The hardware and bandwidth for this mirror is donated by dogado GmbH, the Webhosting and Full Service-Cloud Provider. Check out our Wordpress Tutorial.
If you wish to report a bug, or if you are interested in having us mirror your free-software or open-source project, please feel free to contact us at mirror[@]dogado.de.
New: ephemeral SAS key agreement, display-byte derivation, and constant-time MAC verification through vodozemac. SAS handles reject wrong pointer types, low-order peer keys, and repeated use of an ephemeral secret. Protocol orchestration and durable user trust remain in mx.client.
New: SHA-256 SAS commitments use sha2 0.10.9, now declared directly. This crate was already bundled and locked through vodozemac; no vendored source bytes or R dependencies were added.
mxc_signing_key_*() provides durable Ed25519
signing keys for Matrix cross-signing. Private state uses the same
encrypted pickle format and 32-byte local store key as device
accounts.mxc_megolm_inbound_export(),
mxc_megolm_inbound_import(), and
mxc_megolm_inbound_info() implement the cryptographic half
of m.forwarded_room_key, preserving the first known message
index and marking imported sessions unverified as required by
Megolm.tools/configure.R picks the Rust target on Windows from
the running R rather than from the host triple:
aarch64-pc-windows-gnullvm on ARM64,
x86_64-pc-windows-gnullvm for clang-compiled R,
i686-pc-windows-gnu on 32-bit,
x86_64-pc-windows-gnu otherwise. It is passed as
--target whenever it differs from the host. Fixes the build
on Windows ARM64. Thanks to Jeroen Ooms (#3).-C link-self-contained=yes. Passing
--target stops cargo applying RUSTFLAGS to
build scripts and proc-macros, which leaves them unexecutable on the
Rtools toolchain.mxc_olm_create_outbound() now propagates vodozemac’s
SessionCreationError instead of silently encoding a
Result as a Session external pointer. The
previous behavior meant a non-contributory Diffie-Hellman key (Soatok
2026-02 disclosure, fixed in vodozemac 0.10.0 itself) returned a corrupt
pointer that produced undefined behavior on use.mxc_ed25519_verify(),
mxc_verify_device_keys(),
mxc_verify_one_time_key() so callers can validate
homeserver-supplied device-keys and signed one-time keys before using
them. Hostile-fixture tests cover every rejection branch.SECURITY.md (threat model, pinned dependency
status, pickle hygiene, known limitations).security-audit walking the audit
findings.mx.api (>= 0.1.0.1) and
simplermarkdown added to Suggests;
VignetteBuilder: simplermarkdown.These binaries (installable software) and packages are in development.
They may not be fully stable and should be used with caution. We make no claims about them.
Health stats visible at Monitor.