Skip to content

Wombat 1.3.0

Latest
Latest

Choose a tag to compare

View all tags
@ventz ventz released this 19 Oct 20:50
v1.3.0
fcb00d6

Wombat's GitHub repository is now ventz/wombat-vpn (renamed from ventz/wombat-wireguard-mac-app; old links redirect).

Wombat 1.3.0: tab completion, and security fixes

  • Tab completion for zsh (oh-my-zsh too), bash and fish: commands, flags, files and your tunnel names. Run wombat completion install once: it finds the shells you use and puts the completion where each one already looks. With oh-my-zsh, or a folder zsh already reads, it doesn't touch ~/.zshrc; otherwise it shows the one line it would add and asks first. --dry-run shows everything without changing anything, and wombat completion uninstall removes it.
  • Tunnel names complete even when Wombat isn't running, and show whether each tunnel is connected. wombat up offers the tunnels that aren't connected, and wombat down the ones that are.
  • Security: fixes from a second independent security review. A VPN with a pinned server certificate always signs in inside Wombat, where the pin is checked. Files sent by other apps are labeled as such in the import review, which also shows a pinned certificate's fingerprint. Importing from the clipboard clears it afterwards. Full-tunnel checks cover IPv6 the same way for AnyConnect and WireGuard. Touch ID requests from the command line time out, and repeated requests you decline are held off longer. An older copy of Wombat can't put back its older network extension, and the command line won't drive an older app.
  • New tunnels are saved switched off in macOS's VPN settings until you first connect them, so adding one never turns off another VPN app's configuration. wombat up asks first when connecting might do that.
  • Homebrew: the cask now links the completion files too. If you installed with Homebrew before, run brew reinstall --cask ventz/tap/wombat-wireguard once to get them (or just run wombat completion install).

Install

Download Wombat-1.3.0.dmg below, open it, and drag Wombat to Applications (network extensions only
run from there). On first launch, allow the extension in System Settings › General › Login Items
& Extensions; the first Cisco AnyConnect VPN asks once more, for "Wombat OpenConnect". It is
signed with a Developer ID, notarized by Apple, and updates itself.

AnyConnect support links OpenConnect (LGPL-2.1) statically; how to rebuild and relink it from
source is in Vendor/openconnect/WOMBAT.md.

Verify

spctl --assess --type open --context context:primary-signature -vv Wombat-1.3.0.dmg
shasum -a 256 Wombat-1.3.0.dmg
# de5f2593dd5d88aba1dad1047a99e68f8cc14d706314a96c337c0fb0b0e928e1
Assets 3
Loading