Meshway v0.1.0-alpha.1

Meshway 0.1.0-alpha.1 is an experimental Apache-2.0 peer VPN, SOCKS and tunneling implementation. The public website is https://user-github-me.github.io/meshway/ and source is https://github.com/user-github-me/meshway.

This alpha includes SOCKS5 TCP/UDP, IPv4/IPv6 packet VPN and tunneled DNS; recovery-key accounts with protected local state and optional encrypted peer sync; device revocation and signed history deletion; a server list/map; personal VPS access; and reversible Linux routing, DNS and firewall setup. Internet exits require explicit consent and peer authorization. One owner-operated Azure encrypted relay is live; public invitations assist peer connections and provide no internet exit access.

Choose an artifact for your platform:

Platform	Download	What is included
Android	meshway-android-debug.apk	Kotlin app and Go VpnService bridge; development APK with a debug signature
macOS, Intel or Apple Silicon	Meshway-macos.dmg / Meshway-macos.zip	Drag-to-Applications universal Swift app, packet-tunnel extension and universal daemon; owner signing is required for installed packet VPN
macOS, Apple Silicon fallback	Meshway-macos-arm64-daemon-client.zip	Simple desktop client for the local SOCKS/tunnel daemon
Windows x64 or ARM64	Meshway-setup-x64.exe / Meshway-setup-arm64.exe, or portable Meshway-win-ARCH.zip	Per-user installer or portable GUI, daemon, privileged VPN helper and vendor-signed Wintun driver
iPhone/iPad	Source and build scripts in the repository	App/provider source builds pass; the installable release is deferred until the owner's Apple Developer account and provisioning are ready
Linux amd64 or arm64	.deb, .rpm, or meshway-linux-ARCH.tar.gz	Core and Linux VPN controls; distro packages include systemd integration and leave service startup explicit
Chrome or Firefox	Meshway-extension-chrome.zip / Meshway-extension-firefox.zip	Browser proxy extension; load locally for development; Firefox needs “Run in Private Windows → Allow” before proxy control
npm CLI	nazifbd-meshway-0.1.0-alpha.1.tgz / meshway-cli-0.1.0.tgz	Public @nazifbd/meshway package and original GitHub launcher; both carry the publisher key pin and explicit verified core installer
Containers	meshway-container-linux-ARCH.tar.gz	Portable docker load archives; also available as ghcr.io/user-github-me/meshway:0.1.0-alpha.1 for both Linux architectures

Six raw cores and their archives are also available for macOS/Linux/Windows amd64 and arm64. native-builds.json records the exact bundled native executables. The 36 payload files include LICENSE, THIRD_PARTY_NOTICES.txt and SHA256SUMS; RELEASE.json and its detached signature complete the 38 release assets. Two signed meshway-source-0.1.0-alpha.1 ZIP/tar.gz assets include the final committed packaging/source snapshot; GitHub also provides the immutable core tag archives. Every platform's source and build scripts remain public.

Install from npm, then explicitly install the pinned project core:

npm install -g @nazifbd/meshway@alpha
meshway install-core
meshway version

The original GitHub package remains available:

npm install -g https://github.com/user-github-me/meshway/releases/download/v0.1.0-alpha.1/meshway-cli-0.1.0.tgz
meshway install-core
meshway version

The registry package version is 0.1.0-alpha.1 under the owner's @nazifbd scope; the original GitHub CLI package version is 0.1.0. Both contain the same launcher code, and the installed core reports Meshway 0.1.0-alpha.1. The installer verifies Ed25519 metadata, artifact checksums and signed license companions, and rejects altered, expired, downgraded or conflicting releases. Cached launches check the signature and binary before execution. Release sequence is 1, with new-install metadata expiring on 2027-01-12; already verified cached cores can run offline after that date.

Validation evidence covers actual Azure direct/forced-relay HTTPS, dual restrictive NAT with packet loss and recovery, Android emulator VPN TCP/DNS/TLS and exit failure recovery, Windows vendor-signed Wintun kernel IPv4/IPv6 TCP plus production firewall UDP blocking/exact-peer bypass/cleanup on an owned adapter, Linux kernel VPN crash/rollback, actual Debian/RPM installation/removal, Chromium and Firefox proxy restoration, and source-built multiarchitecture containers. See the capability matrix and runtime evidence for the tested scope.

The macOS DMG passed read-only mounted file/shortcut/notice checks. The Windows x64 installer passed actual installation, exact payload and shortcut checks, data-preserving removal and unchanged routes/DNS. The ARM64 installer is cross-built; its installation on ARM64 Windows remains unverified. The public npm tarball passed anonymous download and temporary installation checks. Installers start networking only after an explicit app action.

Verify RELEASE.json.sig using the publisher Ed25519 public key acquired independently of the download, then verify every chosen artifact hash. The release signature authenticates publisher content; macOS/Windows owner code-signing certificates and Apple provisioning remain separate requirements. Android uses a development signing key, and Wintun retains its verified upstream vendor signature. Physical-device carrier/sleep-wake behavior, installed Apple packet VPN and independent security review remain qualification gates. This alpha provides encrypted connectivity without an anonymity or universal-network-reachability guarantee.