Night Drop 0.1.18

Night Drop can now tell you when a newer release exists and fetch it for you, over Tor, from its own onion site. Until now the only way to learn about a security fix was to go looking — which is exactly the gap that left Linux users on 0.1.15 for three days.

What changed

The app checks for updates over Tor, and only over Tor. It asks our own .onion for a small manifest, at most once a day, and compares versions on your device. The request carries no version, no identifier, no cookie and no varying header, so the site cannot tell one user from another or a first check from a hundredth. There is no clearnet path in the code at all: a connection that cannot be made anonymously is skipped, not downgraded.

Tapping the notice downloads that build and checks it before you ever see it. The file is streamed to disk rather than held in memory, hashed against the SHA-256 the site published, and only then moved into your Downloads folder — so a file you can see is always one that passed verification. It reaches the public Downloads folder without the app holding any storage permission. A progress bar shows how far along it is, and the download keeps running with the screen off; it survives Doze on a Samsung, which is where we tested it.

Nothing installs itself. The app hands you a verified file and stops. Android checks the signature and asks you, which is the right place for that decision to live, and it refuses anything not signed by our release key.

A failed check now says so. "Update app" used to report Night Drop is up to date when it simply could not reach the site — a confident lie on the one screen where you deliberately asked, hiding the very fix the feature exists to surface. It now distinguishes the two.

The main Android download installs over per-ABI builds again. The universal APK carried a version code below the per-ABI builds of the same release, so Android treated it as a downgrade and refused it. Anyone who installed from F-Droid — or through the new in-app updater, which fetches the build matching your device — got "App not installed" from the site's primary download with nothing to explain why. Fixed, and it stays ordered correctly from here.

Verifying this release

gpg --import nightdrop-signing-key.asc
gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum -c SHA256SUMS

Fingerprint: 079B A016 9201 A8AB 11F3 2385 884E ACB8 89D0 2002

The three per-ABI APKs are built by the F-Droid recipe in fdroid/app.nightdrop.yml at commit 37cbf9b, so they can be reproduced independently.