Skip to content
The Gateway

Release notes

The public site currently serves The Gateway v2.13.1 for linux/amd64 and linux/arm64.

Download paths

Section titled “Download paths”
Path Purpose
/install.sh One-shot bootstrap installer. Downloads the verified binary and hands off to the full installer.
/install-gateway.sh Full profile-driven installer for rpi, vps, node, full, and custom installs.
/releases/latest/gatewayd-linux-amd64 Latest amd64 daemon binary.
/releases/latest/gatewayd-linux-arm64 Latest arm64 daemon binary.
/releases/latest/SHA256SUMS Checksums for the latest binaries.
/releases/v2.10.0/ Pinned v2.10.0 archive.
/releases/v2.11.0/ Pinned v2.11.0 archive.
/releases/v2.12.0/ Pinned v2.12.0 archive.
/releases/v2.12.1/ Pinned v2.12.1 archive.
/releases/v2.13.1/ Pinned archive of the current release.

v2.13.1 summary

Section titled “v2.13.1 summary”

v2.13.1 is a verification-driven patch release on top of v2.13.0. Its fixes came from running the product’s own node and leak checks against live reference deployments.

The important operator-facing fixes are:

  • dns.upstream_mode now reaches the DNS plane, so configured DoT/DoH is actually applied at boot.
  • Privacy mode no longer downgrades a configured encrypted DNS upstream to cleartext.
  • Leak checks understand encrypted upstreams instead of reporting them as ISP leaks.
  • /whoami redacts API keys, bearer tokens, cookies, and proxy credentials.
  • The node verifier no longer risks disabling Pi-hole while checking role scope.
  • Automatic rollback stops the service and atomically swaps the binary, avoiding ETXTBSY false-successes.
  • Release tooling now checks the embedded UI, installer heredocs, installer embeds, shell syntax, builds, vet, and tests together.
  • Both reference nodes passed 18/18 verification checks and 9/9 leak checks.

Upgrade notes

Section titled “Upgrade notes”

Before upgrading a live gateway:

  1. Take a backup before replacing the binary.

  2. If dns.upstream_mode is dot or doh, confirm the configured upstream is reachable on port 853 or 443; this setting now takes effect at boot.

  3. Create a diagnostics-role API key at /root/.gateway-api-key before running scripts/verify-node.sh; without it, API-gated checks are skipped.

  4. Prefer the update mode for an already-installed node:

    Terminal window
    GATEWAY_UPDATE=1 curl -fsSL https://thegateway.pro/install.sh | sudo bash

Verify checksums

Section titled “Verify checksums”
Terminal window
curl -fsSLO https://thegateway.pro/releases/latest/SHA256SUMS
curl -fsSLO https://thegateway.pro/releases/latest/gatewayd-linux-amd64
shasum -a 256 -c SHA256SUMS --ignore-missing

For arm64, download gatewayd-linux-arm64 instead.

Section titled “Related”