# Goblin Reactor Homebrew packages

Goblin Mosh for macOS, maintained by Adam DePrince. This is an independent
third-party Homebrew tap, hosted at https://brew.goblinreactor.com/.

## Available package

**goblin-mosh** is a Mosh fork for bandwidth-constrained links. It uses zstd
level 22, independent upload/download pacing, idle keepalive backoff, terminal
graphics, and a two-pane file-transfer menu with librsync and FEC.

| Package | Version | Tested binary target |
| --- | --- | --- |
| goblinreactor/tap/goblin-mosh | 1.4.0-goblin20260910.2 | Apple Silicon (arm64), macOS 26 Tahoe |

It includes goblin-mosh, goblin-mosh-client, goblin-mosh-server, goblin-moshcp,
the dictionary compiler, five man pages and Bash completion. These commands
are bundled in one formula, not separate packages.

The Apple Silicon macOS 26 bottle is the tested prebuilt package. Other macOS
targets can attempt a source build, but have not been verified for this release.
Do not force this ARM bottle onto an Intel Mac or an older macOS release.
For Linux, use the [Debian/Ubuntu and RPM packages](https://apt.goblinreactor.com/).

## Install

Install [Homebrew](https://brew.sh/) first if it is not already installed,
then run these commands as your normal user, without sudo:

~~~sh
brew tap goblinreactor/tap https://brew.goblinreactor.com/homebrew-tap.git
brew install goblinreactor/tap/goblin-mosh
~~~

The explicit HTTPS tap URL is important: this tap is hosted here, not in a
GitHub repository inferred from its name. Homebrew will download a matching
bottle automatically. The tap's formula verifies the source and bottle with
SHA-256 checksums; TLS verification must remain enabled.

Homebrew installs the runtime dependencies, including protobuf, abseil,
OpenSSL 3, zstd, librsync, WebP, PNG and ncurses. Existing dependencies may be
updated as part of a normal Homebrew install. Do not use --ignore-dependencies
or --force-bottle as a workaround for an unsupported machine.

This is third-party system software. Adding a tap means trusting its maintainer
and formula code, including future updates. No custom installation script or
root-level background service is required.

## Use and coexistence

Install Goblin Mosh on both endpoints, then connect:

~~~sh
goblin-mosh user@server
man goblin-mosh
~~~

Open the two-pane control/file menu with Mosh's command prefix: Ctrl-^
(usually Ctrl-Shift-6), then 0. Enter starts transferring the selected file or
directory without leaving the browser. Tab and Shift-Tab switch panes.

SSH must reach the server for login, and its firewall must allow the selected
Mosh UDP port (normally 60000–61000). Installing this package does not open
firewall ports or start a permanent daemon.

The goblin-prefixed commands coexist with Homebrew's ordinary mosh formula.
The package does not delete manually installed /usr/local/bin/goblin-mosh
files. Check which installation your shell selects:

~~~sh
command -v goblin-mosh
brew --prefix goblin-mosh
~~~

If an older manual installation wins, adjust PATH or back up and remove that
manual installation explicitly. Do not use brew link --overwrite to erase
administrator-managed files. The old adam-mosh name is not supplied.

On a remote Apple Silicon Mac whose SSH PATH excludes Homebrew, select the
server explicitly:

~~~sh
goblin-mosh --server=/opt/homebrew/bin/goblin-mosh-server user@mac
~~~

## Update, verify and remove

~~~sh
brew update
brew upgrade goblinreactor/tap/goblin-mosh
brew info goblinreactor/tap/goblin-mosh
~~~

Open a new session after an upgrade. Existing Mosh processes are not restarted.
The tap is a small, read-only Git repository over HTTPS; normal brew update
fetches its formula changes from this server.

The optional installed-package test uses an isolated local encrypted session
and temporary directories. It exercises recursive file synchronization and
keyboard input without contacting your real remote sessions. It needs the
formula's Python test dependency:

~~~sh
brew install --only-dependencies --include-test goblinreactor/tap/goblin-mosh
brew test goblinreactor/tap/goblin-mosh
~~~

To remove the Homebrew package and this tap:

~~~sh
brew uninstall goblin-mosh
brew untap goblinreactor/tap
~~~

This does not remove stock Mosh or a separate manual installation.

## Artifacts and matching source

| Artifact | Download |
| --- | --- |
| Apple Silicon macOS 26 bottle | [Binary package](https://brew.goblinreactor.com/bottles/goblin-mosh-1.4.0-goblin20260910.2.arm64_tahoe.bottle.tar.gz) |
| Matching modified source | [Source archive](https://brew.goblinreactor.com/sources/goblin-mosh-1.4.0-goblin20260910.2.tar.gz) |
| Exact release formula | [goblin-mosh.rb](https://brew.goblinreactor.com/releases/20260910.2/goblin-mosh.rb) |
| Installed-package verification | [Encrypted transfer test](https://brew.goblinreactor.com/releases/20260910.2/public-transfer-test.log) |

The [release catalog](https://brew.goblinreactor.com/packages.json) lists the
bottle, source, formula revision, dependency versions, checksums and test logs.
Its [detached signature](https://brew.goblinreactor.com/packages.json.asc)
uses the existing Goblin Reactor archive key:

~~~text
B7B6 1E8C B85A 9270 5303 64F2 3273 CB62 402F C793
~~~

[Download the public signing key](https://brew.goblinreactor.com/goblinreactor-archive-keyring.asc).
Homebrew uses the formula's SHA-256 checksums automatically; the separate
catalog signature is an additional verification mechanism, not a signature
that Homebrew itself checks.

The [matching source archive](https://brew.goblinreactor.com/sources/goblin-mosh-1.4.0-goblin20260910.2.tar.gz)
contains the modified source, build system, license notices and packaging
recipes. The exact formula is also available from the tap and recorded inside
the Homebrew bottle. To compile it yourself:

~~~sh
brew install --build-from-source goblinreactor/tap/goblin-mosh
~~~

Source builds need current Apple Command Line Tools plus the build dependencies
declared in the formula. They run 24 core tests; the positive FIPS-provider test
skips if no configured provider is installed. The bottle is verified by
installing it through the public HTTPS tap and rerunning the file-transfer test.

## Licenses and limits

Goblin Mosh remains GPL-3.0-or-later, with upstream notices and OpenSSL linking
exceptions preserved. It is not an Apache-2.0-only package. See the installed
COPYING, copyright and THIRD_PARTY.md under the formula's share/doc directory.
Homebrew dependencies are separately maintained, dynamically linked packages.
The planned audio codecs are not included in this release.

Normal macOS sessions use Apple's CommonCrypto backend. The --fips-crypto
provider mode is built using OpenSSL 3, but this package does not include a
validated provider or establish FIPS compliance. A suitable provider and a
compliant surrounding system are still required.

Source branch: https://github.com/adamdeprince/mosh/tree/low-bandwidth-mosh
Issues: https://github.com/adamdeprince/mosh/issues
Homebrew tap documentation: https://docs.brew.sh/How-to-Create-and-Maintain-a-Tap