mobile-v1.0.10

Pollis for Android (direct download)

The signed APKs that https://pollis.com/android links to, for
people who do not use Google Play. Same app as the Play listing,
different signing key. One APK per CPU type: almost every phone
wants arm64-v8a; armeabi-v7a is for older 32-bit phones,
x86_64 for Chromebooks and emulators.

Signing certificate SHA-256: a991cf8d0d3c4fd9280b8537f7089f621ec6cc09742a45ff568d06141cf524eb

Verify before installing:

sha256sum pollis-v1.0.10-android-arm64-v8a.apk
apksigner verify --print-certs pollis-v1.0.10-android-arm64-v8a.apk

The Signer #1 certificate SHA-256 digest must equal the value
above, which is also on https://pollis.com/android and committed
in mobile/store/android-sideload-cert.sha256.

• A Play install and this APK cannot update each other (different
  signatures). Switching means uninstalling, and a new install
  starts with empty history.
• There is no auto-update. Check https://pollis.com/android for
  new versions.

v1.17.4

What changed

See CHANGELOG.md
for this release's entry, written for the person installing it.

Verify what you downloaded

Every artifact below is published with its SHA-256 in a public,
append-only transparency log, a keyless cosign signature, a SLSA
build-provenance attestation, and a CycloneDX SBOM.

• Commands to check all of it: https://pollis.com/artifacts
• Whether this release rebuilt bit-for-bit from source:
  https://pollis.com/assurance

The installers verify automatically — install.sh requires the hash
it downloaded to appear in the transparency log at a different
origin from the CDN, and runs cosign when it is available.

---

What's Changed

• Org transfer finalize: drop the old signer, repoint relay image (#1265) by @actuallydan in #1357
• chore: refresh the rebuild ledger through v1.17.3 by @github-actions[bot] in #1359
• CI: explicit toolchain 1.96.0 on the dtolnay steps; pollis-verify 0.8.3 (#1353) by @actuallydan in #1354
• Rebuild ledger: classify v1.17.1's rebuild as environment drift by @actuallydan in #1358
• Mobile: show a new device's approval request on the phone (#1360) by @actuallydan in #1362
• QR sign-in the right way round: the new device shows the code, the signed-in phone scans it (#1361) by @actuallydan in #1363

Full Changelog: v1.17.3...v1.17.4

v1.17.3

What changed

See CHANGELOG.md
for this release's entry, written for the person installing it.

Verify what you downloaded

Every artifact below is published with its SHA-256 in a public,
append-only transparency log, a keyless cosign signature, a SLSA
build-provenance attestation, and a CycloneDX SBOM.

• Commands to check all of it: https://pollis.com/artifacts
• Whether this release rebuilt bit-for-bit from source:
  https://pollis.com/assurance

The installers verify automatically — install.sh requires the hash
it downloaded to appear in the transparency log at a different
origin from the CDN, and runs cosign when it is available.

---

What's Changed

• outbox flow: autocorrect-proof text (#1345) by @actuallydan in #1346
• chore: refresh the rebuild ledger through v1.17.2 by @github-actions[bot] in #1339
• Transparency publish: always overwrite unsigned proofs/entries (#1348) by @actuallydan in #1350
• pollis-verify 0.8.2 (#1351) by @actuallydan in #1352
• Release-impact check: live vs main per target, feature parity, /release-check + hooks (#1347) by @actuallydan in #1349
• Org transfer: accept the pollis-app signer, repoint GHCR/OIDC/docs/links (#1265) by @actuallydan in #1356

Full Changelog: v1.17.2...v1.17.3

v1.17.2

What changed

See CHANGELOG.md
for this release's entry, written for the person installing it.

Verify what you downloaded

Every artifact below is published with its SHA-256 in a public,
append-only transparency log, a keyless cosign signature, a SLSA
build-provenance attestation, and a CycloneDX SBOM.

• Commands to check all of it: https://pollis.com/artifacts
• Whether this release rebuilt bit-for-bit from source:
  https://pollis.com/assurance

The installers verify automatically — install.sh requires the hash
it downloaded to appear in the transparency log at a different
origin from the CDN, and runs cosign when it is available.

---

What's Changed

• A revoked device is told it was revoked and signs itself out (#1338) by @actuallydan in #1340
• CLI (pollis-tui) rot: render every message shape, message actions, Secret Key at sign-up, --help/--version, verified installer, signed macOS CLI, DS empty-room send-data by @actuallydan in #1341
• Durable outbox: an outgoing message is never silently lost (#1335) by @actuallydan in #1342
• Mobile 1.0.8 (#1343) by @actuallydan in #1344

Full Changelog: v1.17.1...v1.17.2

pollis-verify-v0.8.3

Pollis transparency-log verifier

Independently verify the public transparency log at
https://verify.pollis.com — no trust in Pollis required beyond
the published log public key.

Pinned public key (ML-DSA-44, 1312 bytes) so that a signed
statement about history stays checkable long-term:

56ab128f3f10107382802e69d3de8659d0127c711feb9c849f5b213c6f2d0af3b5fe41f581b202b385906fc42e4421747e84939054d160c551536131e41508a82b1f3ff0a07bcc4cee5e2eae8e85155d5c9e0dbc6e7683811649fb9e3b1f18c7ed070dbf61f2a058915b33f8ad3edcd135dd18770053e5ac971b13d17d95e16e98f47a852d600c47cbc0349354af2898803cfec7112660076d20027cb67870e18fb25ee327a36743fa812ccf93ba0769ddbd3d42ab40849ac8c98357b64eaf1ffc242abb12fddef4d8cdfa02448b4d99546b448e589657f898a47c6f30ddd88edd3f4456470e0a151e5fd601750c8b0489d3471897cfa78e0d7a00d938dfe876ef243117c972e041fdb00aa7af30d34184153cfd7b1e3b481dc562bbfc82bc20fe8ac4d9845f41de49fc33b6f94494df7088b06c7cb9ae35db86ac0fd293ca403046cec46ca9b12c755670d3d9b14c300b11ec292cd5e37d9f9e5e5d1729222a33bf1e13440f44dbf1b4d4104c612db4e269760868be5ff99f9ed269625fa4f39e21713a14293285e95f8a8e8cecd9db8e6a70c36340280322eab3490270ac640f706a23e81d79111dead641eaf7b926582ed0b0422f9addc0091d731a4fe1b9079be8bd75df23f5f9bf287beab7f67f763e04f0245bf9c705136d04eb8391fb4b4f12bfba44ae49bb6f32ddb0d539e59cd0159120b2fb1718f57e12a846638dbe0b650bfcd5a6cc74cd315b49136ea4e13d431a7f3a4c38fc783a82ca2b4c44a2f379c8aa9704d4639de3f94466662c97fbbd834db97a90405c382b5039803f4e4ed5c6b57487c8d23ad9e4d319df3466c49ef1e1cef526ddad1db5fa14f3b067b40580e068582dc428e21dbdc3df848e8e00fe1181f8e0d1409ab9a8757aef008b67191f4368f37cbd587ff65acdf07adbb989d09cc3318e346ca71c029557f2c523c204defab472b3dcb09bfbb95d5d1665a360a00faeb09b660f13fdc00f7b53fbfeaa58f87a208ad4551bcbe4307bf4d8451e027f4cc33cd55700016795c3164b1bc90d9dd1737b49d2e9e4b190128d2e62a44a80c1375c616aa2871ae7ad4a914102551380a8f8edb68c2df02bdf52607a7432ea7026f6a1efcdb37ecc11ecf1623ec6979e5d65c2812a997121010cd5fd9a98b9ed34edc17b667bfd37ef2be6dfe67fbdde03fa95bb80d0e1c7336263042ef44c4f9d28f1bf959bdc24c09cf8269378705022ff476fce91dbba6c8ffec00b27572eaa4835b59948d7a625ccc84ff4ac062176f4972f5131a961b17c7ff0010d2f2f3f8c12b7bf05fb9771d64a24fdab058f4bf3a155ade6a496b9a09d43a7673b5d8fb6519e01bf911ca78cc23f95943f63db72883d522fe24d4b7c7a26c7fd43b4f6f7496acf9ea2cab2e3cd6fc274964b576084c820bae79dbaa331d11751ec718660cd8e7847b7bacf31180803f681fb349b96338c98c791f74bc95e0d37b2810632159bc3175fed2e16038d45d35e4628250e8c9fb66c5bb2238f6456901f657e9655d3d5a09ff4952a0b9eb9c614f78c27626a136ef281f7099f68e898628530ef690851c179ef6a02448d498e49b2c362c839832100f4a9bf4abf17d496c71bfb5263da345d952b275f04707b31b9f6575da6dd2be799b90cc615f52ec32b4833a7e619d7f34f91f16edc38bc0a869c7211473f3ab90255446e0b7efbb2b97e8111d43b039ec0469b020f38925aad61e229836c96fad5bf3c3cad8f2c1c8b56cd819e8972d108dbfa8cd518177feaa7f4e0b547584a9a5d39ad4f1e8010cfead998ec18991cb89031a11c03cbd1ee7e0a1436da10ef154db13d4850c687c0a668215c9c8b7b1c

This build trusts only that key. A served key that differs is a hard
alarm, not an accepted rotation.

Usage

# verify the entire log (signatures, inclusion proofs, consistency)
./pollis-verify-<platform> remote https://verify.pollis.com

# verify one conversation's commit chain (use a conversation id, not a name)
./pollis-verify-<platform> group https://verify.pollis.com <CONVERSATION_ID>

# verify a user's account-key history chain (identity-key versions)
./pollis-verify-<platform> account https://verify.pollis.com <USER_ID>

# verify a released version's binaries against the transparency log
./pollis-verify-<platform> release https://verify.pollis.com v1.3.0

Exit code is non-zero if any check fails. Add --json to
group, account, or release for machine-readable output.

Verify the download against the matching *.sha256 file.

mobile-v1.0.9

Pollis for Android (direct download)

The signed APKs that https://pollis.com/android links to, for
people who do not use Google Play. Same app as the Play listing,
different signing key. One APK per CPU type: almost every phone
wants arm64-v8a; armeabi-v7a is for older 32-bit phones,
x86_64 for Chromebooks and emulators.

Signing certificate SHA-256: a991cf8d0d3c4fd9280b8537f7089f621ec6cc09742a45ff568d06141cf524eb

Verify before installing:

sha256sum pollis-v1.0.9-android-arm64-v8a.apk
apksigner verify --print-certs pollis-v1.0.9-android-arm64-v8a.apk

The Signer #1 certificate SHA-256 digest must equal the value
above, which is also on https://pollis.com/android and committed
in mobile/store/android-sideload-cert.sha256.

• A Play install and this APK cannot update each other (different
  signatures). Switching means uninstalling, and a new install
  starts with empty history.
• There is no auto-update. Check https://pollis.com/android for
  new versions.

mobile-v1.0.8

Pollis for Android (direct download)

The signed APKs that https://pollis.com/android links to, for
people who do not use Google Play. Same app as the Play listing,
different signing key. One APK per CPU type: almost every phone
wants arm64-v8a; armeabi-v7a is for older 32-bit phones,
x86_64 for Chromebooks and emulators.

Signing certificate SHA-256: a991cf8d0d3c4fd9280b8537f7089f621ec6cc09742a45ff568d06141cf524eb

Verify before installing:

sha256sum pollis-v1.0.8-android-arm64-v8a.apk
apksigner verify --print-certs pollis-v1.0.8-android-arm64-v8a.apk

The Signer #1 certificate SHA-256 digest must equal the value
above, which is also on https://pollis.com/android and committed
in mobile/store/android-sideload-cert.sha256.

• A Play install and this APK cannot update each other (different
  signatures). Switching means uninstalling, and a new install
  starts with empty history.
• There is no auto-update. Check https://pollis.com/android for
  new versions.

v1.17.1

What changed

See CHANGELOG.md
for this release's entry, written for the person installing it.

Verify what you downloaded

Every artifact below is published with its SHA-256 in a public,
append-only transparency log, a keyless cosign signature, a SLSA
build-provenance attestation, and a CycloneDX SBOM.

• Commands to check all of it: https://pollis.com/artifacts
• Whether this release rebuilt bit-for-bit from source:
  https://pollis.com/assurance

The installers verify automatically — install.sh requires the hash
it downloaded to appear in the transparency log at a different
origin from the CDN, and runs cosign when it is available.

---

What's Changed

• ci: bump docker/build-push-action from 6.19.2 to 7.4.0 by @dependabot[bot] in #1269
• ci: bump taiki-e/install-action from 2.87.22 to 2.87.27 by @dependabot[bot] in #1268
• ci: bump the actions-official group with 3 updates by @dependabot[bot] in #1267
• chore: refresh the rebuild ledger through v1.17.0 by @github-actions[bot] in #1311
• Release prune: don't abort on an already-pruned version by @actuallydan in #1310
• Make lost messages visible: placeholder + on-device log (#1312) by @actuallydan in #1318
• Bump Expo SDK 57 patch releases to clear expo-doctor (#1309) by @actuallydan in #1321
• Bump rustls 0.23.46; ignore RUSTSEC-2026-0346/0349 on old 0.21/0.22 lines by @actuallydan in #1313
• iOS: core data dir in Application Support, excluded from backup (#1306) by @actuallydan in #1314
• macOS updater: stop quarantining the bundle we install, heal bundles stamped by older releases by @actuallydan in #1322
• Upgrade livekit 0.7 → 0.9 and libsql 0.9 → 0.10; drop rustls 0.21/0.22 (#1303) by @actuallydan in #1319
• Stop livekit 0.9 sending the device hardware model to the SFU (#1320) by @actuallydan in #1325
• Bump expo 57.0.30 / expo-router 57.0.28 (#1328) by @actuallydan in #1329
• Mobile: pinned messages (#1315) by @actuallydan in #1327
• Docs: mobile store builds are a released output (#1317) by @actuallydan in #1323
• Mobile: Vault (#1316) by @actuallydan in #1326
• Images going 'unavailable': count sealed messages' attachment references (#1330) by @actuallydan in #1331
• Mobile Maestro fixes: media-viewer restart timing, vault keyboard on iOS (#1334) by @actuallydan in #1336
• Mobile 1.0.7 (#1332) by @actuallydan in #1333

Full Changelog: v1.17.0...v1.17.1

mobile-v1.0.7

Pollis for Android (direct download)

The signed APKs that https://pollis.com/android links to, for
people who do not use Google Play. Same app as the Play listing,
different signing key. One APK per CPU type: almost every phone
wants arm64-v8a; armeabi-v7a is for older 32-bit phones,
x86_64 for Chromebooks and emulators.

Signing certificate SHA-256: a991cf8d0d3c4fd9280b8537f7089f621ec6cc09742a45ff568d06141cf524eb

Verify before installing:

sha256sum pollis-v1.0.7-android-arm64-v8a.apk
apksigner verify --print-certs pollis-v1.0.7-android-arm64-v8a.apk

The Signer #1 certificate SHA-256 digest must equal the value
above, which is also on https://pollis.com/android and committed
in mobile/store/android-sideload-cert.sha256.

• A Play install and this APK cannot update each other (different
  signatures). Switching means uninstalling, and a new install
  starts with empty history.
• There is no auto-update. Check https://pollis.com/android for
  new versions.

v1.17.0

What changed

See CHANGELOG.md
for this release's entry, written for the person installing it.

Verify what you downloaded

Every artifact below is published with its SHA-256 in a public,
append-only transparency log, a keyless cosign signature, a SLSA
build-provenance attestation, and a CycloneDX SBOM.

• Commands to check all of it: https://pollis.com/artifacts
• Whether this release rebuilt bit-for-bit from source:
  https://pollis.com/assurance

The installers verify automatically — install.sh requires the hash
it downloaded to appear in the transparency log at a different
origin from the CDN, and runs cosign when it is available.

---

What's Changed

• Mobile 1.0.6: store build with security dependency upgrades (#1299) by @actuallydan in #1300
• Remove dead src-tauri/Cargo.lock (#1301) by @actuallydan in #1302
• chore: refresh the rebuild ledger through v1.16.2 by @github-actions[bot] in #1304
• Diagnostics: real sign-in errors, on-device log, bounded DS failed-request log (#1305) by @actuallydan in #1307

Full Changelog: v1.16.2...v1.17.0