OwnTransit v0.1.0 — Your SSH. Your keys. Untrusted transit.

OwnTransit v0.1.0

Your SSH. Your keys. Untrusted transit.

OwnTransit carries an SSH byte stream between two hidden, outbound-only
endpoints through a public relay that is treated as fully compromised. The
relay can observe metadata or deny service, but the independently authenticated
inner TLS 1.3 channel is designed to keep it from reading the stream, forging an
accepted endpoint, or selecting the connector's destination. The production
connector can dial only the build-fixed literal tcp4 127.0.0.1:22. OpenSSH
still owns SSH host and user authentication, authorization, forwarding, and
recovery.

Linux quick install

Public VPS / server:

curl -fsSL https://raw.githubusercontent.com/sentrybottale/OwnTransit/1e239516b66d4b3af345d84985ccd0683f10ee26/install-linux.sh | sudo sh -s -- relay

Private machine running your SSH server:

curl -fsSL https://raw.githubusercontent.com/sentrybottale/OwnTransit/1e239516b66d4b3af345d84985ccd0683f10ee26/install-linux.sh | sudo sh -s -- connector

Client computer:

curl -fsSL https://raw.githubusercontent.com/sentrybottale/OwnTransit/1e239516b66d4b3af345d84985ccd0683f10ee26/install-linux.sh | sudo sh -s -- client

Administrator's trusted machine:

curl -fsSL https://raw.githubusercontent.com/sentrybottale/OwnTransit/1e239516b66d4b3af345d84985ccd0683f10ee26/install-linux.sh | sudo sh -s -- provisioner

The installer selects amd64 or arm64 and verifies the existing release payload. On Debian/Ubuntu, a missing relay Podman dependency is installed after verification. Fresh relay and connector services remain disabled; the relay's host port is loopback-only. Nginx, websites, firewall rules and SSH configuration are not edited by OwnTransit. Public HTTPS integration and enrollment are separate operator steps.

Follow First deployment for the actual invitation-creation command and activation sequence, or INSTALL.md for prerequisites. The provisioner's authority keys belong on the administrator's trusted machine, never on the public relay.

These commands trust GitHub to deliver the commit-pinned bootstrap. The convenience script and guide were added after v0.1.0; the immutable release assets and their signed qualification are unchanged.

Supported release targets

• Apple-silicon macOS (arm64)
• 64-bit x86 Linux (amd64 / x86_64)
• 64-bit ARM Linux (arm64 / aarch64)

Intel macOS and all other targets are unsupported in 0.1.0. The macOS
qualification was deliberately read-only and made no system mutation; it does
not claim stable macOS client lifecycle activation. The two Linux connector
install, restart, reboot, reacquisition, confinement, and no-listener results
apply to the exercised existing hosts, not every Linux installation.

Independent/offline installation

For the independent/offline method, use the original 0.1.0 installation guide. The native archive contains the exact signed executables and offline installers; the source archive and owntransit.rb provide the source/Homebrew frontend lane.

For this stricter method, independently obtain the expected trust
material and verify the trust statement, signed outer and native inventories,
release manifest, release policy, and signed qualification record as described
in INSTALL.md and PUBLISHING.md. Retained 0.1.0-rc.* role state is not a
supported in-place predecessor of stable 0.1.0. Keep an independent SSH and
host-recovery path while installing and canarying OwnTransit.

The documented initial-enrollment flow requires a bidirectionally authenticated
human contact procedure and the complete target-first six-word transcript
comparison. The words authenticate the transcript, not either human. Enrollment
itself was not exercised by this qualification. OwnTransit never creates,
stores, selects, or edits SSH keys, accounts, authorized_keys, or SSH
configuration.

Signed qualification

• Status: PASS
• Gate set: owntransit-0.1.0-minimal.v1
• Release ID: ov7g6h3cxxmpnbdm4twv2nkvneg2yk5ydrn4vtxjsj7m56yv2mgq
• Source commit: 445579f850589e1564ed41ecd9cc2d1f3c571439
• Outer inventory SHA-256: 906e634897637256cf504e96919e155e0a5d834d0485b43803efc38fc912930e
• QUALIFICATION.txt SHA-256: 34615b90e1e2bd24b2c9a68908add5d5d6403e16c491c749a9ba2ebcb7830f99
• Unresolved Critical findings: 0
• Unresolved High findings: 0

The signed record binds four PASS results for the exact released bytes: full
source/security/publication checks, independent signature and inventory
verification, bounded supported-artifact execution, and a live SSH session plus
an integrity-checked 65,536-byte SCP round trip through the untrusted relay.

The signed artifact result explicitly does not claim stable macOS client
lifecycle activation, macOS provisioner package lifecycle, Linux client,
provisioner, or relay package lifecycle, pristine-host qualification, or an
enrollment run.

Additional assurance status

These activities were NOT-PERFORMED for this release qualification:

• pristine/factory-clean macOS and per-architecture Linux lifecycle/reboot matrices;
• dual public relay-exchange qualification and exhaustive composite dossiers;
• an independent secret scan of the exported/new public object graph;
• an independent clean-builder reproduction;
• signer/issuer custody and clean-room recovery rehearsal; and
• an independent external security review and authorized penetration test.

This PASS is a bounded qualification of one exact artifact set, not an external
security certification, penetration-test certification, guarantee, or claim of
universal production suitability. Review the documented threat model and scope,
keep alternate recovery, and make your own environment-specific deployment
decision.