Skip to content

5.1.3

Choose a tag to compare

View all tags
@jegly jegly released this 25 Oct 06:03
· 21 commits to main since this release
Immutable release. Only release title and notes can be modified.
5.1.3
9f8d34e

OfflineLLM 5.1.3

Post-quantum signed release, large-heap support, and updated dependencies.

New

  • Large heap enabled (android:largeHeap), giving the app more memory headroom when loading bigger models. The change landed upstream with a malformed manifest entry; that is fixed here so release builds work.

Security

  • Post-quantum hybrid signing. Release APKs are now signed with APK Signature Scheme v3.2: the original app key plus an EC P-384 key and an ML-DSA-87 post-quantum key. Android 17 and newer verify the hybrid block, where the ML-DSA-87 key is the signer; earlier versions verify the original key as before.
  • Tamper check updated for the new signing: it checks the current signer only, accepting the ML-DSA-87 key on Android 17+ and the original key below. Expected digests are stored obfuscated and compared as raw bytes.

Changed

  • Dependencies and build tooling updated; Gradle 9.8.2. The native llama.cpp/Vulkan library is built with NDK 27.2.
  • Build-time tooling pinned to patched releases of Netty, Bouncy Castle, jdom2 and jose4j (Dependabot alerts on the build classpath; none of this ships in the APK).

Requires Android 13+ and arm64-v8a. Bring your own GGUF model.

Verify

OfflineLLM-5.1.3-PQC-signed.apk
SHA-256: 0f2460fc339f017dbfeea694cf1caaede215aaded6715b8ca0f6eaebccba4092

sha256sum OfflineLLM-5.1.3-PQC-signed.apk
apksigner verify -v --print-certs OfflineLLM-5.1.3-PQC-signed.apk   # build-tools 37.0.0 on JDK 25 shows all three keys

Signing certificate SHA-256: ML-DSA-87 5f99de5b3195753d4fe8ddabebd2fb27356b2109d6fbb2471fcbbdf21a9e76a6, EC P-384 fa8f4a07e6a4f2b7dc6e5ab31fc05592b1414ab9436d1e2e39b35ce3bb2e33a2, original key 98d324d4106a368c62729a0a24d9ac9a6b47f8ac4c6585348531f0ee4eb6a04c.

Assets 4
Loading