Velta v1.5.5

What's changed in Velta v1.5.5

Full changelog: v1.5.4...v1.5.5

Added

• Liquid glass composer (opt-in, Chat appearance): on Windows and Android the message field can bend the chat behind it like a frosted glass plate. Off until you turn it on; macOS and the browser PWA keep the solid field.
• Playback speed: a 1×/1.5×/2× button on voice and audio players (chat bubbles and the gallery player). The choice is remembered across messages and syncs through settings transfer.
• Sending in the background (Android): when a message is still uploading and you background the app, a silent "Sending…" notification appears until the outgoing queue drains. The send itself always continued; the card now shows it. It appears when the background-connection service already keeps the process alive (the default setting).
• Category chips in the forward and share pickers (#294): All / People / Groups / Channels / Bots / Saved filter the target lists — the same buckets as the main chat list's bar.
• Haptic ticks on swipes (Android): a short vibration confirms crossing the reply and back thresholds.
• Message info: last app update: for webxdc apps, the info dialog shows when the app last received a status update.

Fixed

• Pinned messages tray: updates instantly when a pinned message is unpinned or deleted. The tray's event was wired to core event kinds that never existed on the wire, so until now it only refreshed on the next unrelated chat event.
• Translations completed: the remaining confirmation dialogs and toast notifications are translated — the French and Russian packs now cover the whole UI.
• Text-only Auto covers only unaccepted 1:1 contact requests, never group senders; plain text without real attachment metadata stays a normal text bubble (#310, #311).
• Channel invitations: Invite via link/QR is offered only for owned outgoing channels — incoming subscriptions and mailing lists no longer get an action the core cannot fulfill (#312, #313).
• Chat-list startup: a startup crash caused by reading collapse state in its temporal dead zone is fixed (#282, #306).
• Relay invites: an invite with no expiry date lasts 48 hours, and a failed PWA signup gives its use back so it can be retried.
• PWA: static installs no longer assume their own host relays mail — the page-host WebSocket proxy is opt-in per build (#307); web publication stops when the onboarding verification keys are missing instead of publishing unverifiable invites (#308).
• Linux packages are actually attached: v1.5.4's release job built but never published the .deb, AppImage, and Arch package. v1.5.5 attaches them (glibc 2.36 or newer: Debian 12, Ubuntu 23.04, Arch). Linux does not self-update yet.

Changed

• Messaging core 2.69.0 (v1.5.4 shipped 2.66.0). No database migration. The pick-up matters most for one fix: webxdc apps are no longer sometimes received as plain files. Secure-Join prefers the vc- prefix where accepted, long messages truncate at load time instead of save time, and marking messages seen queues read receipts in one transaction. Velta's quilt stays 200 operations across 37 files, re-anchored onto the new tree and clean under rustc 1.98's clippy.

• The archived DNS-tunnel library (replaced by the SOCKS5 proxy in v1.5.0) is removed from the source tree together with its deploy script and docs. Saved proxies and settings transfer are unaffected.

• fix(invite):
  keep the mailbox helper when reserving a claim (4dc9d82)

• fix(invite):
  default 48h expiry and retry a failed PWA signup (f74d5c0)

• fix(ui):
  scope text-only Auto to 1:1 requests (58f4c12)

• fix(pwa):
  preserve onboarding public keys in web publishes (f622e0f)

• fix(ui):
  avoid listCollapse TDZ in renderChatList during app evaluation (5fcf37f)

macOS (test build)

Velta_<version>_universal.dmg runs on Apple Silicon and Intel Macs (macOS 10.15+). It is not notarized (no Apple Developer ID yet), so macOS blocks the first launch:

1. Open the DMG and drag Velta into Applications.
2. Remove the download quarantine once, in Terminal:
   xattr -dr com.apple.quarantine /Applications/Velta.app
   — or try to open Velta, then go to System Settings → Privacy & Security and click Open Anyway (macOS 15 no longer offers right-click → Open for this).
3. macOS asks for microphone/camera access on first use (calls, QR scanning). With the ad-hoc signature it may ask again after an update.

Linux (x86_64, glibc 2.36+)

Built on a Debian 12 base: every binary requires at most glibc 2.36, so the packages run on Debian 12, Arch (rolling) and any newer distro. Linux self-update is not wired yet — install once, then update by downloading the new release.

• Debian 12+ / Ubuntu 23.04+: sudo apt install ./Velta_<version>_amd64.deb
• Arch: sudo pacman -U velta-bin-<version>-1-x86_64.pkg.tar.zst (repackaged from the same .deb; not published to the AUR)
• Anything else (glibc 2.36+): Velta_<version>_amd64.AppImage — chmod +x and run; requires webkit2gtk-4.1 from the host (sudo pacman -S webkit2gtk-4.1 on Arch, libwebkit2gtk-4.1-dev on Debian).

Velta v1.5.4

What's changed in Velta v1.5.4

Full changelog: v1.5.3...v1.5.4

Added

• Windows Hello, working end to end (Windows): enabling Hello no longer fails with create 0x80090027 — the database key is now held through the system KeyCredentialManager surface (direct NGC key creation is fenced to OS components on current Windows), and the Hello prompt comes to the front on its own instead of opening behind the app. The app-lock PIN can remain as the other way in.
• Text-only mode (Privacy & security): hide attachments and link previews for unknown senders (default), everyone, or nobody — each hidden item reveals on tap until you trust the chat. Fail-closed: anything it cannot classify counts as unknown.
• Show in folder (desktop): the message context menu reveals an attachment's file in the file manager.
• Relay send failover: the Relays dialog shows what the last send attempt did, and an optional strict mode keeps sending on the pinned relay only.
• Invited PWA onboarding: an invite link walks through account creation and lands with the relay already configured.
• Roaming hint (Android): while on data roaming, Velta suggests Text-only mode once per roaming episode — it never switches anything on its own.
• Linux packages: .deb, AppImage and Arch (PKGBUILD repackaging the .deb); the bundled core ships as velta-rpc-server so it cannot clash with distro deltachat-rpc-server packages.

Fixed

• Privacy & security claimed attachments "stay unencrypted" — they have been encrypted with the database key since #184 (thumbnails and upload staging included). The note now says so; the unencrypted wording remains only for sessions without an OS keychain, where nothing is encrypted.
• Relays: a boot-time crash when the failover log was created before module init.

Security

• Attachment encryption at rest is out of preview: native profiles encrypt blobs, thumbnails and upload staging (VLTA: per-file wrapped keys, seekable 64 KiB chunks). Windows Hello holds the database key through a hardware-backed Hello credential; the app-lock PIN and Windows Hello can each be the key root.

• fix(linux):
  build on Debian 12 and gate packaged GLIBC requirements (475688b)

macOS (test build)

Velta_<version>_universal.dmg runs on Apple Silicon and Intel Macs (macOS 10.15+). It is not notarized (no Apple Developer ID yet), so macOS blocks the first launch:

1. Open the DMG and drag Velta into Applications.
2. Remove the download quarantine once, in Terminal:
   xattr -dr com.apple.quarantine /Applications/Velta.app
   — or try to open Velta, then go to System Settings → Privacy & Security and click Open Anyway (macOS 15 no longer offers right-click → Open for this).
3. macOS asks for microphone/camera access on first use (calls, QR scanning). With the ad-hoc signature it may ask again after an update.

Velta v1.5.3

What's changed in Velta v1.5.3

Full changelog: v1.5.2...v1.5.3

Added

• Pure black (AMOLED) (Theme, dark only): main and chat backgrounds become #000; headers, menus and the composer stay slightly grey. Checked against WCAG AA in every theme.
• Stickers in attachments menu (Chat appearance, off by default): hides the composer sticker button and adds Stickers to the attachments menu. The reply you are writing is kept.
• Collapsible chat list on wide windows: the chevron above the Menu button or Ctrl+B (⌘B) slides the list out; while collapsed the button shows the unread count. Narrow and portrait layouts are unchanged.
• Open documents in the default app (#279, part one): tapping a pdf, docx, txt or other file opens it in the system app — desktop and Android through a decrypted temporary copy with the original name; on Android, "No app can open this file" offers Save as…. The PWA opens pdf/text in a new tab and downloads the rest. Images, video, audio, webxdc and HTML keep their in-app viewers. "Show in folder" is still to come.

Fixed

• Desktop opened the encrypted attachment file (hash name) instead of the document when database encryption was on.
• Stickers and apps keep the active reply (#264). Quote and forward markers are matched case-sensitively, so a webxdc no longer counts as a reply (#263).
• Webxdc info lines show the sender as a profile chip (#265).
• @mention picker: shows a loading row, lists letters first in big chats, uses custom avatars and refreshes when members change (#266).
• Browser (PWA) core: attachments round-trip again and a timer trap is gone (#261).
• The empty chat pane's subtitle meets WCAG AA contrast.

Removed

• The article card (#252) is not part of this release; it stays on its own branch.

Security

• Android: profile data encryption as shipped in 1.4.89. Desktop and PWA: preview. Attachment encryption at rest: work in progress.

• feat:
  send an article opening, filter diagnostics, encrypt pasted images (5a85615)

macOS (test build)

Velta_<version>_universal.dmg runs on Apple Silicon and Intel Macs (macOS 10.15+). It is not notarized (no Apple Developer ID yet), so macOS blocks the first launch:

1. Open the DMG and drag Velta into Applications.
2. Remove the download quarantine once, in Terminal:
   xattr -dr com.apple.quarantine /Applications/Velta.app
   — or try to open Velta, then go to System Settings → Privacy & Security and click Open Anyway (macOS 15 no longer offers right-click → Open for this).
3. macOS asks for microphone/camera access on first use (calls, QR scanning). With the ad-hoc signature it may ask again after an update.

Velta v1.5.2

What's changed in Velta v1.5.2

Full changelog: v1.5.1...v1.5.2

Added

• Windows Hello (Windows desktop): Privacy & security can wrap this device's database key in Windows Hello — PIN, face, or fingerprint — and remove the Credential Manager copy. Cold start stays locked until Hello succeeds. The app-lock PIN can stay as the other way in. The button stays hidden when Hello is not set up on this Windows account.

Fixed

• Large chats no longer freeze the app. The "N replies" count scanned the chat twice, and each open started another copy until the database pool was full. The lookup now uses the message-id index, and the chat view runs one of those counts at a time.
• Restart core runs one at a time. Stopping mail gives up after 15 seconds and starts again anyway. A database statement that has already started still runs to the end — quit an app that is already stuck on an older build.
• The core watchdog no longer raises its banner for calls that are slow on purpose (backup, adding a relay, calls). A frozen clock counts as the app coming back, and a timed-out call stops counting after 2 minutes.
• The core banner sits below the Android status bar.

Under the hood

• Design system: selection, accent tint, and the keyboard focus ring are their own tokens. The light theme's focus ring is #1a68b8 (5.1:1). docs/design-tokens.html is generated from app/css/main.css. The public design page does not embed that fragment yet.

• sqlite3_interrupt is not wired. The statement that filled the pool is gone, and an interrupt would roll back the write transaction on that connection. Add it when a core slow sql line still owns a pool slot after Restart returns.

• Quilt is 188 ops / 37 files. Suite: 198 files / 1332 tests.

• fix(macos):
  keep the Hello wrap helpers off the macOS build (7c73c60)

• feat:
  unlock the Windows desktop database key with Windows Hello (80d58f4)

• fix:
  get_reply_counts uses the rfc724_mid index and restarts no longer overlap (#249) (2bd95a9)

macOS (test build)

Velta_<version>_universal.dmg runs on Apple Silicon and Intel Macs (macOS 10.15+). It is not notarized (no Apple Developer ID yet), so macOS blocks the first launch:

1. Open the DMG and drag Velta into Applications.
2. Remove the download quarantine once, in Terminal:
   xattr -dr com.apple.quarantine /Applications/Velta.app
   — or try to open Velta, then go to System Settings → Privacy & Security and click Open Anyway (macOS 15 no longer offers right-click → Open for this).
3. macOS asks for microphone/camera access on first use (calls, QR scanning). With the ad-hoc signature it may ask again after an update.

Velta v1.5.1

What's changed in Velta v1.5.1

Full changelog: v1.5.0...v1.5.1

Added

• Core watchdog (desktop and Android): when the core stops answering, the app shows a banner with Restart core and restarts it automatically after a minute. Mail connections only — your data is untouched. Skipped during a profile transfer and during calls.
• "Fetching messages…" strip on an empty chat list after login or restore, so first sync no longer looks like a broken app; switches to "Updating…" while messages actively arrive.
• Loading bar in in-chat search while results are being fetched — no more silent modal on large profiles.
• Progress for profile export, second-device transfer and import: native progress, stage text, a corner pill, and an Android notification.
• Call screen shows the route: a small chip says Direct or Via relay (relay is normal — calls stay end-to-end encrypted).
• Redesigned @mention chips: a soft tinted chip that grows with the glyphs — long names, Й/Д, combining marks and emoji no longer get clipped; wrapped names get a chip per line.

Fixed

• A stalled core no longer blanks the Relays screen, zeroes the Bots chip or empties the chat list. The last good data stays on screen with a "Couldn't load — Retry" banner instead.
• Six lock waits behind a stalled core removed at the source (core patches #22 and #25–#28): the metadata and config locks are no longer held across network calls and SQL, skipped scheduler wake-ups are no longer lost, and the connectivity page answers during an IO restart.
• The watchdog no longer declares the core recovered while account calls are still stuck, and it keeps timing client-timed-out calls in view until they really answer.
• @mention chips keep WCAG AA contrast in the light theme with a custom accent color (yellow was the worst offender).
• Second-device transfer: one receive at a time, and closing the receive dialog no longer cancels the sender.
• Renaming a contact no longer fails; message info honors the selected profile.

Under the hood

• app/js/load-retry.js (last-good lists) and app/js/core-watchdog.js (ping state machine, regression-tested).

• Mention chip colors derived against the chip's own tint, not just the bubble (chat-appearance.js).

• Findings and upstream issues: docs/core-stall-investigation.md. Suite: 195 files / 1317 tests.

• fix:
  preserve RPC wrapper account scoping (febc708)

• fix:
  track timed-out RPCs in watchdog (f9af0b1)

• fix:
  keep watchdog stalled until RPCs recover (4a6aec4)

macOS (test build)

Velta_<version>_universal.dmg runs on Apple Silicon and Intel Macs (macOS 10.15+). It is not notarized (no Apple Developer ID yet), so macOS blocks the first launch:

1. Open the DMG and drag Velta into Applications.
2. Remove the download quarantine once, in Terminal:
   xattr -dr com.apple.quarantine /Applications/Velta.app
   — or try to open Velta, then go to System Settings → Privacy & Security and click Open Anyway (macOS 15 no longer offers right-click → Open for this).
3. macOS asks for microphone/camera access on first use (calls, QR scanning). With the ad-hoc signature it may ask again after an update.

Velta v1.5.0

What's changed in Velta v1.5.0

Full changelog: v1.4.90...v1.5.0

Added

• SOCKS5 proxy on Android and desktop, replacing the DNS tunnel. Save several proxies, switch with Use/Stop, share a velta://proxy link, QR, or chat card. Username/password optional.
• Pause a relay without deleting it. Sends skip it immediately; fetch skips it at the next reconnect. Mail already stored there stays.
• Add relays automatically is an opt-in in the Relays modal (default off). Legacy profiles that had it on are flipped off once at upgrade.
• Native attachments encrypted at rest (VLTA: a profile key, a random key per file, authenticated chunks). Profile databases were already encrypted on Android in 1.4.89.
• Copy log / Share in About Velta (last 512 KB of velta.log), with the same on/off switch as Velta Diagnostics.
• Push registration failure shows in Settings → Push notifications, with the distributor's reason.

Changed

• The DNS tunnel is archived. Saved loopback proxy URLs from it are cleared on upgrade. Use SOCKS5 or a WebSocket proxy instead.
• File logging to velta.log is off by default. boot: heartbeats still write so a stuck splash has a trail. Turn logging on from About or Diagnostics when you need a log.
• The app-lock PIN also unlocks the auto-lock screen. With biometric + PIN both on, cancelling the fingerprint prompt used to leave no way in short of killing the app. Auto-lock now checks the PIN in place (same backoff as the start gate) and never dismisses without a match.

Fixed

• Chats no longer freeze when opening or switching (1.4.90): restarting mail connections no longer blocks chat loading. Returning to the app also cancels a background fetch started while hidden.
• SOCKS5 rename dropped makeChooser from the proxy import list; the chooser is imported again.

Under the hood

• Bounded, redacting, rate-limited logger (log.rs); sidecar and UnifiedPush extracted from lib.rs; one VELTA_DB_KEY install_env entry; VAPID key from Gradle veltaVapidKey; JSON-RPC documented as the only core contract. Node 24 CI globs tests/**/*.test.mjs.

• fix(desktop):
  cfg-gate Android-only symbols so -D warnings passes (9816268)

• refactor:
  extract sidecar and push modules from lib.rs (#205) (ff71757)

macOS (test build)

Velta_<version>_universal.dmg runs on Apple Silicon and Intel Macs (macOS 10.15+). It is not notarized (no Apple Developer ID yet), so macOS blocks the first launch:

1. Open the DMG and drag Velta into Applications.
2. Remove the download quarantine once, in Terminal:
   xattr -dr com.apple.quarantine /Applications/Velta.app
   — or try to open Velta, then go to System Settings → Privacy & Security and click Open Anyway (macOS 15 no longer offers right-click → Open for this).
3. macOS asks for microphone/camera access on first use (calls, QR scanning). With the ad-hoc signature it may ask again after an update.

Velta v1.4.90

What's changed in Velta v1.4.90

Full changelog: v1.4.89...v1.4.90

Fixed

• Chats no longer freeze when opening or switching. Opening a chat could hang for 30 seconds or more and end with "Couldn't open chat", most often with a saved DNS tunnel whose server was unreachable. Restarting mail connections no longer blocks chat loading, and DNS-tunnel work no longer runs on the UI thread. Refs #176, #181
• Re-tapping a chat that is still loading waits for the same request instead of starting another one.

Changed

• Velta Diagnostics names the slow core requests when a chat takes long to open, so stalls can be traced from one log.

macOS (test build)

Velta_<version>_universal.dmg runs on Apple Silicon and Intel Macs (macOS 10.15+). It is not notarized (no Apple Developer ID yet), so macOS blocks the first launch:

1. Open the DMG and drag Velta into Applications.
2. Remove the download quarantine once, in Terminal:
   xattr -dr com.apple.quarantine /Applications/Velta.app
   — or try to open Velta, then go to System Settings → Privacy & Security and click Open Anyway (macOS 15 no longer offers right-click → Open for this).
3. macOS asks for microphone/camera access on first use (calls, QR scanning). With the ad-hoc signature it may ask again after an update.

Velta v1.4.89

What's changed in Velta v1.4.89

Full changelog: v1.4.88...v1.4.89

Added

• Profile data encryption on Android. Each profile's message database is encrypted at rest (SQLCipher) with a key in the Android Keystore; existing data is migrated once at startup, with a verified copy. On desktop and in the browser app it is a preview. Attachments are not encrypted yet (work in progress). Refs #178
• Privacy & security. A new screen in the side drawer (desktop and Android apps) holds the lock settings for the whole app instead of each profile's Profile management.
• App-lock PIN on desktop, Android and the browser app: Velta asks for it at every start, with growing delays after wrong attempts. The browser app adds a recovery code and passkey unlock.
• Biometric lock on Android, with the phone's screen-lock PIN, pattern or password as a fallback on Android 11+ so it also works without enrolled fingerprints. It combines with the Velta PIN ("Use PIN" on the lock screen).
• Lock when hidden after 1, 5 or 15 minutes.
• Language cards in the device chat offer Russian or French when your system language differs from the app's.

Fixed

• Android: the database key was never actually stored, so encryption stayed off; the biometric prompt failed with "did not succeed"; the embedded core no longer re-initializes after it is ready.
• Opening a chat can no longer get stuck for minutes when the core stalls; re-tapping retries.
• Images and videos keep a stable height while they load, so the chat no longer jumps.
• "This message was deleted" is readable in every theme (WCAG AA); the row keeps its height during Undo and then collapses smoothly.

Changed

• The thread button is icon-only, attached to the bubble corner; the reply count follows the time on all sizes.
• Invite, Cryptex, link-invite and language cards follow the theme tokens and the design-system primary button.

Under the hood

• Chat-open timing summaries and slow-step/slow-RPC lines in Diagnostics (ids and durations only, no content); biometric failures log the exact prompt error. Attachment encryption is work in progress; until then attachments rely on platform isolation, as Privacy & security says.

macOS (test build)

Velta_<version>_universal.dmg runs on Apple Silicon and Intel Macs (macOS 10.15+). It is not notarized (no Apple Developer ID yet), so macOS blocks the first launch:

1. Open the DMG and drag Velta into Applications.
2. Remove the download quarantine once, in Terminal:
   xattr -dr com.apple.quarantine /Applications/Velta.app
   — or try to open Velta, then go to System Settings → Privacy & Security and click Open Anyway (macOS 15 no longer offers right-click → Open for this).
3. macOS asks for microphone/camera access on first use (calls, QR scanning). With the ad-hoc signature it may ask again after an update.

Velta v1.4.88

What's changed in Velta v1.4.88

Full changelog: v1.4.87...v1.4.88

Added

• Admin groups. A new "Admin group" switch in the New group dialog makes you the group's only admin: only you can add or remove members, change the name, description, avatar, disappearing timer and pins, and you can delete any message for everyone. The info sheet shows "Moderated group · admin: X" with an Admin badge, and the admin's messages carry an Admin chip. Other members' clients enforce the same rules; wire-compatible with ArcaneChat admin groups (core patch #19). Refs #177

Fixed

• Profile keys showing "-". Contact fingerprints are read correctly again from chatmail core 2.66's changed encryption info, so avatars and profile keys show the real key.
• One-letter-wide bubbles. A threaded message that shared its row with the unread or read-marker line no longer collapses into one letter per line.

Under the hood

• Upstream status of every core patch is recorded in VENDORISSUES.MD (assessed 2026-10-29); the README documents Cryptex and velta.cc/join invites.

• fix(avatar):
  read contact fingerprints from core 2.66 encryption info (47c68b0)

macOS (test build)

Velta_<version>_universal.dmg runs on Apple Silicon and Intel Macs (macOS 10.15+). It is not notarized (no Apple Developer ID yet), so macOS blocks the first launch:

1. Open the DMG and drag Velta into Applications.
2. Remove the download quarantine once, in Terminal:
   xattr -dr com.apple.quarantine /Applications/Velta.app
   — or try to open Velta, then go to System Settings → Privacy & Security and click Open Anyway (macOS 15 no longer offers right-click → Open for this).
3. macOS asks for microphone/camera access on first use (calls, QR scanning). With the ad-hoc signature it may ask again after an update.

Velta v1.4.87

What's changed in Velta v1.4.87

Full changelog: v1.4.86...v1.4.87

Added

• velta.cc/join invite links. Invites are now shared as velta.cc/join/?… links by default — the landing page on the site personalizes the invitation, shows the scan-to-transfer QR, and deep-links into the app. Delta Chat mirror links and pasted links still work everywhere.
• Cryptex. A second provider for large files next to Lufi, so a big attachment can fall back when its first host is unreachable.

Fixed

• Images that never appeared. A picture in a chat could stay an empty reserved box for the rest of the session when its decode finished while another chat was open. Cached rows now heal themselves on return — restart or forwarding no longer needed.
• Chat switching on Android, part two. Scheduler interrupts no longer queue behind an IO restart, so a background reconnect can't hold chat opens and sends hostage (the deep fix for the "won't open for minutes" stalls).

Changed

• Message sheet and menu. A Firefox-style three-column action grid, delete confirms inline, a full-height emoji picker, and a clearer drag handle.
• Chatmail core 2.66.0. Marking messages seen and queueing read receipts happen in one transaction, and the IMAP loop avoids full table scans. The long-announced removal of the legacy configured_addr config landed — Velta switched to its own send pin in advance.
• Diagnostics logs strip CI build paths, and the PWA keeps the "Velta was updated" toast until you actually reload, with browser-only controls hidden properly.

Under the hood

• The wasm patch series is rebased onto 2.66.0 (locks re-pinned) for the browser build that ships with this release.

• fix(pwa):
  keep the update toast until reload (0aa829e)

• fix(pwa):
  hide shell-only controls in the browser (8e4b920)

macOS (test build)

Velta_<version>_universal.dmg runs on Apple Silicon and Intel Macs (macOS 10.15+). It is not notarized (no Apple Developer ID yet), so macOS blocks the first launch:

1. Open the DMG and drag Velta into Applications.
2. Remove the download quarantine once, in Terminal:
   xattr -dr com.apple.quarantine /Applications/Velta.app
   — or try to open Velta, then go to System Settings → Privacy & Security and click Open Anyway (macOS 15 no longer offers right-click → Open for this).
3. macOS asks for microphone/camera access on first use (calls, QR scanning). With the ad-hoc signature it may ask again after an update.