Fonte 0.1.7

An APK name filter from an imported list can no longer slow down the checks, and imported certificate pins get a stricter rule.

Requires Android 15 or later. The APK has no native code, so it runs on all ABIs. Update from 0.1.6 in place: the signing key is the same. If an app finds no APK after the update, its name filter is now used as plain text: make the filter shorter, with 6 or fewer repeats, "?" and "|" together.

Changed

• The APK name filter check is stricter. A filter with more than 6 repeats, "?" and "|" together, or a repeated group with a "?" in it, is now used as plain text, not as a regex. Usual filters such as (arm64-v8a|armeabi-v7a|x86_64|x86|universal|noarch) and (?i)^app-?(?:foss)?-?release\.apk$ stay regexes.

Fixed

• No change.

Privacy and security

• Filters with text that the check cannot read correctly (\Q, \c, (?#, the x flag, a [ in a class, a ] at the start of a class) are now plain text. Before, such a filter could hide a slow regex from the check and stop the checks of all apps.
• Fonte ignores release files with a name longer than 200 characters.
• An imported list can pin a certificate only for an entry that names the package. Without a package name, Fonte pins the certificate at the first install, as for a new app.

File	Use
Fonte-0.1.7.apk	Release build, signed.

SHA-256:

• Fonte-0.1.7.apk: 2385bd25f4106dc9fab48033c9538401d48f3417b679f491f567250563632048

Signing certificate SHA-256: cc:15:4a:2b:16:d1:b2:02:1f:23:37:24:05:49:34:16:2b:f2:98:0e:16:16:72:64:0a:6e:0f:38:8c:36:ff:a4

Check the certificate with apksigner verify --print-certs Fonte-0.1.7.apk or with AppVerifier. Do not install an APK with a different certificate.

Fonte 0.1.6

Brave and other repositories that publish all their channels together no longer update to a nightly or beta build.

Requires Android 15 or later. The APK has no native code, so it runs on all ABIs. Update from 0.1.5 in place: the signing key is the same. If Fonte already installed Brave Nightly for you, Fonte refuses the stable Brave APK, because it is a different app. Then remove Brave from Fonte and add it again.

Changed

• A GitHub release whose title names a pre-release channel, such as "Nightly", "Beta" or "rc", is now a pre-release, also when the repository does not flag it.
• A channel word counts only as a full word in tags and titles. Titles such as "Preferences" or "Devices" do not count, and 1.0-prerelease does.

Fixed

• With pre-releases off, Fonte could find a Brave Nightly build as the latest release and install it. Brave does not flag all of its nightlies as pre-releases on GitHub. Now Fonte reads the release title, and it finds the stable release.

Privacy and security

• No change. Fonte sends the same requests as before.

File	Use
Fonte-0.1.6.apk	Release build, signed.

SHA-256:

• Fonte-0.1.6.apk: 039d68dab2456510b5b17b9e069a5e706342e368ba4878832c05ee0c9d11e53d

Signing certificate SHA-256: cc:15:4a:2b:16:d1:b2:02:1f:23:37:24:05:49:34:16:2b:f2:98:0e:16:16:72:64:0a:6e:0f:38:8c:36:ff:a4

Check the certificate with apksigner verify --print-certs Fonte-0.1.6.apk or with AppVerifier. Do not install an APK with a different certificate.

Fonte 0.1.5

Downloads that you start continue in the background, you can now add Brave (stable), and automatic installs wait for an unmetered network by default.

Requires Android 15 or later. The APK has no native code, so it runs on all ABIs. Update from 0.1.4 in place: the signing key is the same. After the update, Fonte keeps your network setting. If you want automatic installs to wait for an unmetered network, turn on Download only on unmetered networks in Settings. If the old switch was on, it stays on, and checks now use all networks.

Changed

• Downloads that you start with Update or Update all continue when you go to a different app. A progress notification in a new quiet "Downloads" channel shows the download. Before, Android could pause Fonte, and the download failed with "Download stalled".
• By default, automatic installs download only on an unmetered network, such as Wi-Fi. On a metered network, the update goes to the "updates available" notification. A later background run on an unmetered network installs it. Checks use all networks. The switch is now Download only on unmetered networks. Before, it also stopped the checks.
• At a first install from F-Droid or IzzyOnDroid, Fonte shows the progress of the signed index download, for example "Checking the F-Droid index 40%". Before, the row showed "Installing…" with no progress, so the install could look stuck.
• With no GitHub token, the automatic check when you open Fonte skips GitHub apps that it checked in the last hour. This saves the GitHub limit of 60 requests an hour. Pull to refresh and the background job check all apps.
• Fonte does less work at a cold start. It reads the installed apps one time, not three times, and it does not load their labels. Fonte now builds and sorts the app list on a background thread.
• TalkBack reads each switch row as one switch, with its title, subtitle and state.
• The home screen has a Check for updates accessibility action on the top bar subtitle. It starts the same check as pull to refresh, for Switch Access and TalkBack.
• The What's new card tells TalkBack "Expand" or "Collapse". A tap opens the card only when the notes are too long to show fully.
• Build: Fonte reads the signing passwords from the Keychain only for a signed release build. The key script stops if the Keychain items are missing. The dependency checksums are complete for a build with an empty cache. Google Maven supplies only Android and Google libraries. Five copies of a library licence text (about 18 KB) are no longer in the APK.
• Internal: more unit tests (install checks, token redirect rule, GitHub limit answers), StrictMode in debug builds, and one shared import function.

Fixed

• You can now add Brave (stable). Brave publishes many nightly and beta builds as GitHub pre-releases. Thus the 10 newest releases were sometimes all pre-releases, and Fonte found no release. Now, if this occurs and pre-releases are off, Fonte reads one more page: the latest stable release. For other repositories, Fonte sends the same single request as before.
• When GitHub refused your token (expired or revoked), all GitHub apps stopped updating, also Fonte. Settings still said "Set". Now Fonte checks again without the token and sends no token until you save a new one. Settings shows "Refused by GitHub", and Fonte posts one quiet notification in a new "GitHub token" channel. Fonte remembers the refusal after a restart and shows the notification only one time for each refused token.
• Version tags that are dates, such as 2024-11-01, compare as full dates. Before, Fonte read only the year. Thus a newer release could look the same or older, and the update did not show.
• One entry that Fonte cannot read, for example an unknown source kind, no longer empties the app list. Fonte skips only that entry. Before the next save, it keeps a copy of the full file. Each copy has a timestamp in its name, so a new copy does not replace an older copy.
• A source that sends a broken answer no longer puts that answer (up to 8 MiB) into the app list and on the screen. Parser errors show one fixed text. Fonte cuts other error texts to 200 characters.
• The "updates available" notification changes when you install updates in Fonte. Before, it could show an old count for up to 24 hours. If you removed the notification, it does not come back.
• Before the first check, the detail screen shows "Not checked yet" for the latest version, not "Not found".

Privacy and security

• Certificate transparency is on for all connections. On Android 16, Fonte now refuses a certificate that is not in the public certificate logs. Android 17 does this check already.
• An APK name filter (regex) that could run for a very long time is now used as plain text, not as a regex. Such a filter can come from an imported list, and it could stop the checks of all apps. The test is a heuristic: it applies to a filter with more than 200 characters, a backreference, more than 4 repeats, or a repeated group with a repeat or | in it.
• The token sheet tells you that Fonte sends the token with each GitHub check, so GitHub can link these checks to your account. For a refused token, Fonte keeps only its SHA-256 hash, not the token.
• The README tells more about the network requests. A GitLab, Forgejo or Gitea release can link its APK on a different host. Fonte checks imported sources immediately. A source can use the stored ETag to see that two checks come from the same phone. F-Droid update checks use an API that has no signature, but the pinned certificate still protects each install.
• Fonte declares one new permission, "run user-initiated jobs", for the downloads that you start. Android gives it at install, with no prompt.

File	Use
Fonte-0.1.5.apk	Release build, signed.

SHA-256:

• Fonte-0.1.5.apk: 3d6e2f6d95ce8d6f86641bdc412a5b7427b78a680b66208db0bd089f207957b8

Signing certificate SHA-256: cc:15:4a:2b:16:d1:b2:02:1f:23:37:24:05:49:34:16:2b:f2:98:0e:16:16:72:64:0a:6e:0f:38:8c:36:ff:a4

Check the certificate with apksigner verify --print-certs Fonte-0.1.5.apk or with AppVerifier. Do not install an APK with a different certificate.

Fonte 0.1.4

A read error of the app list no longer stops Fonte at each start, and Fonte no longer asks for a Play Services emoji font.

Requires Android 15 or later. Update from 0.1.3 in place: the signing key is the same.

Fixed

• When apps.json could not be read at start for a reason other than "no file" (for example a storage error), Fonte stopped at each start. Now Fonte keeps the file aside as apps.json.unreadable and opens with an empty list, as for a damaged file.
• A list file that exists but cannot be opened is no longer treated as missing. Before, the next save replaced it.

Privacy and security

• Fonte no longer asks for a downloadable emoji font. On a phone with Google Play Services, that request went to the Play Services font provider. Fonte uses the system emoji font.

File	Use
Fonte-0.1.4.apk	Release build, signed.

SHA-256:

• Fonte-0.1.4.apk: 48202f4ab3b5d4bb6e5e8ff7b722b6cd7eea5334c1817c56ee0057a4febf2c0b

Signing certificate SHA-256: cc:15:4a:2b:16:d1:b2:02:1f:23:37:24:05:49:34:16:2b:f2:98:0e:16:16:72:64:0a:6e:0f:38:8c:36:ff:a4

Check the certificate with apksigner verify --print-certs Fonte-0.1.4.apk or with AppVerifier. Do not install an APK with a different certificate.

Fonte 0.1.3

Export reports a failure that it hid, and the log keeps less.

Requires Android 15 or later. Update from 0.1.2 in place: the signing key is the same.

Fixed

• Export: when the storage app gave no file to write, Fonte showed "Exported N apps" and wrote nothing. Now Fonte shows an error, so that you do not trust an export that is not there.

Privacy and security

• Warnings in the system log keep only the type of the error. The install warning no longer names the app, and error messages can contain URLs.

File	Use
Fonte-0.1.3.apk	Release build, signed.

SHA-256:

• Fonte-0.1.3.apk: 1f51e33e6b48845fa7baf4d8df9fb0614a11c30437eccdcd4b756dd293191b92

Signing certificate SHA-256: cc:15:4a:2b:16:d1:b2:02:1f:23:37:24:05:49:34:16:2b:f2:98:0e:16:16:72:64:0a:6e:0f:38:8c:36:ff:a4

Check the certificate with apksigner verify --print-certs Fonte-0.1.3.apk or with AppVerifier. Do not install an APK with a different certificate.

Fonte 0.1.2

Fonte updates itself, a guide for the GitHub token, and the list opens at the top. Update from 0.1.1 in place: the signing key is the same.

Fonte updates itself

• Fonte is always in its own list (GitHub Turtlecute33/Fonte) and updates like the other apps. Fonte adds the entry at start, and pins the certificate of the installed Fonte.
• The update of Fonte itself goes after the other downloads and installs, because it closes Fonte.
• If you added Fonte to the list before, Fonte keeps your entry.

GitHub token

• Settings > Access token now shows the steps to make a fine-grained token, for public repositories only or for private repositories too.
• "Create token on GitHub" opens GitHub's form with the name, a one-year expiry and, for private repositories, the "Contents: Read-only" permission already set.

Fixes

• The app list now opens at the top. Before, it often opened at "Not installed", and new updates could appear above the visible part of the list.

Verify

	SHA-256
Fonte-0.1.2.apk	ba343a39edae1c4bf10ec1f85cc733ed4f889d1dfebfbd754f221e9e2bf2d260
Signing certificate	cc154a2b16d1b2021f233724054934162bf2980e161672640a6e0f388c36ffa4

Check the certificate with apksigner verify --print-certs Fonte-0.1.2.apk or with AppVerifier. Do not install an APK with a different certificate.

Fonte 0.1.1

Security fixes, private GitHub repositories and a new icon. Update from 0.1.0 in place: the signing key is the same.

Security

• First install from F-Droid or IzzyOnDroid: the APK must be in the repo's signed index. Fonte checks the index with the repo key that the F-Droid client also uses. Updates do not need this step, because the pinned certificate protects them.
• Release notes from a hostile source can no longer slow down the update checks.
• "Open the source page" opens only https web pages.
• Import: the certificate of an installed app wins over the pin in the file. Fonte accepts only valid pins, and sources that pass the same checks as a pasted link.
• "." and ".." are not accepted as owner or repository names.
• Build: the Gradle download checksum is pinned, and Gradle checks the SHA-256 of every dependency.

Private GitHub repositories

• With a token, Fonte downloads APKs through the GitHub API, so private repositories work. The token still goes only to api.github.com.
• A fine-grained token needs read-only access to "Contents" of the private repositories. When GitHub cannot find a repository, the error message now says this.

Other

• New icon: the drop only, without the arrow.

Verify

	SHA-256
Fonte-0.1.1.apk	799f27e2a60ffdd32431c33280737e85cb793156021674cbe041d6cc582fda0a
Signing certificate	cc154a2b16d1b2021f233724054934162bf2980e161672640a6e0f388c36ffa4

Check the certificate with apksigner verify --print-certs Fonte-0.1.1.apk or with AppVerifier. Do not install an APK with a different certificate.

Fonte 0.1.0

First release of Fonte, a private and minimal app updater for Android 15 and later.

What it does

• Installs and updates apps from GitHub, GitLab (also self-hosted), Codeberg, Forgejo and Gitea, F-Droid and IzzyOnDroid.
• Picks the APK for your processor. Optional name filter and pre-releases.
• Background checks every 3, 6, 12 or 24 hours. Apps that Fonte installed update silently while you do not use them; other apps ask once through a notification.
• Imports your Obtainium export. Share a repository link from the browser to add an app.

Security and privacy

• No native code, no WebView, no dynamic code loading: made for GrapheneOS with "Restrict dynamic code loading" on.
• APK checks before install: GitHub SHA-256 digest, package name, pinned signing certificate (key rotation is followed).
• HTTPS only with system CAs. No analytics, no Google Play Services, no account, no backups.

Install

Android 15 or later. After the first start, allow Fonte to install apps.

Verify

	SHA-256
Fonte-0.1.0.apk	d3185d8bfae2206c1e82e892688e0ca31cefb6d594dc06cb8f28a0506876c469
Signing certificate	cc154a2b16d1b2021f233724054934162bf2980e161672640a6e0f388c36ffa4

Check the certificate with apksigner verify --print-certs Fonte-0.1.0.apk or with AppVerifier. Do not install an APK with a different certificate.