WiltKey Server v1.3.5

WiltKey Relay v1.3.5 — Play Integrity Attestation & Security Updates

This release of the WiltKey blind relay introduces Google Play Integrity verdict verification, Ed25519 client attestation signing, and PostgreSQL/Redis attestation caching, alongside routing and gap-auditing optimizations.

Self-hosters can update their relay binary with the matching build below.

What changed

• Play Integrity Token Verification: Added /api/v1/integrity/challenge and /api/v1/integrity/attest endpoints to verify Play Integrity tokens with anti-replay nonces.
• Ed25519 Attestation Signing: The relay issues signed client attestation badges (WILTKEY_ATTESTATION:<userId>:...) verifiable offline by all peers.
• Postgres & Redis Caching: Attestation records are cached in PostgreSQL (client_attestations) and nonces in Redis to prevent replay attacks and minimize external API calls.
• Zero-Knowledge Privacy Maintained: Google never receives contact graphs, message ciphertext, or metadata. FOSS/community clients remain fully supported with zero degradation.
• Live Relay Status: Already running on api.wiltkey.org.

Which file do I need?

File	Platform
wiltkey-relay-linux-amd64	Linux x86-64 (most VPS/servers)
wiltkey-relay-linux-arm64	Linux ARM64 (Raspberry Pi 4/5 64-bit, ARM VPS)
wiltkey-relay-windows-amd64.exe	Windows x64
wiltkey-relay-darwin-amd64	macOS (Intel)
wiltkey-relay-darwin-arm64	macOS (Apple Silicon)

Run it

# Linux/macOS (chmod +x first)
chmod +x ./wiltkey-relay-linux-amd64
PORT=8090 REDIS_ADDR=localhost:6379 REDIS_DB=1 ./wiltkey-relay-linux-amd64

# Windows
$env:PORT="8090"; $env:REDIS_ADDR="localhost:6379"; .\wiltkey-relay-windows-amd64.exe

For production deployment instructions and reverse proxy configurations, see:
https://wiltkey.org/docs/relay-server.html#self-hosting

Verify your download

Checksums are in SHA256SUMS.txt:

sha256sum -c SHA256SUMS.txt

Built from source with -trimpath -ldflags="-s -w".