alpha development preview

One Link

Peer-to-peer chat and file sync with no required user account and no application telemetry. Devices connect directly where routes permit; optional rendezvous and relay services support cross-network discovery and fallback. Peer sessions are end-to-end encrypted and mutually authenticated.

AGPLv3 no product analytics no required account SQLCipher state DB by default ephemeral session keys no verified production release

Release status

No verified production download is currently published. As checked against GitHub on 2026-07-24, the only release is the mutable auto-latest prerelease. Its rolling binaries and checksum files were refreshed on 2026-07-22, but it has no Sigstore bundles, published SBOM, or provenance assets and is not an approved install source.

The release workflow is implemented, but it has not yet produced a production tag. This page therefore does not redirect to a mutable release or guess an artifact from your operating system.

Production download unavailable

Alpha source evaluation is available below. Do not use auto-latest binaries as trusted software.

Evaluate a reviewed source commit (advanced)

This is a development path, not a production installation:

git clone https://github.com/coherence-energy-labs/one-link
cd one-link
git checkout <reviewed-commit-sha>
uv sync --frozen --extra dev
uv run --frozen one-link app

Future release verification contract

After an immutable v* tag successfully publishes an artifact, its matching .sigstore bundle, SHA256SUMS, signed manifest, provenance, and SBOM, verify the exact tag with:

bash scripts/verify-release.sh ./<artifact> vX.Y.Z

The verifier is tooling, not evidence that those assets exist today. It checks the checksum and Sigstore identities and fails on missing or mismatched evidence. Never substitute latest, master, or auto-latest for the exact tag.

If you don't trust the script either, the underlying check is just python -m sigstore verify identity with the workflow identity pinned. Run it yourself.

What's in the development tree

These are source-level capabilities under test, not a production-release certification. Exact behavior must be verified at the reviewed commit.

X25519 + Ed25519 mutual handshake. ChaCha20-Poly1305 framed wire protocol.
Compatible daemon peers advertise and activate a Signal-style Double Ratchet after capability negotiation; downgrade, legacy-peer, recovery, and production qualification remain release gates.
Five-word transcript-bound SAS pair flow. 5-minute pair TTL. Deny-by-default capability gate after pair.
Group-chat sender chains with sliding-window OOO support + Ed25519-signed messages.
The desktop state database uses SQLCipher by default and refuses silent plaintext fallback. Identity keys, received blobs, runtime memory, and OS-account compromise have separate limits in the threat model.
WebRTC browser-as-peer transport with cryptographically bound DTLS-SRTP fingerprint (signed answer envelope). Independent Chromium and Firefox profiles complete direct DataChannel probes with outside STUN disabled; WebKit/iOS and a physical NAT/TURN matrix remain release gates.
Compatible native daemons use a signed, key-confirmed X25519 + FIPS-203 ML-KEM-768 handshake and refuse classical downgrade by default. Ed25519 identity signatures and browser/WebRTC channels are outside that post-quantum KEM claim.
The optional native v2 relay uses rotating pairwise route tags and recipient-seals both identity-bearing channel first flights. This is not sender anonymity: the relay still observes sockets, timing, size, counts, and rotating-tag linkage. Onion/mix-net message routing is not active.
Explicit owner-confirmed, one-click transactional installation is live only when the complete local frozen standalone bundle and its fixed external A/B helper validate. The helper independently authenticates, activates, health-checks, and rolls back the exact release. Source, pip, development, incomplete, moved, or modified installs fail closed; Unattended/background automatic installation remains disabled, and no verified public stable tagged release exists yet.
BLAKE3-verified content-defined chunking for fast large-file sync. Native-code accelerator with SHA-256 sidecar integrity check.
mDNS LAN discovery + optional rendezvous + relay for cross-network. Hardened tier (Tor / DHT) on roadmap.

Threat model

The full threat model lives at docs/SECURITY.md. Nine adversary classes (T1 casual snoop through T9 state actor) with explicit defenses + honest "where the gaps are."

For responsible-disclosure of a vulnerability: SECURITY.md at the repo root.

For the people

One Link is licensed under AGPLv3 so it can never be quietly enclosed inside a closed-source corporate product. The full charter is in NOTICE. The project aims to require no account, email, or phone number and to ship no application telemetry or advertising. Necessary infrastructure and supply-chain dependencies are documented in the threat model instead of being presented as nonexistent.