v1.1.8

Highlights

First-run onboarding. New installs now get a short first-run flow that introduces FROST key shares and lets you pick a signing policy (Manual, Basic, or Auto) during setup, so the threshold-signing model and per-request approval behavior are clear before the first signature.

F-Droid listing. The store listing now carries app screenshots and per-release changelogs. F-Droid reads this metadata from the release tag, so v1.1.8 is the first build whose screenshots and "What's New" populate the F-Droid page.

No cryptographic or signing changes since v1.1.7 (keep.version is unchanged). Both per-ABI APKs continue to reproduce bit-for-bit from source.

What's Changed

• onboarding: add first-run FROST/share guidance and sign-policy choice (#295) by @wksantiago in #395
• fastlane: add missing per-ABI changelogs for v1.1.6 and v1.1.7 by @kwsantiago in #404
• fastlane: add phone screenshots for F-Droid listing (#405) by @wksantiago in #406
• Release v1.1.8 by @kwsantiago in #407

Full Changelog: v1.1.7...v1.1.8

v1.1.7

Highlights

Reproducible builds restored. In v1.1.6 the native library libkeep_mobile.so compiled non-deterministically, so an independent rebuild of the same source no longer matched the published APK and the reproducibility check failed. v1.1.7 fixes this: the uniffi CLI/bindgen code (whose template codegen is non-deterministic) is no longer linked into the runtime library, only into the build-time uniffi-bindgen tool.

Both per-ABI APKs now reproduce bit-for-bit from source, verified in CI:

Container build reproduces the published v1.1.7 arm64-v8a APK (payload identical).
Container build reproduces the published v1.1.7 x86_64 APK (payload identical).

Use v1.1.7 (not v1.1.6) for reproducible distribution and F-Droid.

Verifying

sha256sum keep-android-v1.1.7-arm64-v8a.apk keep-android-v1.1.7-x86_64.apk
# compare against SHA256SUMS, or rebuild with Dockerfile.reproducible and
# compare payloads with apksigcopier (see REPRODUCIBLE_BUILDS.md).

What's Changed

• Build(deps): bump the all group across 1 directory with 3 updates by @dependabot[bot] in #400
• Build(deps): bump androidx.compose:compose-bom from 2026.06.00 to 2026.06.01 in the minor-and-patch group across 1 directory by @dependabot[bot] in #399
• release: pin keep reproducibility fix and bump to 1.1.7 by @kwsantiago in #402

Depends on the keep fix in privkeyio/keep#702 (uniffi cli feature gated to the bindgen binary).

Full Changelog: v1.1.6...v1.1.7

v1.1.6

Highlights

• Pins Keep to v0.5.0: bundles the keep v0.5.0 core (see the keep v0.5.0 release).
• Security hardening (via keep-mobile): closes a set_active_share check-then-set (TOCTOU) race; the NIP-98 HTTP-auth approval prompt now surfaces the URL and method being authorized; RNG health-check failures fail closed (return an error) instead of panicking; and cryptographic dependencies are advanced past recent RUSTSEC advisories.
• Test coverage: adds an instrumented test for the NIP-55 approval-flow kill switch.

Note: the CLI/desktop-facing v0.5.0 features (threshold-OPRF unlock, software DKG, HD FROST wallets) are not yet surfaced in the Android app; this release delivers the underlying core security fixes to app users.

Install

Download keep-android-v1.1.6-arm64-v8a.apk (most phones) or keep-android-v1.1.6-x86_64.apk from the Assets section below. Min SDK 33 (Android 13+).

Verify

sha256sum -c SHA256SUMS

Full changelog

v1.1.5...v1.1.6

v1.1.5

What's Changed

• Add Compose UI flow tests for approval, unlock, and launch by @kwsantiago in #352
• nip55: test batch accumulation + approval double-submit guard (#326 items 1 & 4) by @wksantiago in #342
• nip55: return rejection result for null-handler batch reject (not RESULT_CANCELED) by @wksantiago in #340
• nip46: run global rate-limit check after denylist/authorization gate by @wksantiago in #339
• nip55: anchor audit chain to resist tamper by @wksantiago in #338
• nip46/nip55: fix bunker copy, approval-callback crash, signing-history crash, back nav, and local 1-of-1 signing by @wksantiago in #358
• Build(deps): bump the all group with 3 updates by @dependabot[bot] in #356
• Build(deps): bump net.java.dev.jna:jna from 5.19.0 to 5.19.1 in the minor-and-patch group by @dependabot[bot] in #357
• chore: bump keep to be59ae7 for NIP-98 opt-in timed-remember by @kwsantiago in #360
• nip55: drop internal error="rejected" magic string by @wksantiago in #361
• Build(deps): bump the all group with 4 updates by @dependabot[bot] in #363
• Build(deps): bump the minor-and-patch group with 3 updates by @dependabot[bot] in #362
• nip55: add round-trip test for AndroidSigningRateLimiterStorage by @wksantiago in #364
• nip55: add round-trip + tamper test for audit-chain FFI seam by @wksantiago in #365
• nip55: re-pin keep to drop orphaned SigningAuditLog.verifyChain by @wksantiago in #366
• nip55: extract consent guards into pure helpers with test coverage (#354) by @wksantiago in #367
• nip55: add handler-level sign_event verify-signature instrumented test by @wksantiago in #368
• nip55: add serializeBatchResults round-trip instrumented test (#323) by @wksantiago in #371
• nip55: re-pin keep to invalidate live node on share import (#379) by @wksantiago in #380
• Build(deps): bump the all group with 3 updates by @dependabot[bot] in #370
• Build(deps): bump gradle-wrapper from 9.6.0 to 9.6.1 in the minor-and-patch group by @dependabot[bot] in #369
• Release v1.1.5: per-ABI APK splits (arm64-v8a, x86_64) by @kwsantiago in #382

Full Changelog: v1.1.4...v1.1.5

v1.1.4

What's Changed

• Release v1.1.4: align reproducible build to F-Droid environment (trixie + JDK 21) by @kwsantiago in #351

Full Changelog: v1.1.3...v1.1.4

v1.1.3

What's Changed

• F-Droid metadata: target reproducible release v1.1.2 by @kwsantiago in #349
• release: keep-android v1.1.3 (F-Droid build compatibility) by @kwsantiago in #350

Full Changelog: v1.1.2...v1.1.3

v1.1.2

What's Changed

• Reproducibility CI fix + F-Droid metadata to v1.1.1 by @kwsantiago in #346
• Release: sign during the container build (fix re-sign breaking F-Droid reproducibility) by @kwsantiago in #347
• release: keep-android v1.1.2 (fix reproducible release signing) by @kwsantiago in #348

Full Changelog: v1.1.1...v1.1.2

v1.1.1

What's Changed

• Build releases in the pinned container so they reproduce on F-Droid by @kwsantiago in #344
• release: keep-android v1.1.1 (reproducible container build) by @kwsantiago in #345

Full Changelog: v1.1.0...v1.1.1

v1.1.0

Highlights

• Pins keep to v0.4.9: signer permission policy, audit chain, rate limiting, and caller verification now run inside the audited Rust core. Full keep v0.4.9 notes: https://github.com/privkeyio/keep/releases/tag/v0.4.9.
• Batch / multi-event signing (#325): approve many events in a single prompt.
• Upfront permission bundles (#331): pre-authorize a permission set when an app connects, via the get_public_key permissions array.
• Per-relay NIP-42 scoping (#337): kind 22242 relay-auth grants are scoped per relay, with a relay-auth allowlist.
• Spec-correct declined requests (#332): user rejection returns RESULT_OK with rejected instead of RESULT_CANCELED.
• NIP-46 remember-grants consolidated (#300, #302): single source of truth in the engine, no duplicate Android store.
• Reproducible-build groundwork and F-Droid metadata (#260): native libraries now build with the pinned NDK (r29), and fdroiddata metadata was added.

Install

Download keep-android-v1.1.0.apk from the Assets section below. Min SDK 33 (Android 13+).

Verify

sha256sum -c SHA256SUMS

Full changelog

v1.0.5...v1.1.0

v1.0.5

Highlights

• Pins keep to v0.4.8: ECDH and signing race fixes, persistent NIP-46 grants CLI, hidden-vault grant support, audit-log expansion. Full keep v0.4.8 notes: https://github.com/privkeyio/keep/releases/tag/v0.4.8.
• Bunker init race fix (#296): bunker handshake no longer drops the first event under load; pending approvals now trigger a notification.
• UI/UX overhaul (#293): design tokens, shared components, consistent screens across the app.
• Live activity log (#292) for relay, bunker, and peer events.
• Authorized Clients populated from bunker onConnect (#291) with foreground-service and crash fixes.
• onConnect callback wired up in the bunker FFI binding (#290).
• keep-mobile is now the single source of truth for the kill switch (#284).
• Share rename writes canonical metadata, not just prefs (#283).

Install

Download keep-android-v1.0.5.apk from the Assets section below. Min SDK 33 (Android 13+).

Verify

sha256sum -c SHA256SUMS

Full changelog

v1.0.4...v1.0.5