Goblin Reactor RPM repository

Signed third-party Goblin Mosh RPMs maintained by Adam DePrince. Repository and package catalog: https://apt.goblinreactor.com/ For Debian or Ubuntu, use the APT instructions on that page instead.

Available packages

goblin-mosh includes the client, server, goblin-moshcp, dictionary compiler, five man pages and Bash completion. These are bundled commands, not separate RPM packages. Only the following native builds are published:

Rocky packages require the normal Rocky repositories, CRB and EPEL. Other RPM distributions, other releases, ARM64 and 32-bit systems are not tested or published. Do not mix Fedora and Rocky packages. These packages are not endorsed by Fedora, Rocky Linux or Red Hat.

Set up DNF

Install the setup tools first. Existing curl-minimal is sufficient:

sudo dnf install ca-certificates gnupg2
command -v curl >/dev/null || sudo dnf install curl

Then run this block. It checks the OS, architecture and signing-key fingerprint before installing the repository configuration:

(
    set -eu
    . /etc/os-release
    case "$ID:$VERSION_ID" in
        fedora:44) goblin_target=fedora-44 ;;
        rocky:9|rocky:9.*) goblin_target=rocky-9 ;;
        rocky:10|rocky:10.*) goblin_target=rocky-10 ;;
        *) echo "No package is published for this OS release." >&2; exit 1 ;;
    esac
    test "$(uname -m)" = x86_64 || {
        echo "Only x86_64 RPMs are currently published." >&2
        exit 1
    }
    if test "$ID" = rocky; then
        sudo dnf install dnf-plugins-core epel-release
        sudo dnf config-manager --set-enabled crb
    fi
    goblin_keydir=$(mktemp -d)
    trap 'rm -f "$goblin_keydir/key.asc" "$goblin_keydir/goblinreactor.repo"; rmdir "$goblin_keydir"' EXIT
    curl -fsSL https://apt.goblinreactor.com/goblinreactor-archive-keyring.asc \
        -o "$goblin_keydir/key.asc"
    goblin_fingerprint=$(gpg --batch --show-keys --with-colons \
        "$goblin_keydir/key.asc" | awk -F: '$1 == "fpr" {print $10; exit}')
    test "$goblin_fingerprint" = B7B61E8CB85A9270530364F23273CB62402FC793 || {
        echo "Unexpected repository signing key; stopping." >&2
        exit 1
    }
    curl -fsSL "https://apt.goblinreactor.com/rpm/goblinreactor-$goblin_target.repo" \
        -o "$goblin_keydir/goblinreactor.repo"
    sudo install -d -m 0755 /etc/pki/rpm-gpg
    sudo install -m 0644 "$goblin_keydir/key.asc" \
        /etc/pki/rpm-gpg/RPM-GPG-KEY-goblinreactor
    sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-goblinreactor
    sudo install -m 0644 "$goblin_keydir/goblinreactor.repo" \
        /etc/yum.repos.d/goblinreactor.repo
)
sudo dnf --refresh makecache
sudo dnf install goblin-mosh

Signing-key fingerprint:

B7B6 1E8C B85A 9270 5303 64F2 3273 CB62 402F C793

DNF may ask to import this same key for its separate repository-metadata key store. Both gpgcheck=1 and repo_gpgcheck=1 must stay enabled. Do not use --nogpgcheck or disable TLS verification. This grants the archive maintainer the trust normally required to install system software.

Use, update and remove

Install on both endpoints, then connect:

goblin-mosh user@server
man goblin-mosh
sudo dnf upgrade goblin-mosh
rpm -q goblin-mosh
sudo dnf remove goblin-mosh

Mosh's command prefix opens the two-pane file menu: Ctrl-^ (usually Ctrl-Shift-6), then 0. Enter starts transferring the selected file or directory without leaving the browser. The connection uses independent directional pacing, zstd level 22, FEC and librsync file synchronization.

The package installs goblin-prefixed commands in /usr/bin and coexists with the distribution's mosh package. The obsolete adam-mosh package conflicts with it. It never deletes an administrator's manual /usr/local installation; check "command -v goblin-mosh" if an older manual build shadows /usr/bin. Open a new session after updating; existing sessions are not restarted. After upgrading the OS release, install the matching repository configuration. SSH must reach the server for login, and its firewall must allow the selected Mosh UDP port (normally 60000–61000). Installing the package does not open firewall ports or start a permanent system daemon.

Matching source and rebuilding

Each binary has a complete matching, signed source RPM. Download the SRPM for your release from the package catalog:

The source RPM contains the modified source archive, the RPM spec, Debian packaging, and container build recipes. Verify a downloaded SRPM with "rpmkeys --checksig filename.src.rpm". Install rpm-build and your DNF builddep plugin, use "sudo dnf builddep ./filename.src.rpm" to install its build dependencies, then run "rpmbuild --rebuild ./filename.src.rpm" as a regular user on the matching OS. The DNF plugin package is dnf5-plugins on Fedora 44 and dnf-plugins-core on Rocky. Build dependency inventories, image digests, test logs and artifact checksums are linked in the catalog.

Licenses and verification

Goblin Mosh remains GPL-3.0-or-later, with upstream notices and OpenSSL linking exceptions preserved; it is not an Apache-2.0-only distribution. See /usr/share/licenses/goblin-mosh/ and /usr/share/doc/goblin-mosh/THIRD_PARTY.md. Runtime libraries are dynamically linked distribution packages, not bundled copies. Planned audio codecs are not included in this release.

The --fips-crypto provider mode is built, but this is not a FIPS certification claim. A properly configured and validated provider plus a compliant surrounding system are still required.

All three RPM builds pass 26 core tests and an installed encrypted file-transfer test. Public-release checks also install through HTTPS with both package and metadata signature verification, retrieve and verify the SRPM, confirm stock Mosh coexistence, and repeat the file-transfer test.

Source branch: https://github.com/adamdeprince/mosh/tree/low-bandwidth-mosh Issues: https://github.com/adamdeprince/mosh/issues Rocky repository background: https://wiki.rockylinux.org/rocky/repo/

goblin-mosh -J user@jump user@destination
goblin-mosh -J user@first,user@second user@destination