-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi folks,
By popular demand, on <https://www.wireguard.com/install/>, there's now a (somewhat small) link in the Android section called "Download APK File", for those who want to sideload the package or bundle it in an OS image or whatever else. The recommended method of installation is still of course the Play Store, because its updater is known to work very well across devices. But now there's a decent alternative method. The new direct APK download and the Play Store are the *only* two supported installation sources. Alternative builds and alternative app stores aren't supported (unless they're shipping the direct APK file that the WireGuard project provides). You can verify those direct APK files using OpenBSD's signify(1): $ cat wireguard-android-release.pub untrusted comment: wireguard android release key public key RWTAzwGRYr3EC9px0Ia3fbttz8WcVN6wrOwWp2delz4el6SI8XmkKSMp $ curl -O https://download.wireguard.com/android-client/latest.sig $ signify -V -p wireguard-android-release.pub -e -x latest.sig -m latest Signature Verified $ read _ file < <(sort -k2 -Vr latest) $ curl -O https://download.wireguard.com/android-client/"$file" $ sha256sum -c latest --ignore-missing com.wireguard.android-1.0.20230512.apk: OK This is the same Ed25519-based signature mechanism that is used by the WireGuard Windows client. The private key lives in an HSM [1]. Jason [1] https://marc.info/?l=openbsd-misc&m=155723329924761&w=2 -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEq5lC5tSkz8NBJiCnSfxwEqXeA64FAmRiJ/QACgkQSfxwEqXe A669fg/9GnopO43uXGIB6T1IZbY1WkIDZt7pMdq52rypqMq9PwG4HK+kQbGJWJYC IBW9v3ae3uhVhX84Qnke7RJ3aYVMltfyp0BoTzsIsyk4v4U8KguGchdI5Mn59sj/ 2HSUVMQ9+5n7SCQqsJp9CW0GSBoME2AU1zzjEyzwr1SM7zq/5CCLEBvMsImhP0rw n1Vzb0o24CUNyiNbNy4op4eEAuLs8lpfj95qs0kpaLM2vH13LBeO0sKHdKUQe9dd iOJRXBrx8FAy/kwweycFww6KhGtO1fKzWwLyAwEhKvvcBC+kBhFfEU/mO6iIuao+ YQ8VDw4uSaHrP3RFBFxVUlcMhI/ytShwnW2CIuKd1/tpCk9Pdq5tg+QQB5FqVv0A evAhjuI0ggzmsEpnh9ldYDWCDViKBz7TdBYgsQ+lW4lwQLNIAn3jzqHTSLNtJPY2 Obw9E5PvZK/kw+cHbZJP4mRXpSl2sLL6HocDPUwRWNwEFAVawHlPNSkaNhiiWpmg HO0m7FMh7NP7R/IVA+7ULaUFL3X+R9d66znn2uoGwU783FQFlfKb4X5CCsP8h3+A YoJJ5v7328LHc6tajprvPSEH5Lt0ok+4cKxq/wAQb4AI2SUIFW77MRmM44q2TYrd mr0v2FmZxOlTdENn5lMyj2580k9E41zuH85/Pz0VxmgdbUuGqKM= =ACE8 -----END PGP SIGNATURE-----