Lantern DSSE

Where this actually is

This is an experimental release. It is not production-ready, and it is not a preview of something nearly ready either.

We chose the lower of the two available words deliberately. Experimental means interfaces, defaults and configuration may change between releases without a migration path, and that nothing here has been run at length by anyone who did not write it. Run it in a lab. Read it. Break it, and tell us what broke. Do not put it in front of a fleet you would mind losing.

Production is not a property a project declares. It accrues after a thing has been run in many environments by people who did not write it. Saying otherwise before that has happened would ask you to take on trust exactly the thing this project exists to make verifiable.

So the site does not say enterprise-grade, battle-tested, or production-proven anywhere. What it says instead is what has been exercised, and where.

What is open, and what this release contains

There is no held-back edition. The product is open source — no paid tier, no build to unlock, no capability withheld from the published version. That explicitly includes the four things an open-core product normally keeps for itself: multi-tenancy, high availability, multi-region, and the admin console. None of them is a commercial edition here.

This release publishes the whole platform — not an enforcement core now with the operations layer following later. Policy evaluation, TLS interception, HTTP/TLS egress with DLP inspection, DNS control, east-west authorisation, mTLS device identity and admission, private-app publishing through the Connector, the macOS and Windows agents, and the operations layer named above.

See the release notes for downloads, validation scope and known limitations before installing.

The standard egress configuration uses Go's HTTP and TLS implementations. It is running in our three-region lab and is the configuration selected for this release, with DLP inspection and upstream certificate verification enabled. The source also includes curl-impersonate as an optional implementation requiring additional build and configuration steps. It is not enabled by the standard build or installer. How egress works.

Experimental release, 2026-09-11. Repository: github.com/lantern-networks/dsse-core.

What a licence is, and is not

With no vendor keys configured — the default, and what you get by cloning the repository — the software is unlimited. No signature is checked, no seat count is compared, and the licensing code never runs. There is no build to unlock and no feature withheld from the open version.

Where a signed licence is present, it declares a scope, and it may limit growth — refusing new enrolments beyond that scope. It may not stop steering, cut traffic that is already flowing, halt an edge, or disable features. Ending a commercial relationship must not take a running deployment down, and you can check the current state yourself: the predicates that would do it exist and have zero call sites outside their own tests.

What would have to be true before we use the word production

Written down now, so that the claim later has a defined meaning rather than being a marketing decision.

Endpoint signing is done, and on Windows it goes all the way down. The macOS package is signed with a Developer ID and notarised. The Windows agent binaries are signed with an EV certificate. As of 22 August 2026 the kernel-mode WFP driver carries a Microsoft attestation signature — so it loads on an ordinary machine, with Secure Boot on and memory integrity on.

The signed macOS package and Windows installer, including the Microsoft-signed driver, are available in the 0.3.1 GitHub release. Signed distribution is part of the open release. Checksums, the source SBOM and installation guides are available alongside the packages. A driver you compile yourself is not the one Microsoft signed and still requires test-signing mode.