Goblin Reactor RPM repository

Signed third-party Goblin Skiff RPMs maintained by Adam DePrince. Repository and package catalog: https://apt.goblinreactor.com/ For Debian or Ubuntu, use the APT instructions on that page instead.

Available packages

goblin-skiff includes the client, server, goblin-skiffcp, dictionary compiler, five man pages and Bash completion. These are bundled commands, not separate RPM packages. Only the following native builds are published:

Rocky packages require the normal Rocky repositories, CRB and EPEL. Other RPM distributions, other releases, ARM64 and 32-bit systems are not tested or published. Do not mix Fedora and Rocky packages. These packages are not endorsed by Fedora, Rocky Linux or Red Hat.

Set up DNF

Install the setup tools first. Existing curl-minimal is sufficient:

sudo dnf install ca-certificates gnupg2
command -v curl >/dev/null || sudo dnf install curl

Then run this block. It checks the OS, architecture and signing-key fingerprint before installing the repository configuration:

(
    set -eu
    . /etc/os-release
    case "$ID:$VERSION_ID" in
        fedora:44) goblin_target=fedora-44 ;;
        rocky:9|rocky:9.*) goblin_target=rocky-9 ;;
        rocky:10|rocky:10.*) goblin_target=rocky-10 ;;
        *) echo "No package is published for this OS release." >&2; exit 1 ;;
    esac
    test "$(uname -m)" = x86_64 || {
        echo "Only x86_64 RPMs are currently published." >&2
        exit 1
    }
    if test "$ID" = rocky; then
        sudo dnf install dnf-plugins-core epel-release
        sudo dnf config-manager --set-enabled crb
    fi
    goblin_keydir=$(mktemp -d)
    trap 'rm -f "$goblin_keydir/key.asc" "$goblin_keydir/goblinreactor.repo"; rmdir "$goblin_keydir"' EXIT
    curl -fsSL https://apt.goblinreactor.com/goblinreactor-archive-keyring.asc \
        -o "$goblin_keydir/key.asc"
    goblin_fingerprint=$(gpg --batch --show-keys --with-colons \
        "$goblin_keydir/key.asc" | awk -F: '$1 == "fpr" {print $10; exit}')
    test "$goblin_fingerprint" = B7B61E8CB85A9270530364F23273CB62402FC793 || {
        echo "Unexpected repository signing key; stopping." >&2
        exit 1
    }
    curl -fsSL "https://apt.goblinreactor.com/rpm/goblinreactor-$goblin_target.repo" \
        -o "$goblin_keydir/goblinreactor.repo"
    sudo install -d -m 0755 /etc/pki/rpm-gpg
    sudo install -m 0644 "$goblin_keydir/key.asc" \
        /etc/pki/rpm-gpg/RPM-GPG-KEY-goblinreactor
    sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-goblinreactor
    sudo install -m 0644 "$goblin_keydir/goblinreactor.repo" \
        /etc/yum.repos.d/goblinreactor.repo
)
sudo dnf --refresh makecache
sudo dnf install goblin-skiff

Signing-key fingerprint:

B7B6 1E8C B85A 9270 5303 64F2 3273 CB62 402F C793

DNF may ask to import this same key for its separate repository-metadata key store. Both gpgcheck=1 and repo_gpgcheck=1 must stay enabled. Do not use --nogpgcheck or disable TLS verification. This grants the archive maintainer the trust normally required to install system software.

Use, update and remove

Install on both endpoints, then connect:

goblin-skiff user@server
man goblin-skiff
sudo dnf upgrade goblin-skiff
rpm -q goblin-skiff
sudo dnf remove goblin-skiff

Skiff's command prefix opens the two-pane file menu: Ctrl-^ (usually Ctrl-Shift-6), then 0. Enter starts transferring the selected file or directory without leaving the browser. The connection uses independent directional pacing, zstd level 22, FEC and librsync file synchronization.

The package installs goblin-prefixed commands in /usr/bin and coexists with the distribution's mosh package. The obsolete adam-mosh package conflicts with it. It never deletes an administrator's manual /usr/local installation; check "command -v goblin-skiff" if an older manual build shadows /usr/bin. Open a new session after updating; existing sessions are not restarted. After upgrading the OS release, install the matching repository configuration. SSH must reach the server for login, and its firewall must allow the selected Mosh UDP port (normally 60000–61000). Installing the package does not open firewall ports or start a permanent system daemon.

Matching source and rebuilding

Each binary has a complete matching, signed source RPM. Download the SRPM for your release from the package catalog:

The source RPM contains the modified source archive, the RPM spec, Debian packaging, and container build recipes. Verify a downloaded SRPM with "rpmkeys --checksig filename.src.rpm". Install rpm-build and your DNF builddep plugin, use "sudo dnf builddep ./filename.src.rpm" to install its build dependencies, then run "rpmbuild --rebuild ./filename.src.rpm" as a regular user on the matching OS. The DNF plugin package is dnf5-plugins on Fedora 44 and dnf-plugins-core on Rocky. Build dependency inventories, image digests, test logs and artifact checksums are linked in the catalog.

Licenses and verification

Goblin Skiff remains GPL-3.0-or-later, with upstream notices and OpenSSL linking exceptions preserved; it is not an Apache-2.0-only distribution. See /usr/share/licenses/goblin-skiff/ and /usr/share/doc/goblin-skiff/THIRD_PARTY.md. Runtime libraries are dynamically linked distribution packages, not bundled copies. Planned audio codecs are not included in this release.

The --fips-crypto provider mode is built, but this is not a FIPS certification claim. A properly configured and validated provider plus a compliant surrounding system are still required.

All three RPM builds pass 28 core tests, installed encrypted file transfers and lossy four-hop relay transfers. Public-release checks install through HTTPS with package and metadata signature verification, retrieve and verify the SRPM, and repeat the file-transfer and relay tests.

Source branch: https://github.com/adamdeprince/goblin-skiff/tree/low-bandwidth-mosh Issues: https://github.com/adamdeprince/goblin-skiff/issues Rocky repository background: https://wiki.rockylinux.org/rocky/repo/

Goblin Skiff 1.4.0-goblin20260919.2

Goblin Skiff is a fork of Mosh, optimized for bandwidth-constrained links. This release includes authenticated UDP jump relays, configurable initial connection timeouts and negotiated radio pacing. Install goblin-skiff on the client, destination and any jump hosts. Use goblin-skiff --connect-timeout=300 user@server for slow startup, or goblin-skiff -J user@jump user@server for a relay.

Every supported package runs 28 core tests, installed encrypted transfers and lossy four-hop transfers. Public APT, DNF and Homebrew installations are verified against the signed repositories or bottle checksums. Optional provider tests skip only where no configured FIPS provider is available. Prebuilt packages use Reed–Solomon FEC with RaptorQ excluded. Goblin protocol remains 1; both directions of upstream Mosh interoperability pass.

Goblin Modem 0.1.0.20260919.1 uses the Skiff binaries and local configuration variables. Matching source and detailed verification results are in the signed catalog. Mosh is a registered trademark of Keith Winstein. Goblin Skiff is independent of the upstream project; see the trademark notice.