v1.0.8

v1.0.8 — App lock, themes, tamper detection, Android 17

This release adds an opt-in biometric gate on the whole app, two new dark themes (Catppuccin Mocha and Dracula), runtime APK signature verification, and bumps targetSdk to 37 (Android 17) for the latest platform security gates. FLAG_SECURE is now hardcoded on every activity in the app rather than just the sensitive ones.

---

NEW FEATURES

Biometric app lock (opt-in)

• New toggle in Settings: Biometric app lock.
• When on, the app shows the biometric / device-credential prompt on first launch and any time it returns from background.
• Backed by the existing hardware-attested CryptoObject flow — same BIOMETRIC_STRONG + Keystore binding used for the private-key reveal and zip export.
• Session is held in memory only; killed when all activities stop.

Idle auto-lock

• Companion setting: Auto-lock when idle → Off / 1 min / 5 min / 15 min.
• Only shown / active when the biometric lock is enabled.
• Tracks onUserInteraction across MainActivity, SettingsActivity, LogViewerActivity, TunnelCreatorActivity. After the configured idle period, the session is dropped and the user is bounced back to MainActivity for re-authentication.

Themes

• New Settings ListPreference: Theme → System default / Catppuccin Mocha / Dracula.
• Catppuccin and Dracula are always-dark Material 3 palettes with full color schemes (primary / secondary / tertiary / container variants, surface tones, error/warning tags, navigation/status bar tints).
• Selecting a static palette disables Material You dynamic colors so the chosen accent stays consistent.
• Theme changes apply immediately via recreate(); pre-sets currentThemeMode synchronously to avoid double-recreate flicker.

APK tamper detection

• SignatureVerifier pins the SHA-256 of the trusted signing cert: 98d324d4106a368c62729a0a24d9ac9a6b47f8ac4c6585348531f0ee4eb6a04c.
• Checked on every MainActivity.onCreate. If the cert hash doesn't match, the app shows a blocking dialog and exits.
• Skipped in BuildConfig.DEBUG builds — and DEBUG is a compile-time constant, so a repackager can't flip it back.
• Uses PackageManager.GET_SIGNING_CERTIFICATES on API ≥ 28, falls back to legacy GET_SIGNATURES on older devices.

About section

• New collapsible About entry in Settings:
  • GitHub → github.com/jegly
  • Website → jegly.xyz
  • Version → v1.0.8
• Tap to expand/collapse; expanded state persists across theme-change recreates via onSaveInstanceState.

---

HARDENING

FLAG_SECURE is now app-wide

• Previously applied only to the sensitive screens (editor, detail, log viewer, TV).
• Now hardcoded on BaseActivity (covers MainActivity + TunnelCreatorActivity) and SettingsActivity as well.
• Result: screenshots, screen recording, recents-thumbnail leaks, and accessibility-tool screen reads are blocked everywhere in the app.

targetSdk 36 → 37 (Android 17)

• Picks up the new Android 17 security gates and removes the install warning on Android 17 devices.
• compileSdk bumped to match.
• Build requirement: Android SDK Platform 37 must be installed via SDK Manager.

---

UX / POLISH

• Settings preferences no longer use initialExpandedChildrenCount — it conflicted with dynamic isVisible toggles on the About section and caused items to "expand and close quickly".
• Disabled the RecyclerView item animator on the preferences list to stop visible jumps when async backend detection changes layout.
• kernel_module_enabler now starts hidden and only becomes visible if the async root-shell check succeeds — prevents the About section from jumping up on unrooted devices when the toggle gets removed after the first frame.
• Pre-setting Application.currentThemeMode synchronously in the theme change listener prevents a double-recreate race condition that caused theme changes to flicker.

---

ALREADY IN PLACE (no change, called out for clarity)

• android:allowBackup="false" — prevents adb backup extraction of tunnel configs.
• network_security_config.xml — cleartext forbidden, only system CAs trusted.
• VpnService status notification is system-controlled and not under app control, so no app-side notification privacy work was needed.

---

FILES ADDED

• ui/src/main/java/com/wireguard/android/util/SignatureVerifier.kt
• RELEASE_NOTES.md (this file)

FILES MODIFIED

gradle.properties                                        version 1.0.8
ui/build.gradle.kts                                      compileSdk + targetSdk → 37
tunnel/build.gradle.kts                                  compileSdk → 37
ui/src/main/java/com/wireguard/android/Application.kt    theme observer, app lock state,
                                                          idle-timeout watcher,
                                                          activity lifecycle tracking
ui/src/main/java/com/wireguard/android/activity/
  BaseActivity.kt                                        FLAG_SECURE, theme, onUserInteraction
  MainActivity.kt                                        tamper check, app-lock onResume gate
  SettingsActivity.kt                                    theme handling, app lock toggle,
                                                          idle timeout setting, expandable
                                                          About, item-animator disabled,
                                                          kernel_module_enabler hidden by
                                                          default to prevent jump,
                                                          FLAG_SECURE, onUserInteraction
  LogViewerActivity.kt                                   theme handling, onUserInteraction
ui/src/main/java/com/wireguard/android/util/
  UserKnobs.kt                                           themeMode, appLockEnabled,
                                                          appLockTimeout flows
  BiometricAuthenticator.kt                              FragmentActivity overload for
                                                          activity-level biometric prompts
ui/src/main/res/values/colors.xml                        Catppuccin + Dracula palettes
ui/src/main/res/values/styles.xml                        AppTheme_Catppuccin, AppTheme_Dracula
ui/src/main/res/values/themes.xml                        WireGuardTheme variants
ui/src/main/res/values/strings.xml                       theme + app lock + about + tamper +
                                                          idle timeout strings
ui/src/main/res/xml/preferences.xml                      theme, app_lock, app_lock_timeout,
                                                          expandable About section

---

INSTALLING

Sideload the APK from the Releases page.

Requires Android 8.0 (API 24) or higher.

Android will warn about installing from an unknown source — that's expected. The app is not distributed through the Play Store.

---

VERIFYING YOUR INSTALL

After installing, check the signing certificate matches the pinned hash:

SHA-256: 98d324d4106a368c62729a0a24d9ac9a6b47f8ac4c6585348531f0ee4eb6a04c

The app does this check itself on launch — if you see the "Unverified App" dialog, the APK has been tampered with or re-signed.

v1.0.20260315-hardened-7

v1.0.20260315-hardened-7

Bug fixes — encrypted config store

Fix: "No matching key found for ciphertext stream" on export (Android 14) The zip export was failing with a Tink decryption error on any tunnel whose config had been edited after import. The root cause was introduced in v5: writing encrypted content to a .conf.tmp file then renaming it to .conf is incompatible with how Tink works. Tink binds ciphertext to the file path used during encryption as associated data (AAD). A file encrypted as tunnel.conf.tmp cannot be decrypted when opened as tunnel.conf. The fix writes directly to the canonical path instead.

Fix: Blank/empty tunnel configs after editing (Android 16) The same broken save path from v5 left configs on disk that could not be decrypted, causing tunnels to appear with empty configs after the app was reopened. Fixed by the same change above.

Fix: Stale .conf.tmp leftover files excluded from tunnel enumeration Any .conf.tmp files left behind by the broken v5 save path are now filtered out during enumeration so they no longer appear as phantom tunnels that fail to load.

Fix: Missing R8 keep rules for Tink and security-crypto Added -keep rules for com.google.crypto.tink.** and androidx.security.crypto.** in proguard-android-optimize.txt. Obfuscation was enabled in v1 but the keep rules were never added, leaving Tink's key registry and primitive classes at risk of being renamed or stripped by R8 in future builds.

Note: Tunnels that were edited on a previous build are corrupted on disk and cannot be recovered. Delete and re-import them after installing this update.

v1.0.20260315-hardened-6

FLAG_SECURE added to TunnelDetailFragment — tunnel metadata including addresses, endpoints, DNS servers and public key are now protected from screenshots, screen recording and recents thumbnails.

v1.0.20260315-hardened-5

Third security audit pass

Fixed TOCTOU race condition in EncryptedConfigStore.save() — config files are now written atomically via a temp file to prevent data loss if the app is killed mid-save
Removed dead overlay permission code from QuickTileService — SYSTEM_ALERT_WINDOW was already removed from the manifest in a previous audit; the unreachable code path requesting it has now been deleted
Deleted sync-crowdin.sh — upstream translation sync script with no relevance to this fork

wireguard-android-hardened-1.0.20260315-4

Hardens the log viewer — previously accessible to anyone with an unlocked device.
Changes:

Biometric authentication now required to open the log viewer (PIN/pattern/password accepted as fallback)
FLAG_SECURE added to log viewer — prevents screenshots and screen recording of log content
App icon background changed from red to dark charcoal
Dead code removed: FileConfigStore.kt and VersionPreference.kt deleted entirely
FLAG_SECURE added to Android TV interface (TvMainActivity)

v1.0.20260315-hardened-3

WireGuard Android Hardened v1.0.20260315-3
Second security audit pass — dead code removal and TV interface hardening.
Changes in this release:

FLAG_SECURE added to TvMainActivity — the Android TV interface now blocks screenshots, screen recording, and recents thumbnails, consistent with the phone UI
FileConfigStore.kt deleted — the plaintext config store implementation has been removed entirely from the codebase. It was already unreachable at runtime (replaced by EncryptedConfigStore in the first hardening pass) but its presence was a liability worth eliminating
VersionPreference.kt deleted — dead UI code removed. The version/package name preference was already removed from the Settings screen in the first pass; the backing class has now been deleted too

No functional changes — tunnel behaviour, import/export, biometric auth, and all other features are unchanged.
Based on upstream WireGuard Android v1.0.20260315.

v1.0.20260315-hardened-2

Security: Patches two vulnerabilities in golang.org/x/crypto that are unpatched in upstream WireGuard Android as of this release:

[CVE] Unbounded memory consumption in golang.org/x/crypto/ssh GSSAPI parsing
[CVE] Out-of-bounds panic in golang.org/x/crypto/ssh/agent on malformed messages

Upgraded golang.org/x/crypto from 0.38.0 to 0.45.0.

WireGuard Android Hardened v1.0.20260315-1

Security update — bumps golang.org/x/crypto from 0.38.0 to 0.45.0 in the Go tunnel library.
Fixes:

SSH: GSSAPI DoS risk mitigation
SSH agent: panic prevention on malformed constraint

Based on upstream WireGuard Android v1.0.20260315.

v1.0.0-hardened

WireGuard Android Hardened v1.0.0
A hardened fork of WireGuard Android focused on privacy and security. Based on upstream v1.0.20260315.
What's changed from upstream:

Tunnel configs encrypted at rest with AES-256-GCM via Android Keystore
Biometric authentication upgraded from BIOMETRIC_WEAK to BIOMETRIC_STRONG with hardware-attested CryptoObject
Self-updater completely stripped — Updater.kt, Ed25519.java, SnackbarUpdateShower.kt deleted
Device fingerprint USER_AGENT removed — no longer broadcasts SDK version, ABI, board, manufacturer, model, or package name
REQUEST_INSTALL_PACKAGES and SYSTEM_ALERT_WINDOW permissions removed
Remote control intents removed from manifest, settings UI, and codebase entirely
Network security config added — cleartext traffic forbidden, system CAs only
FLAG_SECURE extended to cover entire tunnel editor screen, not just private key reveal
Clipboard marked EXTRA_IS_SENSITIVE on API 33+ — excluded from clipboard history
ProGuard obfuscation re-enabled (-dontobfuscate removed)
Zip export biometric bypass blocked — explicit warning shown when hardware unavailable
Log export token replaced with UUID.randomUUID() instead of a WireGuard private key
VersionPreference and DonatePreference removed from settings

Install: Download the APK, enable "Install unknown apps" for your file manager, and install. Requires Android 8.0 (API 24) or higher.
Note: This is a personal use build. Not affiliated with WireGuard LLC.