Trikey v0.1.29-alpha

Fixes from the first tests with a Trezor on iPhone, a restore on Android and a guardian replaced after a reset. Nothing
changes in the guardian: update the app.

• Trezor on iPhone works (#279). After Trezor Suite Lite answered, the screen stopped responding to taps: the
  "Confirm on your device" sheet flashed while Trikey was still in the background, which left an invisible layer on iOS.
  The setup screen also no longer says a Trezor shows "Trikey": it never does; it shows the wallet's address to compare.
• Replace guardian (#277, #278). Replacing a guardian with the same box after a reset (a reset keeps its nostr
  address) no longer stops with "The guardian now guards another wallet": the move finishes, and a phone left waiting
  finishes it with "Go on with the move". The screen now says to have your hardware wallet ready, and a device that
  isn't found says what to do ("No Ledger found. Unlock it, enable Bluetooth on it…") instead of "did not respond".
• Recovery code (#280). Letters from other alphabets that look like the code's (what text recognition or a
  keyboard suggestion can put in: a Cyrillic З or М, a Ø) are read as the letters and digits they resemble, and a
  character that still doesn't fit names its group. Write the code by hand; never copy it from a screenshot.
• Removing a wallet (#281) always clears it from the phone, even if the phone's secure storage refuses to delete
  a key: before, a restore could then say "This phone already has a Trikey wallet" until the app's storage was cleared.

The Android APKs (the standard build and the one without Google code) and their .sha256 files are attached by
the Android test APK build; the guardian image is ghcr.io/theicaruswings/trikey-guardian:0.1.29-alpha, and the
attached trikey-guardian-compose.yml names it by digest. This release is published only once every file is
attached and checked (publish-release.yml). How to install and test: docs/alpha-test-plan.md.

Trikey alpha test build (Android)

Signed with the Trikey release key (certificate SHA-256 c6c46a1332725111413a7b0313e2f2f37b10f0ce4c8da1cac3c92d179a162da7, also in
packaging/android/release-cert.sha256). Every release from 0.1.7-alpha on has this signature, so it installs over
the previous one and the wallet on the phone stays. Builds up to 0.1.6-alpha had one-off keys: moving from one of
those needs a last uninstall, which deletes the wallet on that phone, so make a backup (recovery code and backup
file) first. To get updates without downloading by hand, see docs/android-signing.md (Obtainium).

Which APK? There are two builds of the same code, as two apps: each updates itself, and both can be on one
phone, each with its own wallet.

• trikey-alpha-v0.1.29-alpha.apk: the standard build, "Trikey" (app.trikey.wallet). It contains Google's
  libraries: QR codes are read with Google's ML Kit, and Google Drive backup can be switched on in a later release
  (it needs Google Play services on the phone).
• trikey-alpha-foss-v0.1.29-alpha.apk: no Google code, "Trikey FOSS" (app.trikey.wallet.foss), for phones without Google
  Play services (GrapheneOS, /e/OS, LineageOS) or if you prefer an app without it. QR codes are read with the
  open source zxing-cpp. It will never offer Google Drive backup: the backup is the recovery code plus the backup
  file, which you can still save to Google Drive or anywhere else from the share sheet. Settings, About says
  "Trikey (no Google)".

Today both do the same: Google Drive backup is not switched on in either yet. Not sure? Take the standard one.

Had the no-Google APK of 0.1.21-alpha or earlier? It had the standard app's id, so this FOSS APK cannot
update it: it installs as a second app, next to the old one, and starts empty. Your wallet is still in the old
app. Because it is a new app, Android has no installed app to compare its signature with, so check who signed
it before you restore your wallet into it: install AppVerifier (F-Droid or Accrescent), pick Trikey FOSS
(app.trikey.wallet.foss), and compare its SHA-256 with the release key's above and in
packaging/android/release-cert.sha256. If they differ, uninstall it and restore nothing. Then, in Trikey FOSS, tap
"I already have a Trikey wallet", then "My phone, but I have its backup", and open your backup file with your
recovery code. Uninstall the old app once the wallet shows in the new one. (Or install the standard APK over the
old app: it updates in place, keeps the wallet, and Android checks its signature, with Google's libraries.)

• Pre-alpha, open source, not audited. Test networks only (signet, testnet4). Never put real bitcoin in it.
• Install: download the APK on the phone, open it, and allow installing from this source when Android asks.
• Passkeys and Google Drive backup are not in these builds; the backup is a recovery code plus a backup file.
• Check for updates (Settings, About) offers the APK of the build you have installed.
• The SHA-256 of each APK below (and its .sha256 file) shows that a download is complete. It comes from this
  release, like the APK, so it does not show who made it: the signing certificate does.
• How to test it: docs/alpha-test-plan.md in the repository.

Standard: trikey-alpha-v0.1.29-alpha.apk

• SHA-256 e307ee0d0a65b7b2fa7795acde7bf42bb36faad69bd5d4d46b59403c51610d99
• 58.3 MB, built for arm64-v8a from commit ae6a507.

No Google: trikey-alpha-foss-v0.1.29-alpha.apk

• SHA-256 fa958bfd520f522019a87185111d630e54e753da2b8976b0be3f983f4b78e6e3
• 52.9 MB, built for arm64-v8a from commit ae6a507.
• Checked by the build: no Google Play services, Firebase, ML Kit or data transport code in it.

Trikey v0.1.28-alpha

Releases now come from the founder's own nostr key, and the Android APK can be rebuilt byte for byte. Nothing changes
in how the app or the guardian work.

• A new publisher (#260, #261). From this release, Trikey's releases and its Zapstore listings are signed by Icarus
  Wings, the founder (npub19tzp8lf3klmqj3dz9mz0qnuvjp7uyy9993gmljmyaxs8phztj7wsnujvq5, icaruswings@trikey.app),
  instead of the Trikey account. The Trikey account announced the change in a note it signed
  (packaging/VERIFY.md, "Check a release's signature"). On Zapstore, nothing to do: the listing stays the same, and
  this release may reach it a little later than GitHub while the move is settled with Zapstore.
• Reproducible Android builds (#231). Two builds of the same commit now give the same APK, and VERIFY.md explains how
  to rebuild a release and compare it. APKs up to 0.1.27-alpha carried the private network address of the build
  machine in an unused resource; they no longer do.
• Donations over Lightning (#259): icaruswings@getalby.com, next to the on-chain address on trikey.app.

The Android APKs (the standard build and the one without Google code) and their .sha256 files are attached by
the Android test APK build; the guardian image is ghcr.io/theicaruswings/trikey-guardian:0.1.28-alpha, and the
attached trikey-guardian-compose.yml names it by digest. This release is published only once every file is
attached and checked (publish-release.yml). How to install and test: docs/alpha-test-plan.md.

Trikey alpha test build (Android)

Signed with the Trikey release key (certificate SHA-256 c6c46a1332725111413a7b0313e2f2f37b10f0ce4c8da1cac3c92d179a162da7, also in
packaging/android/release-cert.sha256). Every release from 0.1.7-alpha on has this signature, so it installs over
the previous one and the wallet on the phone stays. Builds up to 0.1.6-alpha had one-off keys: moving from one of
those needs a last uninstall, which deletes the wallet on that phone, so make a backup (recovery code and backup
file) first. To get updates without downloading by hand, see docs/android-signing.md (Obtainium).

Which APK? There are two builds of the same code, as two apps: each updates itself, and both can be on one
phone, each with its own wallet.

• trikey-alpha-v0.1.28-alpha.apk: the standard build, "Trikey" (app.trikey.wallet). It contains Google's
  libraries: QR codes are read with Google's ML Kit, and Google Drive backup can be switched on in a later release
  (it needs Google Play services on the phone).
• trikey-alpha-foss-v0.1.28-alpha.apk: no Google code, "Trikey FOSS" (app.trikey.wallet.foss), for phones without Google
  Play services (GrapheneOS, /e/OS, LineageOS) or if you prefer an app without it. QR codes are read with the
  open source zxing-cpp. It will never offer Google Drive backup: the backup is the recovery code plus the backup
  file, which you can still save to Google Drive or anywhere else from the share sheet. Settings, About says
  "Trikey (no Google)".

Today both do the same: Google Drive backup is not switched on in either yet. Not sure? Take the standard one.

Had the no-Google APK of 0.1.21-alpha or earlier? It had the standard app's id, so this FOSS APK cannot
update it: it installs as a second app, next to the old one, and starts empty. Your wallet is still in the old
app. Because it is a new app, Android has no installed app to compare its signature with, so check who signed
it before you restore your wallet into it: install AppVerifier (F-Droid or Accrescent), pick Trikey FOSS
(app.trikey.wallet.foss), and compare its SHA-256 with the release key's above and in
packaging/android/release-cert.sha256. If they differ, uninstall it and restore nothing. Then, in Trikey FOSS, tap
"I already have a Trikey wallet", then "My phone, but I have its backup", and open your backup file with your
recovery code. Uninstall the old app once the wallet shows in the new one. (Or install the standard APK over the
old app: it updates in place, keeps the wallet, and Android checks its signature, with Google's libraries.)

• Pre-alpha, open source, not audited. Test networks only (signet, testnet4). Never put real bitcoin in it.
• Install: download the APK on the phone, open it, and allow installing from this source when Android asks.
• Passkeys and Google Drive backup are not in these builds; the backup is a recovery code plus a backup file.
• Check for updates (Settings, About) offers the APK of the build you have installed.
• The SHA-256 of each APK below (and its .sha256 file) shows that a download is complete. It comes from this
  release, like the APK, so it does not show who made it: the signing certificate does.
• How to test it: docs/alpha-test-plan.md in the repository.

Standard: trikey-alpha-v0.1.28-alpha.apk

• SHA-256 463cdd3c8da188f3f9cd406a80cbb1122baeb671be6d634d4571567b04a41e41
• 58.3 MB, built for arm64-v8a from commit 05e4c0a.

No Google: trikey-alpha-foss-v0.1.28-alpha.apk

• SHA-256 c36bba7b2c7d0e7961cb05c1a87558178c8f67e4905fe3c34607f42b1b158107
• 52.9 MB, built for arm64-v8a from commit 05e4c0a.
• Checked by the build: no Google Play services, Firebase, ML Kit or data transport code in it.

Trikey v0.1.27-alpha

The app gets motion throughout and a new Security tab, both screens get fixes from a design review, and releases are
signed with Trikey's key. Update the guardian, then the app.

• Motion that shows what's happening (#246, #247, #250). Sending shows the two signing steps and ends on a drawn
  check, with who signed and what's left of today's daily limit. Waiting for the hardware wallet, money arriving, a
  recovery's countdown, unlocking the guardian and pairing all move now, and the app opens with the Trikey keys landing
  on Home. Buttons never wait for an animation, warnings never move, and with Reduce Motion on nothing moves at all.
• A new Security tab (#249): your three keys drawn as the Trikey mark, green when all is well and amber with the
  one thing that needs you, then tiles for each key and each protection.
• Safer screens (#248). Approving on a hardware wallet now lists the amount and fee in the unit your device shows,
  next to the address. An unanswered recovery on Home is red, with a button to review it, above Send. Checking a receive
  address no longer says "Your device agrees" before you have compared. Review shows a silent payment's full address,
  "Send max" is now "Send everything", small buttons are larger, and the same things have the same names everywhere.
• The guardian's web page (#245): larger click targets, field borders and focus outlines you can see, plainer
  words, and the same title size and date format on every page.
• Signed releases (#234). Each release carries trikey-<tag>-SHA256SUMS, signed with Trikey's nostr key, and the
  pipeline won't publish without that signature. packaging/VERIFY.md shows how to check it.
• For developers: an optional security-key (YubiKey) lock for key 2 in the wallet core, off and not in the app yet
  (#236; design in docs/design/yubikey-key2.md, #227); dependency install scripts off in CI (#219); Start9 build tooling
  updated for two advisories (#225, #244). Docs: what the phone keeps where (docs/security/phone-storage.md, #237).

The Android APKs (the standard build and the one without Google code) and their .sha256 files are attached by
the Android test APK build; the guardian image is ghcr.io/theicaruswings/trikey-guardian:0.1.27-alpha, and the
attached trikey-guardian-compose.yml names it by digest. This release is published only once every file is
attached and checked (publish-release.yml). How to install and test: docs/alpha-test-plan.md.

Trikey alpha test build (Android)

Signed with the Trikey release key (certificate SHA-256 c6c46a1332725111413a7b0313e2f2f37b10f0ce4c8da1cac3c92d179a162da7, also in
packaging/android/release-cert.sha256). Every release from 0.1.7-alpha on has this signature, so it installs over
the previous one and the wallet on the phone stays. Builds up to 0.1.6-alpha had one-off keys: moving from one of
those needs a last uninstall, which deletes the wallet on that phone, so make a backup (recovery code and backup
file) first. To get updates without downloading by hand, see docs/android-signing.md (Obtainium).

Which APK? There are two builds of the same code, as two apps: each updates itself, and both can be on one
phone, each with its own wallet.

• trikey-alpha-v0.1.27-alpha.apk: the standard build, "Trikey" (app.trikey.wallet). It contains Google's
  libraries: QR codes are read with Google's ML Kit, and Google Drive backup can be switched on in a later release
  (it needs Google Play services on the phone).
• trikey-alpha-foss-v0.1.27-alpha.apk: no Google code, "Trikey FOSS" (app.trikey.wallet.foss), for phones without Google
  Play services (GrapheneOS, /e/OS, LineageOS) or if you prefer an app without it. QR codes are read with the
  open source zxing-cpp. It will never offer Google Drive backup: the backup is the recovery code plus the backup
  file, which you can still save to Google Drive or anywhere else from the share sheet. Settings, About says
  "Trikey (no Google)".

Today both do the same: Google Drive backup is not switched on in either yet. Not sure? Take the standard one.

Had the no-Google APK of 0.1.21-alpha or earlier? It had the standard app's id, so this FOSS APK cannot
update it: it installs as a second app, next to the old one, and starts empty. Your wallet is still in the old
app. Because it is a new app, Android has no installed app to compare its signature with, so check who signed
it before you restore your wallet into it: install AppVerifier (F-Droid or Accrescent), pick Trikey FOSS
(app.trikey.wallet.foss), and compare its SHA-256 with the release key's above and in
packaging/android/release-cert.sha256. If they differ, uninstall it and restore nothing. Then, in Trikey FOSS, tap
"I already have a Trikey wallet", then "My phone, but I have its backup", and open your backup file with your
recovery code. Uninstall the old app once the wallet shows in the new one. (Or install the standard APK over the
old app: it updates in place, keeps the wallet, and Android checks its signature, with Google's libraries.)

• Pre-alpha, open source, not audited. Test networks only (signet, testnet4). Never put real bitcoin in it.
• Install: download the APK on the phone, open it, and allow installing from this source when Android asks.
• Passkeys and Google Drive backup are not in these builds; the backup is a recovery code plus a backup file.
• Check for updates (Settings, About) offers the APK of the build you have installed.
• The SHA-256 of each APK below (and its .sha256 file) shows that a download is complete. It comes from this
  release, like the APK, so it does not show who made it: the signing certificate does.
• How to test it: docs/alpha-test-plan.md in the repository.

Standard: trikey-alpha-v0.1.27-alpha.apk

• SHA-256 44aa1b2e91b7b43b5fd91e4640056b08f81e119ef9c449bb3242a3705dd3dab7
• 58.3 MB, built for arm64-v8a from commit 220ed0f.

No Google: trikey-alpha-foss-v0.1.27-alpha.apk

• SHA-256 c8c6264591ba876e9871f58b16c9194189fc624e75e84d8edf78b512fe5f2053
• 52.9 MB, built for arm64-v8a from commit 220ed0f.
• Checked by the build: no Google Play services, Firebase, ML Kit or data transport code in it.

Trikey v0.1.26-alpha

A guardian fix for shutting down, and how releases reach you. Update the guardian, then the app.

• The guardian finishes what it started before it stops. When the guardian stopped (an Umbrel update or restart),
  an alert still being sent to your contacts, for example about money leaving Savings, could be cut short, and so
  could a save of its state. Now it waits for both, up to a few seconds (#222).
• Releases are normal GitHub releases now, not pre-releases: Obtainium no longer needs "Include prereleases", and
  Zapstore should pick each release up by itself. The version still says "alpha", and Trikey is still pre-alpha and not
  audited. After each release a check watches Zapstore and opens an issue if an app isn't updated there (#221).
• For testers: docs/testers.md, a one-page start, and a "Hardware wallet test report" issue form;
  every device but the Ledger is still to be tried on real hardware (#216). The beta checklist records the defaults
  (a 200,000 sats daily limit suggested, a 7-day delay), Start9 as "build it yourself" and the iPhone built from source
  for the beta (#215).
• For maintainers: tools/release/bump.mjs moves the version everywhere, docs/releasing.md is the runbook, and the
  changelog uses Keep a Changelog headings so Zapstore gets one release's notes (#217, #218); a flaky test fixed (#220).

The Android APKs (the standard build and the one without Google code) and their .sha256 files are attached by
the Android test APK build; the guardian image is ghcr.io/theicaruswings/trikey-guardian:0.1.26-alpha, and the
attached trikey-guardian-compose.yml names it by digest. This release is published only once every file is
attached and checked (publish-release.yml). How to install and test: docs/alpha-test-plan.md.

Trikey alpha test build (Android)

Signed with the Trikey release key (certificate SHA-256 c6c46a1332725111413a7b0313e2f2f37b10f0ce4c8da1cac3c92d179a162da7, also in
packaging/android/release-cert.sha256). Every release from 0.1.7-alpha on has this signature, so it installs over
the previous one and the wallet on the phone stays. Builds up to 0.1.6-alpha had one-off keys: moving from one of
those needs a last uninstall, which deletes the wallet on that phone, so make a backup (recovery code and backup
file) first. To get updates without downloading by hand, see docs/android-signing.md (Obtainium).

Which APK? There are two builds of the same code, as two apps: each updates itself, and both can be on one
phone, each with its own wallet.

• trikey-alpha-v0.1.26-alpha.apk: the standard build, "Trikey" (app.trikey.wallet). It contains Google's
  libraries: QR codes are read with Google's ML Kit, and Google Drive backup can be switched on in a later release
  (it needs Google Play services on the phone).
• trikey-alpha-foss-v0.1.26-alpha.apk: no Google code, "Trikey FOSS" (app.trikey.wallet.foss), for phones without Google
  Play services (GrapheneOS, /e/OS, LineageOS) or if you prefer an app without it. QR codes are read with the
  open source zxing-cpp. It will never offer Google Drive backup: the backup is the recovery code plus the backup
  file, which you can still save to Google Drive or anywhere else from the share sheet. Settings, About says
  "Trikey (no Google)".

Today both do the same: Google Drive backup is not switched on in either yet. Not sure? Take the standard one.

Had the no-Google APK of 0.1.21-alpha or earlier? It had the standard app's id, so this FOSS APK cannot
update it: it installs as a second app, next to the old one, and starts empty. Your wallet is still in the old
app. Because it is a new app, Android has no installed app to compare its signature with, so check who signed
it before you restore your wallet into it: install AppVerifier (F-Droid or Accrescent), pick Trikey FOSS
(app.trikey.wallet.foss), and compare its SHA-256 with the release key's above and in
packaging/android/release-cert.sha256. If they differ, uninstall it and restore nothing. Then, in Trikey FOSS, tap
"I already have a Trikey wallet", then "My phone, but I have its backup", and open your backup file with your
recovery code. Uninstall the old app once the wallet shows in the new one. (Or install the standard APK over the
old app: it updates in place, keeps the wallet, and Android checks its signature, with Google's libraries.)

• Pre-alpha, open source, not audited. Test networks only (signet, testnet4). Never put real bitcoin in it.
• Install: download the APK on the phone, open it, and allow installing from this source when Android asks.
• Passkeys and Google Drive backup are not in these builds; the backup is a recovery code plus a backup file.
• Check for updates (Settings, About) offers the APK of the build you have installed.
• The SHA-256 of each APK below (and its .sha256 file) shows that a download is complete. It comes from this
  release, like the APK, so it does not show who made it: the signing certificate does.
• How to test it: docs/alpha-test-plan.md in the repository.

Standard: trikey-alpha-v0.1.26-alpha.apk

• SHA-256 ea6743970ca10ebcc6e424f9a2dd247bc276f500b6a1535c26fe99467a555c06
• 58.1 MB, built for arm64-v8a from commit 9339aaa.

No Google: trikey-alpha-foss-v0.1.26-alpha.apk

• SHA-256 41329a2565f220b7b8ad1afd13e0a8ac3a8fb5cdfdf2f05c24d73eece8b3c408
• 52.7 MB, built for arm64-v8a from commit 9339aaa.
• Checked by the build: no Google Play services, Firebase, ML Kit or data transport code in it.

Trikey v0.1.25-alpha

Fixes from a third security review (Grok only, on 0.1.24's code), a simpler Home screen for one wallet, and Trikey on
Zapstore and Obtainium. Update the guardian, then the app.

• The guardian refuses to co-sign while its clock is behind the chain, as it already did while ahead. Before, a
  phone thief who could also set the home server's clock back could spend the daily limit again for every day they
  moved it. The app now says the guardian's clock is off and to check the box's date and time (#213).

• Family hosting keeps a guest's coins in view until they are really spent. A coin left the host's list when the
  chain server did not list it, which is also true of a payment not broadcast yet, or of a malformed reply; a stolen
  guest phone could then make a coin only the guardian can co-sign drop out of a later recovery. Now a coin leaves only
  once the coin its transaction spends is gone, a reply that isn't a list is an error, and leaving the host checks the
  hardware approval first and needs every coin settled (#213).

• Savings alerts can't be crowded out. A large spend from Savings hidden behind 400 small ones was never announced,
  and alerts to contacts kept only the last 32. Now every spend is handed over (largest first) before a scan counts as
  complete, and no alert still owed to someone is dropped: past 64, the smallest fold into one total (#213).

• A LOCK dated in the future is remembered and counted against the contact's limit, so a relay delivering it
  again later can't lock the guardian then (#213).

• One wallet looks like one wallet. Home no longer shows a wallet name and switcher by default. Several wallets is
  now a setting (Settings, Wallets), off unless you turn it on; it stays on while the phone holds more than one wallet,
  so no wallet is ever hidden. The demo starts with one wallet (#211).

• Releases are checked more strictly. The publish check rebuilds the release's compose file from the tagged code and
  the verified image, and requires it byte for byte; the Umbrel store and Start9 jobs take only the digest verified for
  that commit; release runs are matched by commit, not by name; and a release whose files changed while publishing is
  pulled back (#212).

• Get it on Android: both apps are on Zapstore (Trikey and Trikey FOSS), and
  trikey.app/obtainium adds either to Obtainium in one tap (#205, #207, #208).

• The README explains Trikey with diagrams and screenshots, the site no longer says "coming soon", the iPhone build
  docs cover an iPhone on a newer iOS than Xcode knows, and docs/beta-checklist.md lists what stands between this alpha
  and a beta (#203, #204, #206, #209, #210).

The Android APKs (the standard build and the one without Google code) and their .sha256 files are attached by
the Android test APK build; the guardian image is ghcr.io/theicaruswings/trikey-guardian:0.1.25-alpha, and the
attached trikey-guardian-compose.yml names it by digest. This release is published only once every file is
attached and checked (publish-release.yml). How to install and test: docs/alpha-test-plan.md.

Trikey alpha test build (Android)

Signed with the Trikey release key (certificate SHA-256 c6c46a1332725111413a7b0313e2f2f37b10f0ce4c8da1cac3c92d179a162da7, also in
packaging/android/release-cert.sha256). Every release from 0.1.7-alpha on has this signature, so it installs over
the previous one and the wallet on the phone stays. Builds up to 0.1.6-alpha had one-off keys: moving from one of
those needs a last uninstall, which deletes the wallet on that phone, so make a backup (recovery code and backup
file) first. To get updates without downloading by hand, see docs/android-signing.md (Obtainium).

Which APK? There are two builds of the same code, as two apps: each updates itself, and both can be on one
phone, each with its own wallet.

• trikey-alpha-v0.1.25-alpha.apk: the standard build, "Trikey" (app.trikey.wallet). It contains Google's
  libraries: QR codes are read with Google's ML Kit, and Google Drive backup can be switched on in a later release
  (it needs Google Play services on the phone).
• trikey-alpha-foss-v0.1.25-alpha.apk: no Google code, "Trikey FOSS" (app.trikey.wallet.foss), for phones without Google
  Play services (GrapheneOS, /e/OS, LineageOS) or if you prefer an app without it. QR codes are read with the
  open source zxing-cpp. It will never offer Google Drive backup: the backup is the recovery code plus the backup
  file, which you can still save to Google Drive or anywhere else from the share sheet. Settings, About says
  "Trikey (no Google)".

Today both do the same: Google Drive backup is not switched on in either yet. Not sure? Take the standard one.

Had the no-Google APK of 0.1.21-alpha or earlier? It had the standard app's id, so this FOSS APK cannot
update it: it installs as a second app, next to the old one, and starts empty. Your wallet is still in the old
app. Because it is a new app, Android has no installed app to compare its signature with, so check who signed
it before you restore your wallet into it: install AppVerifier (F-Droid or Accrescent), pick Trikey FOSS
(app.trikey.wallet.foss), and compare its SHA-256 with the release key's above and in
packaging/android/release-cert.sha256. If they differ, uninstall it and restore nothing. Then, in Trikey FOSS, tap
"I already have a Trikey wallet", then "My phone, but I have its backup", and open your backup file with your
recovery code. Uninstall the old app once the wallet shows in the new one. (Or install the standard APK over the
old app: it updates in place, keeps the wallet, and Android checks its signature, with Google's libraries.)

• Pre-alpha, open source, not audited. Test networks only (signet, testnet4). Never put real bitcoin in it.
• Install: download the APK on the phone, open it, and allow installing from this source when Android asks.
• Passkeys and Google Drive backup are not in these builds; the backup is a recovery code plus a backup file.
• Check for updates (Settings, About) offers the APK of the build you have installed.
• The SHA-256 of each APK below (and its .sha256 file) shows that a download is complete. It comes from this
  release, like the APK, so it does not show who made it: the signing certificate does.
• How to test it: docs/alpha-test-plan.md in the repository.

Standard: trikey-alpha-v0.1.25-alpha.apk

• SHA-256 c10e13ad1630a5bdeb94f3f18607bca8b698776ec5276561b2432bb03907e80a
• 58.1 MB, built for arm64-v8a from commit 618057a.

No Google: trikey-alpha-foss-v0.1.25-alpha.apk

• SHA-256 e8374e66497746a01bc4a256f6adc1da9441bc1f29d950df95f756cb8db34e86
• 52.7 MB, built for arm64-v8a from commit 618057a.
• Checked by the build: no Google Play services, Firebase, ML Kit or data transport code in it.

Trikey v0.1.24-alpha

The last, low-severity findings of the second security review, and every dependency advisory fixed. Update the
guardian, then the app.

• Your own phone no longer counts as your alert contact. On mainnet a wallet needs at least one alert contact other
  than its paired phone, at pairing and at every rule change; a wallet already paired with only the phone keeps working
  and is warned (#194).
• "Lost my hardware wallet" checks the new device first. Before anything is swept to the new wallet, the new device
  registers it, shows its first address (it must match) and signs a proof. When a new phone replaces a lost one, the
  Recovery Key's key is read from the device too, not only from the guardian (#195).
• The recovery code is harder to leak. No Copy button, the words can't be selected, Android blocks screenshots of
  the screen, and the app covers it in the app switcher (#195).
• The BitBox02 pairing key moved to the phone's secure storage, out of phone backups (#195).
• The phone no longer trusts any address number the guardian reports: at most 20 past the last one it knows is
  used (#195).
• Family hosting: a co-signature no longer drops a guest's coins from the host's ledger before the chain shows them
  spent (#194).
• A chain server is judged by its address, not its label: an internet server labelled "your own" is treated as
  public (refused during a recovery) (#194).
• Local-network filters catch every spelling of an address (IPv6 forms of local addresses, shorthand IPv4), in one
  shared filter; contacts' .onion relays are skipped (#193).
• Strangers can't fill the guardian's log with fake CANCEL messages or refused recovery requests, and the right setup
  code always works even while wrong ones are being tried (#194).
• Dependencies: npm audit reports nothing. nodemailer (the guardian's email alerts) and Expo's and Ledger's
  libraries updated or pinned past their advisories (#189, #190, #198, #201); the guardian image no longer keeps a code
  cache in /tmp, and the Zapstore tool is pinned (#193).
• Releases: the last check before publishing compared the files wrongly and stopped 0.1.23 (#200); the iOS launch
  check now reports on every pull request (#196); a full-history secret scan is clean (#197).

The Android APKs (the standard build and the one without Google code) and their .sha256 files are attached by
the Android test APK build; the guardian image is ghcr.io/theicaruswings/trikey-guardian:0.1.24-alpha, and the
attached trikey-guardian-compose.yml names it by digest. This release is published only once every file is
attached and checked (publish-release.yml). How to install and test: docs/alpha-test-plan.md.

Trikey alpha test build (Android)

Signed with the Trikey release key (certificate SHA-256 c6c46a1332725111413a7b0313e2f2f37b10f0ce4c8da1cac3c92d179a162da7, also in
packaging/android/release-cert.sha256). Every release from 0.1.7-alpha on has this signature, so it installs over
the previous one and the wallet on the phone stays. Builds up to 0.1.6-alpha had one-off keys: moving from one of
those needs a last uninstall, which deletes the wallet on that phone, so make a backup (recovery code and backup
file) first. To get updates without downloading by hand, see docs/android-signing.md (Obtainium).

Which APK? There are two builds of the same code, as two apps: each updates itself, and both can be on one
phone, each with its own wallet.

• trikey-alpha-v0.1.24-alpha.apk: the standard build, "Trikey" (app.trikey.wallet). It contains Google's
  libraries: QR codes are read with Google's ML Kit, and Google Drive backup can be switched on in a later release
  (it needs Google Play services on the phone).
• trikey-alpha-foss-v0.1.24-alpha.apk: no Google code, "Trikey FOSS" (app.trikey.wallet.foss), for phones without Google
  Play services (GrapheneOS, /e/OS, LineageOS) or if you prefer an app without it. QR codes are read with the
  open source zxing-cpp. It will never offer Google Drive backup: the backup is the recovery code plus the backup
  file, which you can still save to Google Drive or anywhere else from the share sheet. Settings, About says
  "Trikey (no Google)".

Today both do the same: Google Drive backup is not switched on in either yet. Not sure? Take the standard one.

Had the no-Google APK of 0.1.21-alpha or earlier? It had the standard app's id, so this FOSS APK cannot
update it: it installs as a second app, next to the old one, and starts empty. Your wallet is still in the old
app. Because it is a new app, Android has no installed app to compare its signature with, so check who signed
it before you restore your wallet into it: install AppVerifier (F-Droid or Accrescent), pick Trikey FOSS
(app.trikey.wallet.foss), and compare its SHA-256 with the release key's above and in
packaging/android/release-cert.sha256. If they differ, uninstall it and restore nothing. Then, in Trikey FOSS, tap
"I already have a Trikey wallet", then "My phone, but I have its backup", and open your backup file with your
recovery code. Uninstall the old app once the wallet shows in the new one. (Or install the standard APK over the
old app: it updates in place, keeps the wallet, and Android checks its signature, with Google's libraries.)

• Pre-alpha, open source, not audited. Test networks only (signet, testnet4). Never put real bitcoin in it.
• Install: download the APK on the phone, open it, and allow installing from this source when Android asks.
• Passkeys and Google Drive backup are not in these builds; the backup is a recovery code plus a backup file.
• Check for updates (Settings, About) offers the APK of the build you have installed.
• The SHA-256 of each APK below (and its .sha256 file) shows that a download is complete. It comes from this
  release, like the APK, so it does not show who made it: the signing certificate does.
• How to test it: docs/alpha-test-plan.md in the repository.

Standard: trikey-alpha-v0.1.24-alpha.apk

• SHA-256 a73704cf611257f4fbbf8c930f3c8c3113dbb74539b1a657e137f6371547027a
• 58.1 MB, built for arm64-v8a from commit ad867c4.

No Google: trikey-alpha-foss-v0.1.24-alpha.apk

• SHA-256 29b0a943654a3aa084f1ff0af991a4518d2df2938bd95de6cdf7151b745392a3
• 52.7 MB, built for arm64-v8a from commit ad867c4.
• Checked by the build: no Google Play services, Firebase, ML Kit or data transport code in it.

Trikey v0.1.23-alpha

A security release, from a second review of the whole project (two independent AI-run audits compared, each finding
checked against the code and fixed with a test that reproduces it). 0.1.22-alpha was never published: its release
stopped at a check of its own files (#185), so this one has everything it had, and more. Update the guardian, then the
app: with this guardian an older app cannot pair a new wallet, add a wallet or change your alert contacts (it says
"update the app"). Nothing here was exploited that we know of. And on Android, the build without Google is now its own
app.

• Your hardware wallet now names your alert contacts when it approves rules (pairing, adding a wallet, a rule
  change): contacts=npub1abcdefgh..wxyz, the start and end of each contact's npub, or for many contacts their number
  and a code that the guardian's web page (Rules) and the app show too. Compare them before you approve. Before, it
  showed only how many contacts there were, so a tampered app could swap your contact for its own unseen. Every contact
  added or removed now gets a message, and Activity names them (#180).
• Adding a wallet needs your first wallet's hardware wallet (one more confirmation, Trikey add-wallet v1), and
  your first wallet's contacts are told of every wallet added and every hardware unlock turned on. Before, a stolen
  phone could add a wallet with a hardware key of its own. New in the guardian's web page (Settings > Wallets and
  hardware unlock): see every wallet and its hardware unlock, turn any unlock off, and remove a wallet after the first
  without its hardware wallet (type REMOVE WALLET). Removing is refused while that wallet's recovery runs (#180).
• A stolen phone can no longer freeze a recovery by co-signing thousands of payments to itself that are never
  sent. Only what the guardian sees on chain moves where it looks for your change now. Co-signing has a minimum fee
  (0.1 sat/vB) and a limit of 30 payments an hour and 200 a day per wallet. A daily limit of 1,000 BTC or more now
  counts as "no limit" for every purpose, and a guardian whose clock was pushed forward no longer forgets payments
  (#179).
• On Umbrel, another app can no longer use the guardian page's sign-in. Browsers send a page's cookie to every app
  on the same address, so the sign-in now also needs a secret only the guardian's own tabs hold. Opening the guardian
  in a new tab while none is open asks for your passphrase. The guardian also trusts only Umbrel's own gateway: on
  umbrelOS 1, a new guardian asks for its setup code (in the app's logs, Settings > Troubleshoot) (#175).
• Umbrel backups leave the guardian out, as on Start9. A restored Umbrel starts an empty guardian: set it up and use
  Replace guardian with your phone and hardware wallet. Backups made by 0.1.21-alpha or earlier still hold a copy
  of the guardian's data (its key under your passphrase): delete them if you can. microSD signing (Passport gen 2,
  Krux) now ends with a step to delete the signed files from the card (#176).
• Turning hardware unlock off and on again now really replaces it. The guardian picks the new unlock's id, so an
  old signature (one malware kept, say) can never make the old unlock again. An old copy of the guardian's data still
  opens with the old signature: only Replace guardian revokes that. An older app can't turn hardware unlock on with
  this guardian ("update the app"); unlocking with one you have keeps working (#181).
• A stranger who reaches the guardian's page can no longer keep you waiting to unlock. Failed passphrases count
  per address; on Umbrel, your own logins through Umbrel never wait for anyone else's (#181).
• Bitcoin Core's password is tied to its port too: changing the port asks for the password again (#181).
• Messages to your alert contacts reach their own inbox relays, also when the guardian has its maximum of relays
  (#183).
• Wallet names in alerts are plain text: letters, digits, spaces, - and ' only, so a thief can't send your
  contacts a link in a wallet's name (#183).
• The guardian refuses floods before writing them: per-sender limits on stored requests, on its memory of handled
  messages (your own phones' entries are never pushed out), and on CANCEL replies (#183).
• The guardian no longer accepts an unsealed unlock from the phone (the passphrase or a hardware unlock sent in
  the clear, as apps before 0.1.17-alpha did): an older app must be updated to unlock the guardian or turn hardware
  unlock on. Family hosting: each guest's recovery now has its own lock, so one guest can't hold up another's or the
  host's. Repeated requests (notes, broadcasts, adding a wallet) are recognised after a restart too, contacts' inbox
  relays on your local network are never used, and the phone no longer stores strangers' unreadable messages (#186).
• Trezor: the reply from Trezor Suite Lite must carry a one-time token, and the key and addresses must be for the
  path asked for (#182).
• Recovery Key mode checks the second hardware wallet too: it registers the vault and shows the same first
  address (test networks only for now) (#182).
• Jade over Bluetooth reaches only Blockstream's PIN server, or one you confirm as your own, over https, with no
  redirects (#182).
• Recovery Key mode's pre-signed refills are encrypted on the phone, so a phone backup can't broadcast them (#182).
• Android: Trikey FOSS. The build without Google code is now its own app (app.trikey.wallet.foss, "Trikey FOSS"),
  installable beside the standard Trikey. Had the no-Google APK of 0.1.21-alpha or earlier? The new one installs as a
  separate, empty app: restore your wallet in it from your backup file and recovery code, check it, then uninstall the
  old one (docs/android-signing.md) (#169).
• Releases are checked before they go out. A release starts as a draft and is published only after its 7 files,
  their checksums and both APKs' signatures are checked; each release pushes one image tag, which a re-release cannot
  change; the build tools are pinned (#177, #171, #185).
• The daily-limit bar on the guardian's home page is visible again (#172). The docs explain renewing the iPhone's
  7-day profile (#174).

The Android APKs (the standard build and the one without Google code) and their .sha256 files are attached by
the Android test APK build; the guardian image is ghcr.io/theicaruswings/trikey-guardian:0.1.23-alpha, and the
attached trikey-guardian-compose.yml names it by digest. This release is published only once every file is
attached and checked (publish-release.yml). How to install and test: docs/alpha-test-plan.md.

Trikey alpha test build (Android)

Signed with the Trikey release key (certificate SHA-256 c6c46a1332725111413a7b0313e2f2f37b10f0ce4c8da1cac3c92d179a162da7, also in
packaging/android/release-cert.sha256). Every release from 0.1.7-alpha on has this signature, so it installs over
the previous one and the wallet on the phone stays. Builds up to 0.1.6-alpha had one-off keys: moving from one of
those needs a last uninstall, which deletes the wallet on that phone, so make a backup (recovery code and backup
file) first. To get updates without downloading by hand, see docs/android-signing.md (Obtainium).

Which APK? There are two builds of the same code, as two apps: each updates itself, and both can be on one
phone, each with its own wallet.

• trikey-alpha-v0.1.23-alpha.apk: the standard build, "Trikey" (app.trikey.wallet). It contains Google's
  libraries: QR codes are read with Google's ML Kit, and Google Drive backup can be switched on in a later release
  (it needs Google Play services on the phone).
• trikey-alpha-foss-v0.1.23-alpha.apk: no Google code, "Trikey FOSS" (app.trikey.wallet.foss), for phones without Google
  Play services (GrapheneOS, /e/OS, LineageOS) or if you prefer an app without it. QR codes are read with the
  open source zxing-cpp. It will never offer Google Drive backup: the backup is the recovery code plus the backup
  file, which you can still save to Google Drive or anywhere else from the share sheet. Settings, About says
  "Trikey (no Google)".

Today both do the same: Google Drive backup is not switched on in either yet. Not sure? Take the standard one.

Had the no-Google APK of 0.1.21-alpha or earlier? It had the standard app's id, so this FOSS APK cannot
update it: it installs as a second app, next to the old one, and starts empty. Your wallet is still in the old
app. Because it is a new app, Android has no installed app to compare its signature with, so check who signed
it before you restore your wallet into it: install AppVerifier (F-Droid or Accrescent), pick Trikey FOSS
(app.trikey.wallet.foss), and compare its SHA-256 with the release key's above and in
packaging/android/release-cert.sha256. If they differ, uninstall it and restore nothing. Then, in Trikey FOSS, tap
"I already have a Trikey wallet", then "My phone, but I have its backup", and open your backup file with your
recovery code. Uninstall the old app once the wallet shows in the new one. (Or install the standard APK over the
old app: it updates in place, keeps the wallet, and Android checks its signature, with Google's libraries.)

• Pre-alpha, open source, not audited. Test networks only (signet, testnet4). Never put real bitcoin in it.
• Install: download the APK on the phone, open it, and allow installing from this source when Android asks.
• Passkeys and Google Drive backup are not in these builds; the backup is a recovery code plus a backup file.
• Check for updates (Settings, About) offers the APK of the build you have installed.
• The SHA-256 of each APK below (and its .sha256 file) shows that a download is complete. It comes from this
  release, like the APK, so it does not show ...

Trikey v0.1.21-alpha

A security release: fixes from an external review of the whole project (an AI-run audit, each finding checked against
the code before fixing). Update the guardian, then the app: a guardian with this release refuses to pair with an older
app. Nothing here was exploited that we know of.

• Your hardware wallet now approves the rules a new wallet starts with. When you pair, add a wallet, accept a family
  invite or replace your guardian, your hardware wallet asks for one more confirmation showing your daily limit
  (limit=, in sats), waiting period (delay=), sweep fee cap and number of alert contacts: check them before you
  approve. Before, only the app chose these rules, so a tampered app could have set a limit high enough to empty the
  wallet with the phone and guardian alone. Wallets already paired keep their rules (#167).
• A notification channel moved to another server no longer keeps its secrets. Moving an ntfy channel needs its topic
  again and forgets its token; a webhook with a new address forgets its signing secret; changing the email server, port,
  encryption, user name or pinned certificate needs the app password again (#164).
• On Umbrel and Start9, only you can set up a new guardian. Other apps on the same box could reach a guardian not yet
  set up. On Umbrel nothing changes for you (the guardian recognises Umbrel's login); on Start9 the guardian asks for a
  setup code: Actions > Show Setup Code, or the dialog that shows your web password (#164).
• Bitcoin Core's password goes only where it was checked, and on Start9 the guardian no longer sees Bitcoin's whole
  data folder. The docs list the exact RPC calls the guardian needs, and advise keeping no funds in the node's own
  wallet (#164).
• Savings: a payment out can no longer be hidden behind many small payments in. The guardian now checks every Savings
  transaction; if there are too many to check for half an hour, you and your contacts get "Savings not fully checked"
  instead of silence (#166).
• Cancelling a recovery by DM: the cancel line must be the whole reply. A reply quoting the guardian's alert no longer
  cancels; anything else gets a short answer saying exactly what to send (#166).
• The guardian's one-time unlock key is replaced after every try, whatever the answer, and a burst of refused
  payment requests hits the same limit as one after another (#166).
• Recovery Key mode: the vault's address waits for your hardware wallet. QR and NFC devices now confirm the vault's
  first address too; no vault address is shown until one has; key exports that don't match their path are refused
  (#165).

The Android APKs (the standard build and the one without Google code) and their .sha256 files are attached by
the Android test APK build when it finishes; the guardian image is ghcr.io/theicaruswings/trikey-guardian:0.1.21-alpha.
How to install and test: docs/alpha-test-plan.md.

Trikey alpha test build (Android)

Signed with the Trikey release key (certificate SHA-256 c6c46a1332725111413a7b0313e2f2f37b10f0ce4c8da1cac3c92d179a162da7, also in
packaging/android/release-cert.sha256). Every release from 0.1.7-alpha on has this signature, so it installs over
the previous one and the wallet on the phone stays. Builds up to 0.1.6-alpha had one-off keys: moving from one of
those needs a last uninstall, which deletes the wallet on that phone, so make a backup (recovery code and backup
file) first. To get updates without downloading by hand, see docs/android-signing.md (Obtainium).

Which APK? There are two builds of the same app. They have the same name, package and signature, so you can
switch at any time by installing the other one over the app; the wallet stays.

• trikey-alpha-v0.1.21-alpha.apk: the standard build. It contains Google's libraries: QR codes are read with
  Google's ML Kit, and Google Drive backup can be switched on in a later release (it needs Google Play services
  on the phone).
• trikey-alpha-foss-v0.1.21-alpha.apk: no Google code, for phones without Google Play services (GrapheneOS, /e/OS,
  LineageOS) or if you prefer an app without it. QR codes are read with the open source zxing-cpp. It will never
  offer Google Drive backup: the backup is the recovery code plus the backup file, which you can still save to
  Google Drive or anywhere else from the share sheet. Settings, About says "Trikey (no Google)".

Today both do the same: Google Drive backup is not switched on in either yet. Not sure? Take the standard one.

• Pre-alpha, open source, not audited. Test networks only (signet, testnet4). Never put real bitcoin in it.
• Install: download the APK on the phone, open it, and allow installing from this source when Android asks.
• Passkeys and Google Drive backup are not in these builds; the backup is a recovery code plus a backup file.
• Check for updates (Settings, About) offers the APK of the build you have installed.
• How to test it: docs/alpha-test-plan.md in the repository.

Standard: trikey-alpha-v0.1.21-alpha.apk

• SHA-256 415372f1956d8f51f76279eab4b54d264080f0f3dd85b754cc1d17023dc588e5
• 58.0 MB, built for arm64-v8a from commit c483dab.

No Google: trikey-alpha-foss-v0.1.21-alpha.apk

• SHA-256 272157727c770d09d2f2364ac5dedc90c5cee6869ddcdc8a314c63abec0b75d3
• 52.6 MB, built for arm64-v8a from commit c483dab.
• Checked by the build: no Google Play services, Firebase, ML Kit or data transport code in it.

Trikey v0.1.20-alpha

Change the guardian's passphrase, and BitBox02. Update the guardian, then the app; each works with the other side's
older version.

• Change the guardian's passphrase. On the guardian's web page, Settings > Passphrase: the current passphrase, then
  the new one twice. Your wallet, its rules and unlocking with your hardware wallet keep working. Other browsers are
  signed out, and your phone and your email, push or Telegram alerts say it happened. The old passphrase stops working
  everywhere (password manager, paper, an older app you once typed it into); your recovery code, backup file and
  recovery sheet don't use it, so there is nothing to print again. A copy of the guardian's data made before the change
  (a backup of the box, a copied Docker volume) still opens with the old passphrase: delete it or keep it safe. The app
  can't change the passphrase, so a stolen phone can't either (#160).
• BitBox02. Plug a BitBox02 into an Android phone's USB-C port, or connect a BitBox02 Nova over Bluetooth on Android
  or iPhone. It sets up your wallet, approves payments and rule changes, gives recovery access, keeps your notes on the
  guardian and can unlock the guardian. It needs firmware 9.27.1 or later; the first time, check that the phone and the
  BitBox02 show the same pairing code. Payments are signed so the phone can check the BitBox02 hides nothing in its
  signatures (anti-klepto). Notes and hardware unlock made with a BitBox02 work only with a BitBox02: if you move your
  recovery phrase to another brand, turn them on again. Not yet tried on a real BitBox02: please test (alpha test plan,
  step 18i) (#159).

The Android APKs (the standard build and the one without Google code) and their .sha256 files are attached by
the Android test APK build when it finishes; the guardian image is ghcr.io/theicaruswings/trikey-guardian:0.1.20-alpha.
How to install and test: docs/alpha-test-plan.md.

Trikey alpha test build (Android)

Signed with the Trikey release key (certificate SHA-256 c6c46a1332725111413a7b0313e2f2f37b10f0ce4c8da1cac3c92d179a162da7, also in
packaging/android/release-cert.sha256). Every release from 0.1.7-alpha on has this signature, so it installs over
the previous one and the wallet on the phone stays. Builds up to 0.1.6-alpha had one-off keys: moving from one of
those needs a last uninstall, which deletes the wallet on that phone, so make a backup (recovery code and backup
file) first. To get updates without downloading by hand, see docs/android-signing.md (Obtainium).

Which APK? There are two builds of the same app. They have the same name, package and signature, so you can
switch at any time by installing the other one over the app; the wallet stays.

• trikey-alpha-v0.1.20-alpha.apk: the standard build. It contains Google's libraries: QR codes are read with
  Google's ML Kit, and Google Drive backup can be switched on in a later release (it needs Google Play services
  on the phone).
• trikey-alpha-foss-v0.1.20-alpha.apk: no Google code, for phones without Google Play services (GrapheneOS, /e/OS,
  LineageOS) or if you prefer an app without it. QR codes are read with the open source zxing-cpp. It will never
  offer Google Drive backup: the backup is the recovery code plus the backup file, which you can still save to
  Google Drive or anywhere else from the share sheet. Settings, About says "Trikey (no Google)".

Today both do the same: Google Drive backup is not switched on in either yet. Not sure? Take the standard one.

• Pre-alpha, open source, not audited. Test networks only (signet, testnet4). Never put real bitcoin in it.
• Install: download the APK on the phone, open it, and allow installing from this source when Android asks.
• Passkeys and Google Drive backup are not in these builds; the backup is a recovery code plus a backup file.
• Check for updates (Settings, About) offers the APK of the build you have installed.
• How to test it: docs/alpha-test-plan.md in the repository.

Standard: trikey-alpha-v0.1.20-alpha.apk

• SHA-256 5e13c78a5d6b65e1709e5734ae7bb295bd8825bdd9a4a9dd1b2538b5f6c12993
• 58.0 MB, built for arm64-v8a from commit da1e8fe.

No Google: trikey-alpha-foss-v0.1.20-alpha.apk

• SHA-256 4373b005857b765b7912127cd2050a1793c3f8f3e6b2786b4abf6bfc750a12a8
• 52.6 MB, built for arm64-v8a from commit da1e8fe.
• Checked by the build: no Google Play services, Firebase, ML Kit or data transport code in it.

Trikey v0.1.19-alpha

A fix for the iPhone app, and Jade over Bluetooth. Update the app; the guardian has no changes.

• iPhone: 0.1.18 closed itself right after opening. Fixed. A part of the Coldcard NFC code loaded itself in a loop on
  phones; on an iPhone without NFC that stopped the app at launch. Your wallet was not touched. A new test catches this
  kind of mistake, and releases now wait for the iPhone launch check (#158).
• Jade over Bluetooth. A Blockstream Jade or Jade Plus can connect over Bluetooth, not only with QR codes: it sets up
  your wallet, co-signs payments, approves your guardian's changes, and can keep your notes on the guardian and unlock
  it. To unlock the Jade you type its PIN on the Jade, and your phone passes an encrypted check between the Jade and its
  PIN server (Blockstream's, unless you set your own); that server sees your phone's IP address and when your Jade
  unlocks, never your PIN or keys, and the app says so before the first unlock. In QR mode Trikey contacts no PIN
  server. Not yet tried on a real Jade: please test (alpha test plan, step 18h) (#156).

The Android APKs (the standard build and the one without Google code) and their .sha256 files are attached by
the Android test APK build when it finishes; the guardian image is ghcr.io/theicaruswings/trikey-guardian:0.1.19-alpha.
How to install and test: docs/alpha-test-plan.md.

Trikey alpha test build (Android)

Signed with the Trikey release key (certificate SHA-256 c6c46a1332725111413a7b0313e2f2f37b10f0ce4c8da1cac3c92d179a162da7, also in
packaging/android/release-cert.sha256). Every release from 0.1.7-alpha on has this signature, so it installs over
the previous one and the wallet on the phone stays. Builds up to 0.1.6-alpha had one-off keys: moving from one of
those needs a last uninstall, which deletes the wallet on that phone, so make a backup (recovery code and backup
file) first. To get updates without downloading by hand, see docs/android-signing.md (Obtainium).

Which APK? There are two builds of the same app. They have the same name, package and signature, so you can
switch at any time by installing the other one over the app; the wallet stays.

• trikey-alpha-v0.1.19-alpha.apk: the standard build. It contains Google's libraries: QR codes are read with
  Google's ML Kit, and Google Drive backup can be switched on in a later release (it needs Google Play services
  on the phone).
• trikey-alpha-foss-v0.1.19-alpha.apk: no Google code, for phones without Google Play services (GrapheneOS, /e/OS,
  LineageOS) or if you prefer an app without it. QR codes are read with the open source zxing-cpp. It will never
  offer Google Drive backup: the backup is the recovery code plus the backup file, which you can still save to
  Google Drive or anywhere else from the share sheet. Settings, About says "Trikey (no Google)".

Today both do the same: Google Drive backup is not switched on in either yet. Not sure? Take the standard one.

• Pre-alpha, open source, not audited. Test networks only (signet, testnet4). Never put real bitcoin in it.
• Install: download the APK on the phone, open it, and allow installing from this source when Android asks.
• Passkeys and Google Drive backup are not in these builds; the backup is a recovery code plus a backup file.
• Check for updates (Settings, About) offers the APK of the build you have installed.
• How to test it: docs/alpha-test-plan.md in the repository.

Standard: trikey-alpha-v0.1.19-alpha.apk

• SHA-256 bd4643e3b3b713da1b97aff7e3e7114f5beeb81a91c299092680581143da8de5
• 57.8 MB, built for arm64-v8a from commit 03fb397.

No Google: trikey-alpha-foss-v0.1.19-alpha.apk

• SHA-256 e13033d36a956bfeff4d736da5713141b31f91a2844657d7f9d12583a63247e7
• 52.4 MB, built for arm64-v8a from commit 03fb397.
• Checked by the build: no Google Play services, Firebase, ML Kit or data transport code in it.