# Lightway Core is a small C library with a warning banner attached

> Lightway Core is the C library behind ExpressVPN's Lightway protocol, and the README opens by saying it is no longer under active development in favour of the Rust rewrite. What remains is a readable multi-platform implementation with a containerised build and an audit-friendly footprint.

**expressvpn/lightway-core** — Lightway Core is a modern VPN protocol by ExpressVPN, to deliver a VPN experience that’s faster, more secure, and more reliable.

- Repository: https://github.com/expressvpn/lightway-core
- Website: https://www.expressvpn.com/lightway
- Stars: 626 · Forks: 74
- Language: C
- License: GPL-2.0
- Published: 2026-10-22 · Updated: 2026-10-22 · Language: en
- Canonical page: https://hysenlabs.com/projects/expressvpn-lightway-core

## The README opens with a deprecation notice

The first thing in the Lightway Core README is a warning box, and it changes how everything else should be read. It states that Lightway C is no longer under active development, that the repository remains unarchived for those who wish to use it for research purposes, and that the authors strongly encourage the use of the Lightway Rust repository, which the project says continues to receive improvements. The project is therefore in a defined state rather than a vague one. There is a successor, named and linked, and the C implementation is explicitly retained for research use. The dates line up with that story. The last push to the main branch was on 2026-04-17, and the three most recent tagged releases are v1.17.17 from 2025-11-19, v1.17.16 from 2025-11-04 and v1.17.15 from 2025-06-12, so the release line stopped before the code stopped moving. If you are evaluating this for a product rather than for study, the README is telling you to pick the other repository.

## What the library actually contains

Lightway Core is described as a small, multi-platform C library that provides the foundational components of a virtual private network, and it is the technology behind Lightway, the protocol ExpressVPN built for an always-on world. The design goal stated in the documentation is to be light on its feet, running faster, using less battery, and being easier to audit and maintain than the code it replaces. That framing is about protocol implementation cost on a device that always has a tunnel open, which is the real constraint for a VPN client on a phone. One practical note for anyone reading the source: the project may be referred to by the internal project name libhelium in the code, so searches for helium will find it. The repository layout supports the multi-platform claim directly, with separate configuration files for android, ios, tvos, linux on several architectures including 386, arm, arm64 and riscv64, plus macos, windows, catalyst and unix, and dedicated multithread variants for linux and windows.

## Earthly gives you the build and the tests in one container

There are two documented build paths, and the first is the short one. The simplest way to build the static library for Linux and run all tests is to use Earthly, which runs the build in a containerised environment, and the whole thing is a single target.

```bash
earthly +all
```

Earthly is also listed among the projects the code relies on, alongside Ceedling and WolfSSL, and the repository ships an Earthfile at the top level together with per-platform yml files and a 3rd_party_deps.yml file, which is where the dependency set per platform lives. The containerised approach matters more than it might look. Building a C library for a dozen platforms means pulling in platform SDKs and third party crypto, and doing that inside a container keeps the local machine clean and makes the build reproducible on a machine that is not the one the maintainers use. It also means the build needs a container runtime, which is an extra prerequisite compared with the traditional path.

## Ceedling is the traditional path, pinned to one version

The second path uses Ceedling, the Ruby based unit testing and build framework, and the documentation is specific about versions because it matters. Ceedling v0.31.1 is the only supported version, since v1.0.0 has breaking changes.

```bash
gem install ceedling -v 0.31.1
```

On Windows the instructions add a constraint of their own: start git-bash, or something similar, from a Developer Command Prompt for VS 2019 before running any subsequent command. From there the build and test command takes a platform argument, where PLATFORM is one of linux, macos or windows.

```bash
ceedling test project:$PLATFORM
```

A release build of the library uses a different target.

```bash
ceedling release project:$PLATFORM
```

The distinction between test and release matters if you are integrating the library, since a release build and a test build are not the same artefact. Code standards are enforced with pre-commit, and the pre-commit hook itself is installed through an Earthly target, so the toolchain that installs the linters lives in the same container system as the build.

## The build matrix shows what this code has to survive

The list of platform files at the top of the repository is the clearest evidence of the scope of this library, and it is worth reading as a compatibility statement rather than a file listing. There are android.yml, ios.yml, tvos.yml, catalyst.yml, unix.yml, macos.yml, macos_arm64.yml, and for linux a spread that includes linux_386, linux_arm, linux_arm64, linux_arm_no_pqc, linux_multithread and linux_riscv64. Windows is covered by windows.yml, windows_32, windows_64, windows_64_multithread and windows_arm64. Three things follow. First, the library targets 32-bit and 64-bit on desktop as well as mobile, including a 32-bit ARM configuration. Second, the riscv64 and 32-bit x86 targets are a sign that the same core is used in embedded contexts where the CPU is not x86 or ARM64. Third, the linux_arm_no_pqc name implies a build variant without post-quantum cryptography support, which is a hint that PQC is part of the protocol stack and can be compiled out. The project description also frames Lightway Core as multi-platform, and the platform set in the repository is where that claim is actually substantiated.

## Documentation and API reference live outside the repository

The documentation is split across two systems and both have sources in the repository. User documentation is generated with Antora and published at lightway.com/docs, with the source kept under +docs/modules/ROOT/pages in this repository. API documentation is generated with Doxygen, configured through the Doxyfile and DoxygenLayout.xml at the top level, and published at lightway.com/doxygen/annotated.html. The Doxygen layout file is worth noting because it means the API reference is deliberately ordered rather than a raw dump of every symbol. There is also a customdoxygen.css file, so the generated output is styled. Security reporting has its own document, SECURITY.adoc, with a section on reporting a vulnerability, and the project asks that such reports go through that path. The acknowledgements section lists the three projects the code relies on: Ceedling, Earthly and WolfSSL. WolfSSL is the TLS stack, and it is also vendored in the tree, with a wolfssl/ directory and the 3rd_party_deps.yml file that tracks third party dependency versions across platforms.

## GPL-2.0 and a research-only posture

The licence is the GNU General Public License, version 2, with the text referenced in the README and a LICENSE file at the top of the repository. GPL-2.0 is a strong copyleft licence, and for a library that other code links against, that has a specific consequence: distributing a combined work imposes obligations on the distribution. This is not legal advice, and the point to raise with whoever owns your compliance process is narrow and concrete, whether a proprietary client that links libhelium can be shipped and under what terms. There is also an EXPRESSVPN_CLA.adoc file at the top level, a contributor licence agreement, and a CODE_OF_CONDUCT.adoc alongside CONTRIBUTING.adoc. The combination of GPL-2.0, a CLA and a research-oriented retention notice says the same thing three ways: the code is readable and reusable for study, but the current path for building a Lightway client is the Rust repository, not this one.

## Conclusion

Lightway Core suits security researchers who want to read the implementation of a commercial VPN protocol in C, and it suits anyone who needs the library as a dependency in an existing build. It does not suit people who want to ship a Lightway client, because the project states it is no longer under active development and points to the Rust version instead, and the last push to the main branch was on 2026-04-17. Before building it, install Earthly and run earthly +all, read the project README warning and the Rust repository notice, and confirm you can accept GPL-2.0 obligations before linking this code into anything you distribute.

## FAQ

### Is Lightway Core still being developed?

No. The README states that Lightway C is no longer under active development, that the repository remains unarchived for research purposes, and that the Lightway Rust repository is receiving continued work instead. The last push to the main branch was on 2026-04-17.

### How do I build Lightway Core and run its tests?

The documented shortcut is earthly +all, which builds the static library for Linux and runs all tests in a containerised environment. The alternative is Ceedling, which the project pins to version 0.31.1.

### Which platforms does Lightway Core support?

The repository carries per-platform configuration for android, ios, tvos, catalyst, unix, macos, linux and windows, including x86 32-bit, ARM, ARM64 and riscv64 variants for Linux, and 32-bit, 64-bit and ARM64 variants for Windows, plus separate multithread build variants.

### What is libhelium in relation to Lightway Core?

It is the same project. The documentation notes that Lightway Core may be referred to by the internal project name libhelium in the source code.

### What licence applies to Lightway Core?

The project is licensed under the GNU General Public License, version 2, with a LICENSE file in the repository, alongside an ExpressVPN contributor licence agreement in EXPRESSVPN_CLA.adoc.

## Sources

- [expressvpn/lightway-core on GitHub](https://github.com/expressvpn/lightway-core)
- [License: GPL-2.0](https://github.com/expressvpn/lightway-core/blob/main/LICENSE)
- [Project website](https://www.expressvpn.com/lightway)
- [README](https://github.com/expressvpn/lightway-core/blob/main/README.md)
- [Releases](https://github.com/expressvpn/lightway-core/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/expressvpn-lightway-core