Releases

Git repositories

Github repositories for the sanctum projects serve as read-only mirrors. Both the daemon and the library source code are available on Github.

View sanctum on GitHub View libkyrka on GitHub

Releases

Sanctum

1.4.1

released 2026-09-26 · sha256 3e92fd47c2d8046cda09e3c3b5fb826c38cf2851ea0aebfce1dee60b0f3f30b9

Download sanctum-1.4.1.tgz (3.5MB)

Highlights

• Added support for arm32 linux platforms.
• Small fixes to cathedral and commixtion.
• Made sanctum frontend logs more readable.
• Hymn status and list now work without root permissions.
• Fixed a rare race condition where last_pn would not be reset in time causing packets after a key exchange to be dropped for a few seconds.

1.4.0

released 2026-09-11 · sha256 f38874300689e72eecc0857f4063b5255bd4348acd6534aef42999f1b1a70e3d

Download sanctum-1.4.0.tgz (3.5MB)

Highlights

• Added commixtion, which mixes incoming data packets between cathedrals with multiple hops.
• Improved how hymn list output looks like to make it more readable at a glance.
• Improved MTU discovery and updated configuration settings for it.
• Fallback openssl-aes-gcm backend for platforms without libsodium or mbedtls.
• Liturgies now alter /etc/hosts to add the tunnel-id or friendly name of a tunnel so they can be resolved when the tunnels are up.
• Changed how cathedral federations are reloaded.
• Cathedrals now remove out-of-date or bad ambry files on reload.
• Small fixes for the improvement of overall code quality.
• Fixed logging on MacoS due to the sandbox being in the way of syslog.

1.3.0

released 2026-06-23 · sha256 2eb8b05485b98363e4cec108b7b0a6074f4b6ebd19ea42ebad1e39e41ae0082c

Download sanctum-1.3.0.tgz (3.3MB)

Highlights

• Shroud now randomly changes packet sizes.
• Shroud now covers entire packets, not just meta-data.

1.2.0

released 2026-06-19 · sha256 3c01b8b43e4efa3b59d38242a4d20847ac6a287f2afd823e92415aaed68ef6c4

Download sanctum-1.2.0.tgz (3.3MB)

Highlights

• Added graces, a way of sending data between the heaven processes.
• Moved heartbeats away from bless/confess and into newly added graces.
• Added MTU discovery using the newly added graces. Set your MTU to "auto" to make use of it.
• Small code adjustments to improve overall code quality.
• Turn a PRECOND() in the cathedrals into a soft error instead.

1.1.2

released 2026-05-29 · sha256 d4b730626f317ddd8b74019e62b7720a7360228e332bf498124e161c46eedfbf

Download sanctum-1.1.2.tgz (3.1MB)

Highlights

• Small mbedtls-aes-gcm fixes.
• Adjust shroud mask to cover sanctum_proto_hdr.

1.1.1

released 2026-05-19 · sha256 f35d1721a7301df0491114c5548d0b2175d93fa877cbb93210e7324041e46d7d

Download sanctum-1.1.1.tgz (3.1MB)

Highlights

• More paranoia when procs exit, explicitly call nyfe_zeroize_all() and warn on linger sensitive assets.
• Hold back key exchanges for a minute if a peer does not answer, reduces packets on the wire a bit when the peer is not online.
• Fixed a missing sanctum_packet_release() in an error path in confess.
• Cathedrals can now signal to peers if they are behind the same external ip, paving the way for local discovery later.
• Cathedrals now only forget tunnels after 120 seconds, instead of 45.
• Cathedrals now only allow offers to be federated each 3 seconds, instead of 1.

1.1.0

released 2026-04-15 · sha256 17ccba4f8d495f65beff5bfdfd8ebaaaba75ec0283874d8b17fc3ada9fd8b3e6

Download sanctum-1.1.0.tgz (3.1MB)

Highlights

• New shroud functionality, replacing encapsulation. A shroud will mask away protocol meta-data with unique per-client traffic protection keys making traffic analysis much harder.

Libkyrka

1.1.1

released 2026-07-09 · sha256 c732cce8be9ef2a3db27b0f53a8359d08ffc90905415f9cbfe65588e5593f0da

Download libkyrka-1.1.1.tgz

Highlights

• Small bug fixes related to MTU sizes for shroud.

Packages

Packages exist for the following distributions:

• Gentoo — lejonet-overlay
• Archlinux (AUR) — aur.archlinux.org/packages/sanctum