Security and official sources

MeshSat is free software and anyone may redistribute it. This page exists so you can tell what we publish from what we do not. If you are about to run an install command, check it against the list below first.

What	Official location
Website	`meshsat.net`
Documentation	`docs.meshsat.net`
Install script	`get.meshsat.net`
Source code	github.com/meshsat/meshsat
All our repositories	github.com/meshsat
Container images	`ghcr.io/meshsat/meshsat`
Hub	`hub.meshsat.net`, open, accounts reviewed before activation
Chat	#meshsat:matrix.nuclearlighters.net on Matrix
Email	hello@meshsat.net

meshsat.org is also ours and redirects here. www.meshsat.net redirects here too.

Our accounts

These are the only accounts we post from.

Platform	Account
GitHub	github.com/meshsat
GitLab	gitlab.com/meshsat, reserved, no code published there
Matrix	#meshsat:matrix.nuclearlighters.net
LinkedIn	linkedin.com/company/meshsat
X	x.com/meshsat
YouTube	youtube.com/@MeshSat
Facebook	facebook.com/meshsat
Reddit	reddit.com/r/meshsat

Verify the installer before you run it

Our install command pipes a script into a root shell:

Quick install
curl -fsSL https://get.meshsat.net | sudo bash

That is convenient and it is also a lot of trust to place in one URL. The risk is not the pipe itself. The risk is running an installer that someone else published under our name, from a location we do not control. So verify the source before you run it, especially if you arrived from a link rather than by typing meshsat.net yourself.

Download it, read it, then run it:

Download, check, run
curl -fsSL https://get.meshsat.net -o meshsat-install.sh
sha256sum meshsat-install.sh
less meshsat-install.sh
sudo bash meshsat-install.sh

The current installer is version 1.1.0 and its SHA-256 is:

005edea4423fa0cac5e2ceea03e57c2e8f0aabeafc52f499960757a4ff91bafe  meshsat-install.sh

The script itself is in the open at install/install.sh, so you can read exactly what it does before trusting it. It installs ghcr.io/meshsat/meshsat with Docker Compose and starts the Bridge on port 6050.

If the checksum does not match, stop and tell us. It could mean we shipped a new installer and have not updated this page yet, or it could mean you did not get the file from us.

Signs something is not ours

An install command that points anywhere other than get.meshsat.net.
A repository that is not under github.com/meshsat.
Being asked to pay, to register, or to disable a security feature to install MeshSat.
A download that arrives as a compiled binary or an archive rather than the script above.

Sites we are not connected to

Other people publish projects using the MeshSat name. We do not control them and we cannot vouch for what they distribute.

meshsat.info is not affiliated with this project, is not operated by us, and its software is not ours.

Reporting a security problem

If you find a vulnerability in MeshSat, or you find something published under our name that is not ours, email security@meshsat.net.

Please include enough detail to reproduce the problem. We will confirm receipt, and we would rather hear about something small than not hear about it. There is no bounty programme.

Machine-readable contact details are at /.well-known/security.txt, following RFC 9116.