Repository navigation
Releases
Releases · AutomatedLabor/tote
v1.2.0-alpha1
v1.1.0-alpha1
v1.0.0-alpha1
v0.6.0-alpha1
v0.5.0-alpha1
v0.4.0-alpha1
v0.3.0-alpha1
v0.2.0-alpha1
v0.1.0-alpha1 — first signed APK
Tote v0.1.0-alpha1
First signed APK. Build-pipeline milestone, not a usable app yet.
What works
- Crypto module (lazysodium-backed): Ed25519 sign/verify, X25519 ECDH,
XChaCha20-Poly1305-IETF encrypt/decrypt with Ed25519 detached signatures,
HKDF-SHA256 (RFC 5869 verified), epoch ratchet Variant B with sender-
authenticated membership lists, CBOR serialization. - 67 JVM unit tests all pass.
- Android foundation: ToteApplication bootstraps lazysodium + ProfileRegistry
- memory observer. BrowserScreen uses WebViewPool for truly-live tabs
(ADR-014). DeviceTierHelper auto-sizes the pool based on ActivityManager.
- memory observer. BrowserScreen uses WebViewPool for truly-live tabs
- Signed with the release keystore.
- APK signature verified (apksigner, NOT keytool).
What does NOT work yet (alpha)
- Cookie extraction/import (Phase 5) — the SQLite + CookieManager snapshot
pipeline is not yet wired to the UI. - Pairing flow (Phase 7) — no QR generation/scanning, no SAS verification UI.
- Recovery + kill switch (Phase 8) — no UI.
- Relay client (Phase 6) — not yet integrated.
- Settings screen (Phase 19) — scaffold only.
- Onboarding (Phase 19) — not built.
Verification
APK SHA-256: 43c28483d6e585f5b89997c47210f1901f37f9f87ca65aeb226ceffddc1fa6c7
Cert SHA-256: df96cae5c963cef4b2adccd6ccf3a76113a0386e2376232f3dc758374acf4196
Verify with:
sha256sum -c app-release.apk.sha256 # → OK
apksigner verify --print-certs --verbose app-release.apk
# expect: V2 Signer: certificate SHA-256 digest: df96cae5...