exe or MeghXL_1.0.0_x64_en-US.msi
Linux (x64) MeghXL_1.0.0_amd64.AppImage, .deb, or .rpm

Only the computer acting as the hub needs an installer. Everything else — phones, laptops, tablets — just opens the URL. Each installer is self-contained; there is no Node.js or other runtime to install.

What's in it

  • Live shared board. A file dropped on one device appears on every open dashboard within a second, over WebSocket.
  • Public or private, per file. Private files never appear in anyone's list — only their unguessable link works.
  • Auto-expiry and one-time links. Share something that deletes itself after a set time, or the moment it is downloaded once.
  • Shared message board for everyone on the network, plus private device-to-device messages.
  • Any size. Uploads stream to disk and downloads support HTTP Range, so transfers resume and the only limit is your disk.
  • Friendly name. Reachable at http://meghxl.local:3000 — bookmark once per device.
  • Host console at /admin for the device roster, blocking, announcements and file management, restricted to the machine running the server.
  • Desktop app with a tray icon, start-at-login, a downloads folder you choose, and in-app updates.
  • LAN-only by design. MeghXL never exposes itself to the internet. For remote access, put it behind your own VPN or authenticated proxy and set PUBLIC_BASE_URL.

Installing

These builds are not notarized by Apple or signed with a Windows certificate, so the first launch shows a warning:

  • macOS — right-click the app and choose Open, then confirm.
  • Windows — More info → Run anyway on the SmartScreen prompt.

Building from source avoids both.

This is separate from update signing: every artifact here is cryptographically signed with the project's updater key, and the app installs an update only if the signature verifies against the public key compiled into it. A tampered download is refused.

Privacy

MeghXL makes exactly one outbound request in its entire lifetime, and only when you press Check for updates: a single GET to the GitHub releases API to compare version numbers. No identifiers, no filenames, no usage data, nothing on a timer. Delete src/routes/update.js if you want even that gone.

Verifying a download

Every installer ships with a matching .sig. To check one, install the Tauri CLI and run:

npx @tauri-apps/cli signer verify -f MeghXL_1.0.0_x64.dmg

Full details in the README · threat model in SECURITY.md · changes in CHANGELOG.md.

Apache-2.0. A matily.org product.

Assets 19