stable
0.1.0
Released 2026-09-22
GADNET 0.1.0 application tree - the version current images ship.
Signed updates for GADNET routers
Every release published here is signed offline with an SLH-DSA-SHA2-128s key (NIST FIPS 205). Your router verifies that signature against a key baked into its image before it unpacks a single byte. This server can withhold an update; it cannot forge one.
Current releases
How a router updates
- Fetch the manifest for its channel over HTTPS.
- Verify the detached SLH-DSA signature against the public key in its own image. No signature, no update.
- Check the SHA-256 of the downloaded bundle against the digest inside the now-trusted manifest.
- Apply in a maintenance window, with rollback if the device does not come back healthy.
Order matters. Nothing is unpacked before both checks pass, so a corrupted or substituted bundle never reaches code that parses it.
Optional: key exchange before download
A signature proves who wrote a release. It does not tell your router whether the bytes it just received came from this server or from whatever terminated the TLS connection - a CDN, a corporate proxy, a captive portal.
Clients can therefore run a one-round-trip hybrid post-quantum key exchange first, and get every response authenticated under the resulting session key. Small documents can additionally be returned sealed, so a middlebox sees that an update was fetched but not which version - and which version a router runs is a list of which vulnerabilities it still has.