Cordial 0.8.0 — it fetches Roblox itself, and you can finally download it

Cordial 0.8.0 — it fetches Roblox itself, and you can finally download it

Two things changed that a user would notice. Cordial now obtains the Roblox
build on its own, verified, from a button; and this is the first release that
carries a file you can download.

The startup freeze is not fixed. It is worse understood than it was, which
is not the same thing, and §What is still broken says exactly where it stands
including two fixes that were announced and retracted in a single day. Read it
before installing if you are signed in.

Cordial downloads Roblox

Press Download Roblox on first run and it fetches the Android build, checks
it, and starts. No second program, no manual APK, nothing to find.

What it checks, because "download" should not mean "trust whatever arrives":

• The archive must be signed by Roblox's own signing certificate. A mirror that
  alters a byte is refused, not used.
• An archive whose v3 signature has been stripped to force the weaker v2 path
  is refused too. That attack works by deleting the newer signature block and
  relying on the verifier to fall back quietly; the scheme-3 stripping
  attestation (0xbeeff00d) is now read and a claimed-but-missing scheme is a
  refusal.
• Downloads never land anywhere that belongs to another application. A build
  found in Sober's directory is read where it lies and never written to.

If you already have Sober, nothing changes and nothing is pressed — Cordial
finds that build and uses it in place.

The mirror is APKPure and it is a third party: it can be down, and it sees who
asked. That is why it is a button rather than something that happens to you.

You can download Cordial

AppImage, .deb, .rpm and an Arch package, built in CI on every push and
attached to this release.

Until now every release carried nothing at all. The Flatpak workflow did know
how to attach a bundle on a tag, but every run it ever had was a push to
main, so that path had never once fired.

The AppImage is the one to take if your distribution is not in that list, or if
you would rather not add a third-party Flatpak remote. It installs nothing.
It is also the least proven artifact here — see below.

Flatpak remains the recommendation for anyone without a reason to prefer
otherwise: it is sandboxed and it updates itself.

Updates

• The updater reports the newest build compatible with your machine, not
  the newest build the mirror happens to hold. An announcement you cannot run
  is not an update.
• The update badge clears once you have installed the update, rather than
  staying lit at something you already did.
• Cancel a download and Cordial remembers where you stopped.
• Cordial notices when the installed build changed underneath it, so a build
  that arrived from elsewhere is no longer invisible to the updater.

Audio

An OSS backend joins PipeWire, PulseAudio and ALSA, selected with
CORDIAL_AUDIO_HOST. It was asked for and the asking was the condition.
PipeWire remains the default and is the one measured against a control.

Plugins

A core event bus: Cordial publishes what it observes — launches, joins,
updates — and a plugin may listen. It may not veto, delay, or alter anything,
by construction rather than by policy. Building it found two bugs in the
existing plumbing, which is the usual argument for building a thing properly.

Smaller things you might hit

• Cordial says when the disk is nearly full. A game that dies because it
  could not write used to say nothing, anywhere, and the engine will not
  mention it either.
• Ctrl+V no longer pastes twice.
• A password box now tells input methods that it is one.
• The settings and update windows moved off a deprecated libadwaita window
  type; the update dialog follows the HIG for progress rather than swapping the
  button out from under you.
• NOTICE now ships in every package. third_party/mocktail-webview/ is
  Apache-2.0 material and §4(d) requires that file to travel with binary
  distributions; no package built before this one included it. That was a
  licence compliance gap in everything shipped to date.

What is still broken

The startup freeze, on a signed-in profile. The client opens, reaches the
signed-in home screen, presents one frame and then spins. It is not fixed.

What is now known: it is render-side and happens after the app is ready — the
engine reports reaching its root screen in frozen runs too. It correlates
strongly with machine load. Across forty-five interleaved runs, eighteen
consecutive launches were healthy at a load average of 0.66 and twenty-one of
the next twenty-seven froze between 1.9 and 3.8 (p = 7.9e-08), across every arm
at once.

Two fixes were announced and withdrawn on 2026-08-27. One "cured" it by not
rendering at all — photographed, a blank grey window, which the survey scored
healthy because its verdict counts presented frames and an empty surface
presents faster than a real one. The other measured p = 0.0005 against a
control taken an hour earlier and p = 1.00 against one measured beside it.
Both are recorded rather than quietly deleted.

If you are hit by it, closing and reopening usually works, and a machine that
is not otherwise busy freezes far less.

A black canvas inside an experience. Joining works; what you see once you
are there frequently does not.

Voice chat does not work. The uplink is hooked and the microphone stays
shut; there is no downlink.

No gamepad or controller support. None, rather than partial. The engine
exports the natives and nothing here calls them yet.

The AppImage's web view is unconfirmed. It bundles WebKitGTK's helper
executables by hand, because they are spawned rather than linked and the
standard tooling does not follow them. If the sign-in window comes up blank,
that is why — the Flatpak is unaffected, and it is worth reporting rather than
assuming Cordial is broken.

Nothing is signed. Not the Flatpak remote, not any of the four new package
formats. What that does and does not protect you from is in the README, and it
is not hidden.

Thanks

Sober, again and specifically. Its issue tracker is why several bugs here were
recognised instead of investigated, its APK path is why Cordial finds a build
you already have, and it went first while it was much harder. No Sober code was
taken and none could be.