v3.8.0 — Security, Transparency & Reliability Update (Recommended)

ASYCUDA World — Republic of Iraq (v3.8.0 / versionCode 38)

Security Hardening & Open-Source Audit Release

• Pinned UNCTAD/SOClass Publisher Signature & Hostname Allowlist for Government JARs:
  • resolveTrustedMofJarUrl() and openMofConnection() enforce https only, hostname asy.mof.gov.iq only, path /aw/*.jar only, and disable HTTP redirects (setInstanceFollowRedirects(false)).
  • verifyDownloadedJarIntegrity() requires META-INF/SOCODE.RSA and META-INF/SOCODE.SF, verifies the X.509 signer certificate matches the pinned UNCTAD/StrategyObject certificate (SHA-256: 5614dc62a20653686934a216439c8c779cd84d58ccbc37e85dda33433f9e972d), drains all entries through JarVerifier, and confirms every non-META-INF/ file entry in the archive is signed by that exact certificate.
• Full X.509 TLS Certificate & Hostname Verification: Enforces standard PKIX X.509 trust verification (AndroidCAStore + Sectigo Root R46 + ZeroSSL RSA DV SSL CA 2) and RFC 2818 hostname verification for https://asy.mof.gov.iq.
• 100% Open-Source Java Bridge (java-bridge/): Complete source code and reproducible build script (./java-bridge/build-bridge.sh) for 00_bootpatch.jar, jars/00_boot.jar, and jars/00_jnlp.jar.
• Authenticated Localhost IPC Bridge (127.0.0.1:47891): Per-session random UUID token (AUTH|<token>|), canonical path validation, and subprocess execution blocking (checkExec() throws SecurityException).
• Cryptographically Verified In-App APK Updates: Verifies both SHA-256 digest and Android X.509 APK signing certificate (d302d4d050fb986e4088dd3e684c90662d00da748dde8da3d4966baea02da023) prior to installation, with a scrollable Update Center modal and automatic background MOF download coordination.
• In-Memory Redacted Diagnostics: Voluntary bug reports are assembled strictly in RAM (ByteArrayOutputStream), scrubbed of credentials/PII/tokens across all Sentry fields, and never written to disk as .zip files.

Published Release Assets & SHA-256 Checksums

Asset	SHA-256 Checksum
ASYCUDA_Iraq_v3.8.0.apk	3b141d5c17f4a52502d5037cdd87ac9bf44241db632b6c53cef84f27b9d79829
asycuda-iraq.tar.xz	ca3a5b787c4d0ba94fa533b00ebb0ce1bb845ceb96d6f1968fb360dfc7d0c7fe
runtime-arm64.tar.xz	f3dc78325792ea764e82d108b54dfc6fe4d6d9fd752bafc83bb780403286b9c1