Skip to content

LockPlus 2.0.2

Latest
Latest

Choose a tag to compare

View all tags
@steiale steiale released this 12 Nov 12:56
· 2 commits to main since this release
v2.0.2
b8bd3d9

LockPlus 2.0.2

A security release. One behaviour change first:

  • Profiles start from LockPlus. Starting a profile from System Settings › VPN or with scutil --nc start now only
    works for the profile you picked for Auto-Connect while Auto-Connect is on. Any other start from outside is refused
    with "Connect it from LockPlus". This also stops other users on the same Mac from connecting your profiles with your
    saved credentials. Connecting from the LockPlus window or the menu bar works as before.

New

  • Open profiles from Finder. Double-click a .ovpn, use Open With for .conf and .zip, or drop files on the Dock
    icon. You get the usual import preview; nothing is saved until you confirm.
  • Test Connection (Diagnostics, ⌘R, or the link in the protection panel while connected) checks that IPv4, IPv6 and
    DNS go through the tunnel. It contacts only LockPlus's own test page, and only when you start it. It says "through the
    tunnel" or "blocked" only when the test proved it. It doesn't check the address websites see.

Security

  • Profile checks moved into a sandboxed helper. Importing, editing and checking profiles now happens in a separate,
    sandboxed helper inside the app, with no network and no file access. The tunnel component, which runs as root, no
    longer parses untrusted profiles with the OpenVPN engine.
  • The tunnel component only talks to LockPlus builds at least as new as itself.
  • The end of a pause, the end of an update and the Auto-Connect setting are sealed with a key in your keychain and used
    once, so another program can't use them to start a profile.
  • Zip import limits are now 1 MB per profile and 64 MB unpacked.
  • The "Import QR Code Image…" items are gone; QR import never worked.

Plus many fixes around restarts of kill-switch sessions, Save Only while connected, and the 2.0.1 display issues (a
refused start right after launch now says why; a second, waiting configuration is noted when it starts). The full list is
in the CHANGELOG.

How this release was checked. Since 2.0.1, every security-relevant change is reviewed by two independent AI review
engines from different model families (Anthropic's Fable and OpenAI's Codex), round after round until neither reports a
high-severity issue. For 2.0.2 that took seven rounds; where a fix kept producing new findings, it was removed and the
smaller remaining limit documented instead. End-to-end runs on macOS 26 and 27 virtual machines checked it on the real
system; the first release candidate's run found two bugs the reviews couldn't see (the profile checker crashed in the
signed build, and a paused profile didn't reconnect without the app), both fixed and re-reviewed before this release. The reports and every known limit are public in
docs/reviews/ and
DESIGN.md §20. As always: an AI review is not a
human audit.

Known issue (also in 2.0.1). After LockPlus quit unexpectedly, Edit Config… may open no editor until the next normal
start. Quit LockPlus with ⌘Q and open it again. The fix is planned for 2.1.

Downloads

File SHA-256
LockPlus.dmg f5fba87d4f9255ec6dc685c455b1b74b7a2213351a5b3bea2fa2555a56cc9b02
LockPlus-2.0.2.zip 9714162dd761e3eb2fc41409631fcd3e2f93357a82b9baf1b306f7a6b14c8c90
0001-LockPlus-ClientOptions-can-leave-openvpn3-s-process-.patch bab08174b1b711219e0c79933a38911734997bfd6d202386f2fc390b3858e4c2

macOS 26 or later, Apple silicon. LockPlus 2.0.x users get this update in the app; Homebrew users too
(auto_updates). The OpenVPN 3 patch is unchanged since 2.0.0.

Assets 6
Loading