AppManagerNG v0.5.0

Full Changelog: v0.4.2...v0.5.0

AppManagerNG v0.4.2 — Premium Polish

AppManagerNG v0.4.2 — Premium Polish

Premium polish release focused on trust, clarity, and feedback.

Highlights

• Refined first-run security handoff, warning tone, and shape consistency.
• Added contextual notification permission asks for wireless pairing, batch operations, and installer progress.
• Improved progress/completion visibility for long-running workflows.
• Includes recent security hardening and UX refinements from the post-v0.4.1 polish series.

Artifact

• AppManagerNG-v0.4.2.apk
• SHA-256: 30A5598D5DF3B7EC118D6940B9AD268F345B3FDA88F6B1887EB909F79D4761D9

AppManagerNG v0.4.1 — Maintenance Drain

Maintenance release. Concentrates 19 closed Now/Eng-Debt rows from the iter-19/iter-20 ROADMAP drains plus one CONFIRMED audit finding flagged for design (GCM cipher reuse — multi-file AES backups still unsafe).

Install

AppManagerNG-0.4.1-universal.apk — universal APK (all ABIs), signed with the AppManagerNG release certificate.

Signing certificate SHA-256: 21:5F:B4:70:63:2E:A6:CD:59:A4:BA:AB:35:0A:9E:0B:99:AD:11:0F:DD:FA:F5:A9:EA:64:61:E5:D0:C2:38:6C

To verify:

apksigner verify --print-certs AppManagerNG-0.4.1-universal.apk

What's new

Features

• Sui (Magisk-module Shizuku) detection in onboarding — surfaced as a "+ Sui" suffix on the Root status line (e.g. "Detected · KernelSU + Sui + ZygiskNext")
• AppOps row-tap 3-state cycle — ALLOWED → IGNORED → ERRORED, matching the Inure model. IGNORE silently no-ops the op without throwing SecurityException, the right move for apps that crash on hard DENY
• Cert fingerprint dialog now shows X.509 Subject + Issuer distinguished names alongside the SHA-256
• Per-OEM debloat risk ribbon — Samsung One UI 8.5 SmartSuggestions warning (UAD-NG #1394 verified field report)
• Backup-name dialog autocompletes from prior backup names (TextInputDropdownDialogBuilder with insertion-stable LinkedHashSet)
• Ops.isAdbShellRoot() detection helper — KernelSU v3.2.3+ ADB Root pathway, also covers APatch / Magisk-kang
• LocalServer bootstrap-failure signature — one-line Log.e capturing Build.MANUFACTURER/PRODUCT/DEVICE, SDK_INT, ro.lineage.version, exception class + cause chain. Targets the LineageOS 23.2 / Android 16 root-binder regression

Fixes

• A16 QPR2 silent clearApplicationUserData failure — PackageManagerCompat.clearApplicationUserData now snapshots IStorageStatsManager pre/post-clear and falls back to pm clear --user N <pkg> shell when the IPC silently lies (the QPR2 Poco F3 / Infinity-X 3.9 / Root-mode bug)

Compliance

• BouncyCastle 1.83 → 1.84 (CVE-2026-3505 / 5588 / 5598)
• Gson 2.13.2 → 2.14.0 (built-in java.time adapters, strict duplicate-JSON-key handling)
• Android 17 static-final reflection audit — 1 fix in TypefaceUtil, 1 deferred to targetSdk=37 bump
• Google Play Contacts/Location-Button policy audit (clean — NG declares neither permission)
• Android 17 System.load() read-only native audit (clean)
• libsu 6.0.0 Shell.cmd migration audit (clean)
• Zip-slip protection audit across extraction paths (clean — TarUtils and AndroidBackupExtractor both carry the canonical double-check guard)

Security advisory

• CVE-2026-0073 — May 2026 Android Security Bulletin patched a Critical zero-click proximal RCE in adbd. AppManagerNG itself is not vulnerable; ADB-mode and Shizuku-via-wireless-debug talk to the same daemon, so devices below patch level 2026-05-01 carry residual risk. See docs/security-advisories/2026-05-08-cve-2026-0073-adb-mode.md

Documentation

• Sideloading verification position document — what the BR/ID/SG/TH Android Developer Verifier does and doesn't do for AppManagerNG users
• GrapheneOS A16 background-install fix patch reference — captures the isResumed + getCallingPackage() audit pattern for future port
• AOSP source-pull pinned to android-latest-release for hiddenapi/ stub harvesting

⚠️ Known issue: GCM cipher reuse on multi-file AES backups

AESCrypto.handleFiles() instantiates a single GCMBlockCipher once before the per-file loop and reuses it across every file with the same mIv. After file 0's doFinal(), the cipher is in finalized state and reused for file 1, with behavior that's either fail-fast or silent nonce-reuse depending on BouncyCastle's internals. Matches upstream AM #1958.

Multi-file AES-encrypted backups produced by v0.4.0 and v0.4.1 cannot be trusted to restore. OpenPGP / RSA / ECC backup modes are unaffected; single-file AES backups are unaffected.

Remediation requires a backup format version bump because the master-IV-only on-disk format can't represent per-file IVs. Three options laid out in docs/audits/2026-05-08-gcm-cipher-reuse-large-backup.md. The next release will pick a fix path and ship it behind a backup metadata version flag with a synthetic 4 GB blob round-trip regression test.

Full changelog: CHANGELOG.md (v0.4.1 section).