Skip to content

v0.3.4

Choose a tag to compare

View all tags
@fr34aky fr34aky released this 30 Aug 21:29
· 104 commits to main since this release
v0.3.4
b485c3f

The app is now called fips2go. Installs in place over any earlier release via the automatic update prompt, Check for updates, or sideload — identity, settings and app data are kept.

Changes since v0.3.2

  • Renamed to fips2go where the name refers to the app: the launcher caption, the entry in Android's Settings → Network → VPN, and the Zapstore listing. The Android package is unchanged (org.fips.android), which is why this updates in place rather than installing alongside your existing copy.
  • Names referring to the mesh are unchanged, because they were never wrong: the in-app header, the "FIPS VPN" notification channel, "FIPS mesh connected", and "Mesh apps". You run fips2go; it joins the FIPS mesh.

Nothing else about the app's behaviour has changed since 0.3.2. There is no functional difference in this build beyond the naming.

(0.3.3 exists but contained no user-visible change — it was cut to produce artifacts under a fixed build-verification script. If you are on 0.3.2 or 0.3.3, this is the update that renames the app.)

Install

Sideload the APK matching your device (adb install -r or open it on the phone); min SDK 26 (Android 8.0). Verify the download against the matching .sha256, or update from within the app.

  • universal — all three ABIs in one file. Installs anywhere; larger. Use this if unsure.
  • arm64-v8a — every 64-bit ARM phone from roughly 2016 on; the device-verified build.
  • armeabi-v7a — old 32-bit phones. Compiles and packages; not exercised on real 32-bit hardware.
  • x86_64 — Android emulator, Chromebooks.

Release APKs are signed with the key whose certificate SHA-256 is
aa905e32bd0058874d252990abba26c78ddd8fca018195ebd1cd232a99a7a8e1 — check a
fresh download with apksigner verify --print-certs <apk>. This matters most on a
first install: there is no previously installed signature for Android to
compare against, so the checksum and this fingerprint are the only things
identifying a genuine build. Subsequent updates are enforced against the key
automatically.

Caveats

Only arm64-v8a is exercised on real hardware. armeabi-v7a compiles and packages but has not been run on a 32-bit device; x86_64 is emulator-verified.

Assets 11
Loading