AgePony 3.0.2

AgePony 3.0.2

Post-quantum encryption arrives in AgePony. This release adds quantum-safe hybrid keys, fuses encryption and signing into one action, and ships a migration tool to bring your existing files forward. It is also the first fully open-source, reproducible build ready for F-Droid. Everything still runs entirely on your device.

Highlights
Post-quantum hybrid encryption

AgePony can now generate and use quantum-safe recipients built on the standardized ML-KEM-768 + X25519 hybrid (X-Wing). Files encrypted to a quantum-safe recipient stay protected against "harvest now, decrypt later" attacks, while remaining fully interoperable with the age command-line tool (v1.3.0 and later).

New key type generated in the vault alongside classic X25519 keys.
Quantum-safe recipients use the age1pq... prefix; identities use AGE-SECRET-KEY-PQ-....
Uses the mlkem768x25519 stanza per the C2SP age specification.
Clear "Quantum-safe" badges and algorithm labels throughout the UI, so you always know the protection in use.
A no-mixing rule keeps quantum-safe and classic recipients from being combined by accident on a single file.
Encrypt and sign in one action

Encryption and SSH signing are now a single step. AgePony signs your plaintext, bundles the payload with its signature, and encrypts the bundle, so the signer's identity stays hidden inside the ciphertext. On the way back, decryption verifies the signature and shows you the trust result before revealing the file.

Sign with an SSH Ed25519 key using the SSHSIG standard.
New SSH Ed25519 key generation added to the key menu.
Single encrypted output file; no separate detached signature to manage.
Upgrade to quantum-safe migration tool

A built-in migration tool re-encrypts your existing files to a new quantum-safe identity in batches. Your originals are kept until each new copy is verified, so nothing is lost in the process.

Batch re-encrypt files and notes to a chosen quantum-safe identity.
Optional shared passphrase for the re-encrypted set.
Results are marked quantum-safe once complete.
Fixes
Decryption output no longer keeps a trailing .age extension. Files like report.pdf.age now decrypt to report.pdf, and chained extensions are handled correctly.
F-Droid and open-source build

This release ships a foss product flavor with no Google dependencies, so AgePony builds fully open-source for F-Droid. The proprietary Google Play In-App Review library is scoped to the play flavor only, the APK drops the Google dependency-metadata block (dependenciesInfo.includeInApk = false), and the build is reproducible: it pulls no JDK toolchains over the network and embeds no build-machine VCS metadata, so it verifies byte-for-byte against F-Droid's clean-room build.

Compatibility
Files encrypted to quantum-safe recipients require an age implementation with post-quantum support (age v1.3.0+ on desktop, or AgePony 3.0.2 or later).
Classic X25519 recipients, passphrase encryption, and SSH recipients are unchanged and fully backward compatible.
Android minSdk 26 (Android 8.0) and above.
Notes
Quantum-safe crypto was verified byte-for-byte against the filippo.io/hpke reference vectors.
All encryption, decryption, signing, and key generation happen locally on device. No accounts, no servers, no tracking.

Full changeset: fd49cb3 (tag v3.0.2)