Varco 0.2.3

Varco 0.2.3 makes file transfers safer, hardens paste and the terminal, and fixes problems in the UI.

Requires Android 15 or later. It runs on all ABIs because the APK has no native code. Update from 0.2.2 in place: the signing key is the same.

Changed

• Files: a running transfer has a Stop button. Back asks before it stops a transfer. A finished download shows "Saved".
• Closing a connected session (on Home or in the session sheet) asks first. A tab that is not connected closes at once.
• Deleting a snippet asks first.
• The server form tells why Save is off: "No spaces" for the host, "1–65535" for the port.
• App lock does not turn on when the phone has no screen lock. The setting tells you to set one first.
• With TalkBack, each switch row and each option row is one item, with its state.
• After you deny the notification permission once, Varco does not ask again.

Fixed

• A rename in Files no longer replaces a file that has the same name. Before, the old file was lost with no warning.
• If Varco cannot read its data file, Home shows a notice. The file is kept, and a restart reads it again. Before, the app opened empty with no message.
• A reconnect starts with a soft terminal reset. Before, the modes of the old connection (alternate screen, mouse reports) stayed on.
• After an SFTP error, Back goes up one folder and does not close Files.
• A new folder opens at the top of the list.
• A link download shows an indeterminate progress bar, not the size of the link.
• A name such as " .. " is not accepted in Files.
• "New session" in the session sheet opens the server form when the user name is empty.
• A long keyboard-interactive prompt can scroll.
• A double tap on Save for a new server no longer adds the server two times or closes the app.
• A public key file that you pick for import shows a message: pick the private key file.
• The terminal gets its size one time when it opens, not two times.

Privacy and security

• Other apps cannot draw over Varco, and Varco ignores taps that go through an overlay. This protects the host key and secret prompts. This adds the normal permission "hide overlay windows".
• A one-line paste from the keyboard that holds control characters now goes through the paste filter and bracketed paste. Before, it went to the shell as typed keys.
• The bracketed paste markers and the text go to the server in one write, so that a full input queue cannot drop one marker.
• CAN and SUB end an APC string. Before, a server could leave the terminal in a state that ignored all output.
• A server can set the clipboard (OSC 52, when you allow it) only from the tab on screen while Varco has focus. The bell vibrates only for the tab on screen.
• A replaced file on the server keeps its mode during the upload. Before, the data was for a short time in a file with the default mode (for example 0644 for a 0600 key).
• Remote file names and server errors are shown without control characters and without bidi characters, so that a name cannot look like a different name.
• A close during connect now ends the new connection. Before, Files could leave a signed-in SSH session open.
• A cancelled YubiKey tap cannot send a wiped PIN to the key. Before, this could use up a PIN retry.
• Import reads at most 1 MB of a file that is not a font.
• The app lock state changes only on the main thread, so a cold start cannot show the app before the lock.

File	Use
Varco-0.2.3.apk	Release build, signed.

SHA-256:

• Varco-0.2.3.apk: 5350b27b5237343aaf0ddcf5068b1e48cf772e54f2fdba70149bf8c7853f9fd4

Signing certificate SHA-256: c1:c9:b7:b7:7e:23:d0:28:d1:55:ce:ae:f9:6f:80:b8:b1:8b:f6:92:22:b2:ef:c6:ff:7f:ff:1e:99:b0:a9:d9

Check the certificate with apksigner verify --print-certs Varco-0.2.3.apk or with AppVerifier. Do not install an APK with a different certificate.