Wombat 1.2.1

Wombat 1.2.1

• Clearer wording when you quit Wombat: your VPNs run in macOS, not in the app, so they keep working, and so do automatic connections and the kill switch. Quitting only removes the menu bar icon.

Install

Download Wombat-1.2.1.dmg below, open it, and drag Wombat to Applications (network extensions only
run from there). On first launch, allow the extension in System Settings › General › Login Items
& Extensions; the first Cisco AnyConnect VPN asks once more, for "Wombat OpenConnect". It is
signed with a Developer ID, notarized by Apple, and updates itself.

AnyConnect support links OpenConnect (LGPL-2.1) statically; how to rebuild and relink it from
source is in Vendor/openconnect/WOMBAT.md.

Verify

spctl --assess --type open --context context:primary-signature -vv Wombat-1.2.1.dmg
shasum -a 256 Wombat-1.2.1.dmg
# 2cb8fa844818edbd3595dd082cab9fe38ecbf812790fa53e36708424ff1f404c

Wombat 1.2.0

Wombat 1.2.0: Cisco AnyConnect, and QR codes

• Cisco AnyConnect: connect to your work or campus VPN (Cisco ASA, Firepower, or ocserv) in the same app as your WireGuard tunnels. Sign in with a password, Duo, single sign-on (Okta, Entra ID and other SAML providers) in your default browser or inside Wombat, or a client certificate from your keychain. The sign-in appears right on the VPN's screen, with no pop-up windows. Built on OpenConnect, running in its own system extension that never holds a WireGuard key. Your first AnyConnect VPN asks you to allow "Wombat OpenConnect" once, with step-by-step instructions and a picture of the switch to turn on.
• QR codes: import a tunnel by scanning its QR code with the camera, or from a screenshot or picture of one (File › Scan QR Code…, drag and drop, or paste).
• Security: fixes from an independent security review. wombat down now asks before dropping kill-switch protection. Full-tunnel checks look at internet IPv6. macOS's shared VPN settings no longer name your server. On shared Macs, tunnels started at the login window stop when another user signs in.
• On-demand now says when another VPN has taken over ("On demand paused"), in the app and in wombat status.
• The command line explains when it is waiting for you, and completions cover more commands.

Install

Download Wombat-1.2.0.dmg below, open it, and drag Wombat to Applications (network extensions only
run from there). On first launch, allow the extension in System Settings › General › Login Items
& Extensions; the first Cisco AnyConnect VPN asks once more, for "Wombat OpenConnect". It is
signed with a Developer ID, notarized by Apple, and updates itself.

AnyConnect support links OpenConnect (LGPL-2.1) statically; how to rebuild and relink it from
source is in Vendor/openconnect/WOMBAT.md.

Verify

spctl --assess --type open --context context:primary-signature -vv Wombat-1.2.0.dmg
shasum -a 256 Wombat-1.2.0.dmg
# 3530f0ddfa0b43e833b21d271e11585361bda28300a33335c0114886a6f8c1c7

Wombat 1.1.1

Wombat 1.1.1

• Install with Homebrew: brew install --cask ventz/tap/wombat-wireguard installs Wombat and puts the wombat command on your PATH, no sudo needed.
• Settings › Command Line now shows whether the wombat command is installed, and updates as soon as it is.
• Fixed the command-line install command on Macs without a /usr/local/bin folder (new Apple silicon Macs without Homebrew): it now creates the folder first.
• The Copy button confirms the copy, and an Open Terminal button sits next to it.

Install

Download Wombat-1.1.1.dmg below, open it, and drag Wombat to Applications (network extensions only
run from there). On first launch, allow the extension in System Settings › General › Login Items
& Extensions. It is signed with a Developer ID, notarized by Apple, and updates itself.

Verify

spctl --assess --type open --context context:primary-signature -vv Wombat-1.1.1.dmg
shasum -a 256 Wombat-1.1.1.dmg
# 66ace5fc3bfd3d9a8d5a38af7b72ec72ba9aa04ca52a693d98d3063143dd242c

Wombat 1.1.0

Wombat 1.1.0

• AmneziaWG support. Import and connect AmneziaWG 1.0 to 2.0 configs (Jc/Jmin/Jmax, S1–S4, H1–H4, I1–I5), for networks that block plain WireGuard. Plain WireGuard tunnels are unchanged and keep running on the standard engine.
• Configs are checked before import, and the review warns about settings that can make a server easy to abuse or fingerprint.
• Fixed a crash that a malicious server could trigger with a malformed IPv6 packet, taking down every tunnel.
• The engine is updated to the latest wireguard-go, including a handshake race fix.
• An approval asked for by the wombat command now closes itself after two minutes, as intended, instead of blocking the app.

Install

Download Wombat-1.1.0.dmg below, open it, and drag Wombat to Applications (network extensions only
run from there). On first launch, allow the extension in System Settings › General › Login Items
& Extensions. It is signed with a Developer ID, notarized by Apple, and updates itself.

Verify

spctl --assess --type open --context context:primary-signature -vv Wombat-1.1.0.dmg
shasum -a 256 Wombat-1.1.0.dmg
# 8062bbbb361a39697fd8e6923e82d1dfde360e0a67af217905d8cbf1c81bc68a

Wombat 1.0.0

Install

Download Wombat-1.0.0.dmg below, open it, and drag Wombat to Applications (network extensions only
run from there). On first launch, allow the extension in System Settings › General › Login Items
& Extensions. It is signed with a Developer ID, notarized by Apple, and updates itself.

Verify

spctl --assess --type open --context context:primary-signature -vv Wombat-1.0.0.dmg
shasum -a 256 Wombat-1.0.0.dmg
# 672532000e321673e3f67568f63eb11699811205ff45557cbae035c148874216