{"id":51763578,"url":"https://github.com/vercingetorx/depot","last_synced_at":"2026-07-19T16:33:57.021Z","repository":{"id":314529514,"uuid":"1052430484","full_name":"vercingetorx/depot","owner":"vercingetorx","description":"Secure post-quantum file transfer utility (Kyber + Dilithium + XChaCha20), with sandboxed server paths, rekeying, and robust CLI workflows.","archived":false,"fork":false,"pushed_at":"2026-03-26T17:29:32.000Z","size":1369,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"master","last_synced_at":"2026-03-27T06:46:40.613Z","etag":null,"topics":["argon2","dilithium","file-transfer","kyber-crystal","nim","nim-lang","post-quantum-cryptography","secure-file-transfer","xchacha20-poly1305"],"latest_commit_sha":null,"homepage":"","language":"Nim","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/vercingetorx.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-09-08T03:34:28.000Z","updated_at":"2026-03-26T17:29:35.000Z","dependencies_parsed_at":"2025-09-13T02:44:03.491Z","dependency_job_id":"80f21da4-7c1a-4ae4-8a08-10333815bf0c","html_url":"https://github.com/vercingetorx/depot","commit_stats":null,"previous_names":["vercingetorx/depot"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/vercingetorx/depot","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vercingetorx%2Fdepot","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vercingetorx%2Fdepot/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vercingetorx%2Fdepot/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vercingetorx%2Fdepot/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/vercingetorx","download_url":"https://codeload.github.com/vercingetorx/depot/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vercingetorx%2Fdepot/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35659409,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-19T02:00:06.923Z","response_time":112,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["argon2","dilithium","file-transfer","kyber-crystal","nim","nim-lang","post-quantum-cryptography","secure-file-transfer","xchacha20-poly1305"],"created_at":"2026-07-19T16:33:56.331Z","updated_at":"2026-07-19T16:33:56.988Z","avatar_url":"https://github.com/vercingetorx.png","language":"Nim","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003c!-- Center align --\u003e\n\u003cdiv align=\"center\"\u003e\n  \u003cimg src=\"https://raw.githubusercontent.com/vercingetorx/depot/refs/heads/master/resources/depot_icon_with_letters_small.png\" alt=\"depot_logo\" width=\"250\"\u003e\n\u003c/div\u003e\n\n# Depot — Secure File Transfer (ML-KEM + XChaCha20)\n\nDepot is a simple, post-quantum-ready file transfer tool. It favors a clean CLI, strong defaults, and explicit safety:\n\n- Modern cryptography with ML-KEM (KEM), ML-DSA (identity), Argon2 (KDF), BLAKE3 (hashing), and XChaCha20-Poly1305 (AEAD).\n- Sandboxed filesystem mode by default (no absolute paths; no escaping the server root).\n- Clear, standardized error codes and explicit batch outcomes.\n\n## Security Overview (brief)\n\n- TOFU identity pinning with ML-DSA; ML-KEM for session keys; Argon2 for key-at-rest and handshake key schedule; XChaCha20-Poly1305 for records.\n- Sandboxed filesystem mode by default (no absolute paths; normalized under the server root).\n- Atomic write/commit with integrity-on-commit checksums; partials removed on abort.\n\n## Build\n\nRequires Rust and Cargo.\n\n```bash\ncargo build --release\n```\n\n## Quick Start\n\n1. Scaffold a config for stable defaults like named servers, log level, and sandbox:\n\n```bash\ndepot config --init\n```\n\nEdit `~/.config/depot/depot.conf` to set those defaults if you want them.\nThe examples below assume `client.server = \"home\"` is configured.\n\n2. Start the server from the directory you want to share:\n\n```bash\ncd /srv/media\ndepot serve --key-pass \"change-me\"\n```\n\nFirst run requires `--key-pass` or `--key-pass-file` to generate an encrypted server identity key. Later runs must use the same passphrase.\nUse `--root`, `--listen`, or `--port` only when you want to override the default server behavior.\n\n3. Export files and directories from your current directory:\n\n```bash\ndepot export picture.jpg\n\n# Export into a specific remote subdirectory\ndepot export picture.jpg --dest photos/trips\n\n# Export the contents of the current directory\ndepot export --all\n```\n\n4. Import files into your current directory:\n\n```bash\ndepot import movie.mp4\n\n# Pull the entire shared root\ndepot import --all\n\n# Download into a different local destination\ndepot import folder --dest ~/Downloads/inbox\n\n# List remote content\ndepot ls\n```\n\n## CLI\n\n```text\ndepot serve [--listen IP] [--port N] [--root DIR] [--log LEVEL]\n            [--no-sandbox] [--allow-overwrite]\n            [--key-pass PASS | --key-pass-file PATH]\n\ndepot export FILE... [--server NAME] [--host HOST] [--port N]\n                     [--dest DIR] [--all]\n                     [--no-skip | --noskip] [--log LEVEL]\n\ndepot import ITEM... [--server NAME] [--host HOST] [--port N]\n                     [--dest DIR] [--all]\n                     [--no-skip | --noskip] [--log LEVEL]\n\ndepot ls [PATH] [--server NAME] [--host HOST] [--port N] [--log LEVEL]\n\ndepot config --init [--force]\n\ndepot --version\n```\n\nTips:\n\n- In sandboxed mode, the server rejects absolute remote paths and `..` traversal.\n- In no-sandbox mode (`depot serve --no-sandbox`), absolute remote paths are allowed.\n- `depot serve` uses the current directory as the server root unless `--root` is provided.\n- `depot export` and `depot import` use the current directory by default.\n- Skip-existing behavior is on by default for export/import; use `--no-skip` or `--noskip` to disable it.\n- Resolution order is: `client.server` default, then `--server`, then `--host` / `--port`.\n- `--server` selects a named server from config.\n- `--host` and `--port` are one-command overrides on top of that resolved endpoint.\n\n## Config\n\n`~/.config/depot/depot.conf`:\n\n```text\n[server]\n# listen = 0.0.0.0\n# port = 60006\nsandbox = true\n\n[client]\nserver = \"home\"\n# log = info\n\n[servers.home]\nhost = \"localhost\"\nport = 60006\n\n# [servers.vps]\n# host = \"files.example.com\"\n# port = 60006\n```\n\nConfig is only for stable preferences. Server pathing is not configured here. `depot serve` serves the current directory unless `--root` is provided.\n\nNamed servers:\n\n- Set `client.server = \"name\"` to choose the default named server.\n- Use `--server name` to select a different named server for one command.\n- `--host` and `--port` override the final resolved endpoint directly for one command.\n- If you do not configure `client.server`, you must use `--server` or `--host` on client commands.\n\n## Identity And Trust\n\n- Depot stores identity and trust material under the Depot config directory.\n- The server identity lives under `~/.config/depot/id/` and is created lazily on first successful `serve`.\n- The server secret key is encrypted at rest in `DPK1` format and requires `--key-pass` or `--key-pass-file`.\n- The client uses TOFU pinning and stores pinned server public keys under `~/.config/depot/trust/`.\n- Client identity lives under `~/.config/depot/id/` and is always used for client authentication.\n- Server-side trusted client public keys live under `~/.config/depot/trust/clients/`.\n\n## Messages and Codes\n\n- Wire carries only an error code; both sides render standardized messages:\n  - Client: `[code] \u003cclient message\u003e`\n  - Server: `[code] \u003cserver message\u003e`\n- Success and skip messages are local only and use typed local status rendering.\n- Batch runs report transferred, skipped, and failed items explicitly.\n\n## Design Notes\n\n- AEAD framing uses typed encrypted records over TCP.\n- Nonces use a per-direction prefix and counter.\n- The server does not invoke a shell to parse paths; the protocol is structured and binary.\n- The Rust implementation uses public crates for its crypto stack: `libcrux-ml-kem`, `libcrux-ml-dsa`, `chacha20poly1305`, `argon2`, and `blake3`.\n\n## Transfer Semantics\n\n- Uploads write to `\u003cdest\u003e.part` and move into place only after checksum verification. On error, partial files are removed.\n- Downloads write to `\u003cdest\u003e.part` and move into place only after checksum verification.\n- Metadata preservation: server to client and client to server preserve `mtime` and file permissions.\n- Directory export/import:\n  - Exporting a directory includes the top-level directory name.\n  - Importing a directory includes the top-level directory name.\n  - Relative remote paths are resolved from the server root.\n  - Relative local paths are resolved from the client current working directory.\n- Exit status is non-zero if any failures occurred in a batch.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvercingetorx%2Fdepot","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fvercingetorx%2Fdepot","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvercingetorx%2Fdepot/lists"}