Skip to content

VRKA Android 4.0.3

Choose a tag to compare

View all tags
@MaverickRox MaverickRox released this 07 Sep 08:24
· 31 commits to main since this release
v4.0.3
f508547

VRKA Android 4.0.3 — Corrective Hardening Pass

VRKA Android 4.0.3 delivers critical cryptographic and filesystem hardening, comprehensive behavioral test expansion, and documentation corrections following an external security review.

Key Changes & Hardening

  • OpenPGP Issuer-Fingerprint Verification: Enforced cryptographic OpenPGP issuer-fingerprint validation in SecureComponentUpdater. The detached signature verification routine now extracts and validates the issuer fingerprint subpacket against the pinned upstream trust anchor (AC0CBBE6848D6A873464AF4E57CF65933B5A7581), strictly rejecting signatures from untrusted subpackets or forged key IDs.
  • Filesystem Transactional Replacement with Safe Fallback: Abstracted filesystem operations behind a clean FileOperations interface. Implemented robust handling for AtomicMoveNotSupportedException with safe file replacement, directory syncing (fsync), and transactional rollback on post-validation failure.
  • Comprehensive Behavioral Test Suite: Replaced static/shallow checks with 32 deep behavioral tests in SecureComponentUpdaterTest (151 tests total across the project, all passing offline). Tests comprehensively verify multi-hop redirect chains, HTTP downgrade rejection, untrusted host rejection, redirect loop/depth limits, in-memory OpenPGP RSA key generation/signing, tampered signatures, issuer fingerprint mismatches, and atomic move fallback mechanics.
  • Documentation & Certificate Accuracy: Corrected the release signer certificate SHA-1 fingerprint (7758980f74a503684bf1a187994e447823d19d7c) and aligned all architectural, security, and test documentation across README.md, SECURITY.md, SECURITY_REVIEW.md, TEST_RESULTS.md, and KNOWN_LIMITATIONS.md.
  • In-Place Upgrade Verified: Verified seamless in-place upgrade on physical hardware (OnePlus 11 5G CPH2447, Android 14) with canonical signing lineage preserved (9befdbf4fb00acedb72f866ce4016944c95ea99448e205768383b310ca11e1fa).

Release Artifacts & Checksums

  • Package: VRKA-Android-v4.0.3.apk
  • SHA-256 Checksum: b447477cf4a0c9a4db473c1d5dc38381956c0092b75060d6000aed6a5edf2ffb
  • Signing Certificate (SHA-256): 9befdbf4fb00acedb72f866ce4016944c95ea99448e205768383b310ca11e1fa
  • Signing Certificate (SHA-1): 7758980f74a503684bf1a187994e447823d19d7c
Assets 4
Loading