dove
Open source · your infrastructure

Send a file.
Then forget it.

dove is a small CLI for sharing files from your own cloud. Links expire. Access is limited. In full mode, the server serving the file cannot read it.

Install dove View on GitHub
~/project

$ dove share release.zip \

--expires 2d --downloads 3

encrypting •••••••••• 100%

uploaded 842 MB

https://share.example/d/k7mx2#key

expires in 2 days · 3 downloads

One command. No dashboard to babysit.

The model

A backup tool encrypts to you and locks everything down. dove turns that inside out: it encrypts to a link, grants exactly the access you allow, then cleans up.

Choose your boundary

Simple when simple is enough.
Full when privacy matters.

01
Simple

A private bucket and an expiring link.

dove uploads to your S3 bucket and creates a presigned URL. The bucket lifecycle cleans up later.

  • Provisions in seconds
  • No server to run
  • Expires in up to 7 days
dove provision
02
Full · encrypted

The server serves it.
The server can't read it.

Files are encrypted on your machine before upload. Your cloud enforces expiry and download counts without ever receiving the key.

  • AES-256-GCM, client-side
  • One-time or N-time access
  • Optional PIN over a second channel
  • Links can live beyond 7 days
dove provision --full
Why the server can't read it

The secret stays after the #.

In a dove link, the decryption key lives in the URL fragment. Browsers never send that part to a server. The page reads it locally and decrypts the file on your device.

Your infrastructure sees the share ID and encrypted bytes. It can approve a download, count it, or expire it—but it never sees the key.

https://share.example/d/k7mx2#ve4P...8q
sent to servershare idstays in browserdecryption key
ciphertext
key in #
your file
PIN-locked shares

A link plus a PIN, over two channels.

For credentials, recovery codes, or banking details, require a short PIN and send it separately by text or call. The gate rate-limits guesses and locks the share after repeated failures. The PIN controls access; the fragment secret stays on the recipient’s device and controls decryption. The server can’t read the file either way.

Security boundaries

What dove protects—and what it doesn’t.

Trust starts with a precise claim. These boundaries are part of the design, not fine print.

Full mode hides content

Encryption happens before upload. Storage, CDN, and the access gate receive ciphertext, never the fragment key.

Simple mode is plaintext

The bucket is private and the link expires, but your cloud provider can read the object. Use full mode when that matters.

Operators host share pages

An operator controls their page’s HTML. Treat dove.sh and the official GitHub repository as the only software sources.

No audit claim

The design and source are public. dove does not claim an independent security audit unless one is completed and published.

Here for a shared file?

Install once. Then run dove get.

Return to the share page and copy its pre-filled command. dove streams the encrypted file to disk and decrypts it locally—even when it is too large for the browser.

From your share page
dove get https://share.example/d/k7mx2#key

Use the exact command from your link. The part after # is the decryption key and never goes to the server.

Canonical install

Get dove from the source.

This is dove's official install page. Release binaries are checksummed, signed with Sigstore, recorded in a public transparency log, and notarized on macOS.

Verify a release on GitHub 
brew install boomctl/tap/dove

Inspect install.sh on GitHub before running it.

Verify a release

Don’t take the download on faith.

Every release includes a checksum manifest, a Sigstore certificate, and a signature. The signer must be dove’s GitHub release workflow—not a private key or an unknown account.

01

Download the binary, SHA256SUMS, and matching .sig and .pem files from the same release.

02

Check the bytes.

sha256sum --check SHA256SUMS --ignore-missing
03

Verify the GitHub Actions identity.

cosign verify-blob --certificate dove-…pem --signature dove-…sig
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
  --certificate-identity-regexp 'github.com/boomctl/dove/.github/workflows/release.yml' dove-…
Inspect the signing workflow