Wombat 1.2.0

Wombat 1.2.0: Cisco AnyConnect, and QR codes

• Cisco AnyConnect: connect to your work or campus VPN (Cisco ASA, Firepower, or ocserv) in the same app as your WireGuard tunnels. Sign in with a password, Duo, single sign-on (Okta, Entra ID and other SAML providers) in your default browser or inside Wombat, or a client certificate from your keychain. The sign-in appears right on the VPN's screen, with no pop-up windows. Built on OpenConnect, running in its own system extension that never holds a WireGuard key. Your first AnyConnect VPN asks you to allow "Wombat OpenConnect" once, with step-by-step instructions and a picture of the switch to turn on.
• QR codes: import a tunnel by scanning its QR code with the camera, or from a screenshot or picture of one (File › Scan QR Code…, drag and drop, or paste).
• Security: fixes from an independent security review. wombat down now asks before dropping kill-switch protection. Full-tunnel checks look at internet IPv6. macOS's shared VPN settings no longer name your server. On shared Macs, tunnels started at the login window stop when another user signs in.
• On-demand now says when another VPN has taken over ("On demand paused"), in the app and in wombat status.
• The command line explains when it is waiting for you, and completions cover more commands.

Install

Download Wombat-1.2.0.dmg below, open it, and drag Wombat to Applications (network extensions only
run from there). On first launch, allow the extension in System Settings › General › Login Items
& Extensions; the first Cisco AnyConnect VPN asks once more, for "Wombat OpenConnect". It is
signed with a Developer ID, notarized by Apple, and updates itself.

AnyConnect support links OpenConnect (LGPL-2.1) statically; how to rebuild and relink it from
source is in Vendor/openconnect/WOMBAT.md.

Verify

spctl --assess --type open --context context:primary-signature -vv Wombat-1.2.0.dmg
shasum -a 256 Wombat-1.2.0.dmg
# 3530f0ddfa0b43e833b21d271e11585361bda28300a33335c0114886a6f8c1c7