Skip to content

Komms 0.4.2 Beta — UNSIGNED TEST RELEASE

Pre-release
Pre-release

Choose a tag to compare

View all tags
@AndriGitDev AndriGitDev released this 04 Aug 18:58
v0.4.2
5a09190
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Komms 0.4.2 Beta — unsigned test release

Warning

This is an explicitly unsigned, pre-production test release. It bypasses
Komms production-signing and publication gates for version 0.4.2 only. Do
not use it for emergency, safety-critical, or production communication.

This prerelease is published for early hands-on testing while Komms moves
toward its production signing and stable-release process. The packages are
bound to tag v0.4.2 and commit
5a09190cfef9cfef92703672517bc008b6e8cc1f. The complete hosted validation
workflow passed, but the included evidence correctly reports:

  • production_signed: false;
  • qualified_for_stable: false; and
  • independently_reproduced: false.

Choosing a package

  • Android: use
    Komms-0.4.2-android-google-free-test-signed.apk for device testing. It is
    signed with an Android debug certificate, not a production release key.
    Its certificate SHA-256 is
    ec07a2d6a873d4b921c03c63a4c38888db582ee8b9e00517c124b4e395083cb7.
    Uninstall it before installing any future production-signed Komms build;
    an authenticated upgrade from this test certificate is not promised.
  • macOS: the universal DMG is unsigned and not notarized. Gatekeeper
    warnings are expected.
  • Windows: the MSI and setup executable are unsigned. SmartScreen
    warnings are expected.
  • Linux: the AppImage, Debian package, and RPM are unsigned. Verify their
    SHA-256 values before use.
  • iOS: the ZIP is an unsigned Simulator application only. It cannot be
    installed on a physical iPhone.

The Android files whose names contain release-unsigned, and the Play AAB,
are validation artifacts rather than ordinary install packages. The
test-signed Google-free APK has the same normalized unsigned payload as the
hosted Google-free validation APK; only its test signature differs.

Verify downloads with UNSIGNED-TEST-SHA256SUMS. The original hosted files
are also covered by VALIDATION-SHA256SUMS and the attached validation
evidence archive. That archive is validation evidence, not an offline release
signature or a production assurance claim.

What changed

  • linked devices use revocable strict-majority device authority and visible
    conflict handling;
  • sender-key groups authenticate each recipient-scoped origin;
  • unknown senders and group invitations use bounded Message Requests;
  • Connect codes replace identity-indexed discovery;
  • durable mailbox v2 uses committed deposits and idempotent leases;
  • pairwise rendezvous, native wake, and operating modes use least-authority,
    replaceable-provider contracts;
  • the stable-v1 protocol fixtures, conformance runner, localization,
    accessibility checks, release evidence controls, and operator runbooks are
    included; and
  • desktop offline-authority export now uses the native Save dialog with safe
    retry behavior.

Known limits

This Beta does not claim an independent security audit, independent
interoperability, production operator qualification, complete physical-device
or radio qualification, universal background delivery, anonymity, remote
erasure, or stable support. No qualified default operator currently ships.
Optional service acknowledgements do not advance message delivery state.

Clean profile setup, S23 Ultra to macOS pairing, message-request consent,
private trust comparison, and bidirectional delivered messaging were exercised
on the same source tree. That useful test does not convert the attached
unsigned packages into production-qualified artifacts.

Assets 16
Loading