Skip to content

Starling 0.2.0

Choose a tag to compare

View all tags
@munzzyy munzzyy released this 31 Aug 19:57
· 14 commits to main since this release
v0.2.0
ff3b54d

Starling 0.2.0 is the first Android release: the same app that runs at starlingmap.app, shipped as a native package with the pieces a web page cannot provide.

Android app

  • Background sharing through a while-in-use foreground service, with a persistent notification the whole time it runs. The app never requests background location permission.
  • Fingerprint or face unlock for the app lock, backed by an Android Keystore key that requires a fresh strong biometric per use and dies if a new biometric is enrolled.
  • Panic wipe wired to PanicKit: pair Ripple and a trigger wipes all app data instantly, even with the app locked.
  • Orbot support: per-app VPN mode works with no setup, and a SOCKS toggle routes WebView traffic through Orbot's proxy with no direct fallback.
  • Verified app links, so invite links open in the app.

Everywhere

  • Custom relay setting in the Android app for self-hosters, and CORS on the relay to match.
  • Leaflet is now a lockfile-pinned npm dependency synced unminified at build time instead of a vendored blob.
  • A real disclosure policy in SECURITY.md and an Android section in the threat model.

Verify this build

The APK is signed with the certificate whose SHA-256 fingerprint is served at starlingmap.app/.well-known/assetlinks.json. Release builds are reproducible: npm ci, bash tools/sync-vendor.sh, then ./gradlew assembleRelease in android/ at tag v0.2.0 produces an unsigned APK with sha256 928acad757ef55b800e7536574f479e8eb3fef6972a3716c685806338c0586b6, and apksigner from build-tools 34 with the same key yields this exact file:

075bc281dd87da708bb6671eda7e834e5c681b76439ec6b65c151b2d80139dc5  starling-0.2.0.apk

Build docs: docs/ANDROID.md. Full changes: CHANGELOG.md.

Assets 4
Loading