v1.2.0

Highlights

A share migration cannot lose the share. The legacy copy was erased once the destination had been resolved, which proves a name exists rather than that the data arrived. The destination is now read back and the share confirmed present before anything is deleted, so an interrupted or partially failed migration leaves the original in place rather than removing the only copy.

Stored values are bound to the key they were stored under. An entry could previously be read back under a different key than the one it was written with, so a value moved or transplanted between entries would still decrypt and be accepted. Each value is now bound to its own key, and a transplanted entry is rejected instead of silently trusted. The registry entry is resolved in a single pass, so a second probe cannot confuse the lookup.

The co-signing prompt says what is asking, and whether that was proven. The request label is shown in the prompt, and presented as a claim rather than a bare fact: it is qualified precisely when nothing verified it, so a label that was cryptographically established reads plainly while an unverified one cannot borrow that authority. A name on its own can no longer imply the request was checked.

AES-GCM cannot be handed an IV it did not generate. AndroidKeystoreStorage no longer exposes an encrypt path that accepts a caller-supplied IV, making nonce reuse structurally impossible rather than merely avoided by convention. A check-rng-hygiene.sh gate enforces this in CI, counting Cipher.init arguments rather than matching a token pair, so a reintroduction fails the build.

keep.version moves to keep v0.9.1. That is load-bearing for this release rather than routine. The pinned core carries the entropy health check that now samples the OS source directly instead of only its mixed output, the FROST nonce replay guard, which previously had no caller marking a nonce used and so never rejected a repeated commitment, and nostr-relay-pool 0.44.2, which fixes a verification-cache bypass (RUSTSEC-2026-0224) that let a forged-signature event skip validation and be persisted as though checked.

What's Changed

Five commits since v1.1.9: a degraded RNG path failing closed rather than quietly (#470), legacy share retention until a copy is demonstrably stored (#469), stored values bound to their key (#468), the request label qualified only when nothing verified it (#467), and the request label shown in the co-sign prompt (#466).

Install

Download the APK for your device's architecture from the Assets section below. Min SDK 33 (Android 13+).

• keep-android-v1.2.0-arm64-v8a.apk for physical devices
• keep-android-v1.2.0-x86_64.apk for emulators and x86_64 hardware

Both per-ABI APKs reproduce bit-for-bit from source: the Reproducibility workflow rebuilds each in a pinned container and compares it against the published artifact with apksigcopier compare, so a mismatch fails rather than passing quietly.

Verify

sha256sum -c SHA256SUMS

Full changelog

v1.1.9...v1.2.0