Skip to content

OwnTransit 1.0.0

Choose a tag to compare

View all tags
@sentrybottale sentrybottale released this 18 Sep 17:50
· 6 commits to main since this release
Immutable release. Only release title and notes can be modified.
v1.0.0
b705c62
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OwnTransit 1.0.0

Your SSH. Your keys. Untrusted transit.

The 1.0 feature baseline ships the existing Client / Relay / Target runtime, including bounded pending reconnects, named tunnels, local recovery menus and independent end-to-end encryption. It introduces no new transport or enrollment protocol.

Install or upgrade

Choose the role on the corresponding machine. Existing installations keep their pairing; do not create new identities just to upgrade.

Public Linux VPS — Relay:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v1.0.0/install-linux.sh | sudo sh -s -- relay

For an existing Relay, select Start or update this relay in its menu. Reopen it with sudo owntransit-relay setup.

Private Linux SSH machine — Target:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v1.0.0/install-linux.sh | sudo sh -s -- target
sudo owntransit-target setup

Choose Continue tunnel for each existing tunnel to run the installed version. Restarting its service interrupts current connections.

Linux Client:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v1.0.0/install-linux.sh | sudo sh -s -- client
owntransit-client setup

Apple-silicon Mac Client, without sudo:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v1.0.0/install-macos.sh | sh -s -- client
"$HOME/.local/bin/owntransit-client" setup

On an existing Client, Continue tunnel checks the retained pairing. For a new installation, follow the quickstart. SSH/SCP examples and operational limits are included.

Scope and compatibility

  • Supported: Linux amd64 and arm64; Apple-silicon macOS Client.
  • Recognized canonical 0.7.0 and 0.8.0 installations can upgrade without re-pairing. Earlier releases remain immutable.
  • The documented Client / Relay / Target commands and pairing-state upgrade path establish the 1.x compatibility baseline.
  • Same SSH-only, fixed local SSH destination and malicious-relay threat model as 0.8. SSH identities, permissions and host verification remain operator-owned.
  • The existing distribution signer and nine assets are retained. DEVELOPMENT-* inventory names and the signing namespace are historical format identifiers, not a new trust ceremony.

Known operational limits

Current retries do not adapt to HTTP 429. Restrictive reverse-proxy quotas can prevent reconnection and may appear as a generic transport error. Keep protection enabled, size it for the combined handshake/renewal workload, and inspect proxy logs when diagnosing failures.

Keep independent maintenance access to unattended machines: the Relay cannot restart a Target through a broken tunnel. Publishing or downloading this release does not update live services or resolve an existing outage automatically.

The 1.0 label does not claim independent security certification, universal availability, pristine-host qualification, an extended soak, or Apple notarization. Initial installer delivery trusts GitHub HTTPS; the installer then verifies the pinned signer, signed inventory and exact archive bytes.

Assets 12
Loading