Second release, and the first one shaped by an outside contribution — thanks to @timcho968 for PR #2.
Updating from 1.228
No reinstall needed. The signing key was rotated in this release, which normally breaks in-place updates. It does not here: the new certificate is carried by a SigningCertificateLineage, so Android 13+ verifies against the new key while older versions keep validating against the previous one. Just install over your current version.
What's new
Webapp mode — pin any site to your home screen and it opens as a fullscreen window with no address bar, in its own task. Re-tapping the shortcut returns to the same window. Ad blocking and downloads work inside it.
Downloads — handled through the system DownloadManager, with a progress notification and files landing in Downloads. Also fixes APK links served without a Content-Disposition header.
Ad popup blocking — window.open calls to domains the engine flags as popups no longer open a window, in both the browser and webapp mode. You get a short toast instead.
Russian filter lists on by default — AdGuard Russian and RU AdList, bringing the catalog to 14 lists. Existing installs pick them up automatically, no manual step.
Privacy — browsing history, bookmarks and open tabs no longer go into Google cloud backup or device transfer; only the settings file does. The Private tab now honestly states that cookies and logins are shared with regular tabs, rather than implying isolation it does not provide.
Interface — Jelly-style bottom bar (Home / Address / Reload / Tabs / Menu), a thin progress bar over the page, edge-to-edge layout with proper insets for cutouts and keyboard, and a reload button that turns into stop while loading. Fullscreen video keeps and restores scroll position.
Performance — lazy image loading, renderer priority tuning, and an optional turbo mode with per-site profiles.
Full list, in Russian and English: CHANGES.md
Signing
Releases up to 1.228 were signed with the Android debug key, whose password is publicly known — anyone could have signed a fake Orbit update. From 2.0.0 the app is signed with a real RSA-4096 key held only by the maintainer.
New certificate SHA-256:
59:17:B8:A8:61:3A:AF:B3:BA:6D:C3:87:BE:CF:D9:CD:E5:E0:65:15:C2:01:4C:6F:BB:D6:99:6E:F1:45:43:CB
Because minSdk is still 21, devices below Android 13 continue to validate against the old certificate through the v1/v2 signature blocks. That transition completes when minSdk is raised. Details: docs/pipeline/brief.md
Which APK
| File | For |
|---|---|
orbit-2.0.0-arm64-v8a.apk |
most phones from roughly 2016 onward (64-bit ARM) |
orbit-2.0.0-armeabi-v7a.apk |
older 32-bit ARM devices |
orbit-2.0.0-x86_64.apk |
emulators and x86 Chromebooks |
orbit-2.0.0-universal.apk |
all of the above in one larger file, if unsure |
Requires Android 5.0 (API 21) or newer.
Checksums
e29da5c2fe2c398ac8a6a287f867da158194ce4e5bb7854242944a6738bf23de orbit-2.0.0-arm64-v8a.apk
da13c4903c5cc1668ed7df5a0e039e5cb7b8a5049709e667744087413858ae75 orbit-2.0.0-armeabi-v7a.apk
e7bd4d7cd79cfb597b2e4cf97d8a02024cde9ac013a69c7d85233c5c9e0771e6 orbit-2.0.0-universal.apk
1e366753b969db4193af51015e7a2a2b9c6f85c0e79322f12c800ca79a0ad72d orbit-2.0.0-x86_64.apk
