New Moon 52.6.2

New Moon 52.6.2 — arm64-v8a release build of main @ a6be690 (includes afd0473, the aboutAddons.js SIGNEDSTATE_* guard).

⚠️ Known issue — NOT fixed in this release

White LayerView / blank pages. The live page SurfaceView stays white on all pages (including about:addons) even though Gecko composites real pixels — this is a compositor→SurfaceView/BLAST handoff bug in the targetSdk-24-era code on modern Android. Commit afd0473 fixes only a JS guard; it does not fix rendering. Full diagnosis: docs/ABOUT-ADDONS-BLANK.md.

Assets

• newmoon-android-arm64.apk — the browser. org.palemoon.community, versionName 52.6.2, arm64-v8a, minSdk 15, targetSdk 24.
  SHA-256: 27887cc8a6539a26f181319e44b96e5338f21b48703dc1f8a18a153be600e67c
• newmoon-crash-helper.apk — standalone crash-report companion. org.palemoon.crashhelper 1.0, minSdk 21.
  SHA-256: edf992e4151e2dd2f066286238e7c251180a0786dc728092d914feadd1c5c4ef

Verification (performed on the published artifacts)

• zipalign -c -P 16: PASS on both APKs — uncompressed .so entries aligned for 16 KB page-size devices; ELF LOAD alignment 0x4000 on lib/arm64-v8a/*.so.
• Signature: v1 + v2 + v3 schemes, newmoon community key (keystore/community.jks).
• aapt dump badging: package org.palemoon.community 52.6.2, native-code: arm64-v8a.

Changes since 52.6.1

• afd0473 — diagnose blank about:addons (presentation-layer, not UI); Fenix feasibility doc; guard SIGNEDSTATE_MISSING.
• a6be690 — version bump to 52.6.2.

Retro/hobby-class browser on an ESR-52-era engine — do not treat it as a secure daily driver.

New Moon 52.6.1 for Android (arm64)

Community build of New Moon — the UXP/Goanna (Pale Moon platform) browser for Android with the Fennec-derived frontend. Built from main @ 200c9e2, which includes efa19c2 — the mozjemalloc foreign-pointer free fix (patches/0006-jemalloc-foreign-pointer-free.patch) for the Pixel 10 / Android 17 16 KB-page launch crash.

Assets

• newmoon-android-arm64.apk — the browser (org.palemoon.community 52.6.1). arm64-v8a only, minSdk 15, targetSdk 24 — installable on Android 14–17, incl. Pixel 10 on a 16 KB kernel.
• newmoon-crash-helper.apk — standalone crash-report companion (org.palemoon.crashhelper 1.0). Reads Download/NewMoon/ via a one-tap folder grant, flags stale session markers, lists reports with Copy/Share. No native code (dex-only).

SHA-256

e1db1de7ed3b4d3e7592c33e5fff0487e5635d1b0aba9a5eb2cf0037d54c6d19  newmoon-android-arm64.apk
110756ad87c4cfca035b44145b16b3c3071ddf48697c30724cd0227c1ff61cc7  newmoon-crash-helper.apk

Verification (run on the published artifacts)

• aapt dump badging: native-code: 'arm64-v8a' (only ABI; no lib/<other-abi> entries in the zip).
• ELF LOAD-segment alignment of system-loaded libs (lib/arm64-v8a/libmozglue.so, libplugin-container.so): 0x4000 (16 KB) via -Wl,-z,max-page-size=16384. (assets/arm64-v8a/*.so are szip-packed for mozglue's custom linker — not raw ELF.)
• zipalign -c -P 16 -v 4 (build-tools 36.1.0): Verification successful on both APKs — uncompressed .so entries at 16 KB boundaries.
• apksigner verify: v1 + v2 + v3 signature schemes pass; signed with the committed community key (keystore/community.jks, password newmoon-community) — update-continuity only, not a security credential.
• mozglue PageSize() returns getpagesize() at runtime (patches/0005), so BSS mprotect works on 16 KB kernels; mozjemalloc forwards foreign (Bionic/Scudo) pointers to the Bionic allocator (patches/0006).

Not a secure daily driver — ESR-52-era engine, retro/hobby class. Reproduce: .github/workflows/build-apk.yml or the README commands.

New Moon 52.6.0 for Android (arm64)

Community build of New Moon — the UXP/Goanna (Pale Moon platform) browser for Android with the Fennec-derived frontend.

APK: newmoon-android-arm64.apk — arm64-v8a only, minSdk 15, targetSdk 24 (installable on Android 14–17, incl. Pixel 10).

• ELF LOAD segments of system-loaded libs are 16 KB page-aligned (-Wl,-z,max-page-size=16384, verified 0x4000); APK is zipalign -P 16'd.
• Signed with the committed community key (keystore/community.jks, password newmoon-community) — update-continuity only, not a security credential.
• Verified: builds end-to-end, installs, launches, full XUL/XBL pipeline runs, real HTTP/HTTPS page loads complete. See docs/STATUS.md for the honest verification list.

Not a secure daily driver — ESR-52-era engine, retro/hobby class.

SHA-256 of the initial locally-built+verified asset: ba0fe05e1c8023a9b2e42fb10ffcfa5bc12f1d5005f6b6c5b7bdd32334f338ec (the CI build from the identical pinned inputs replaces it under the same asset name when the tag workflow finishes).

Reproduce: .github/workflows/build-apk.yml or the commands in the README.