Repository navigation
kwsantiago
Kyle 🐆
A security release. Everything in v1.3.0, plus the fixes below.
A refusal you asked to be remembered now holds
If you refused an app and asked Keep to remember that, the refusal could still be bypassed whenever automatic approval was switched on. The signing policy was consulted before the stored decision, so an app you had explicitly denied could be signed for without asking you, as long as it had been granted background signing and your policy was Automatic or Basic.
A permission you set to Ask was overridden the same way, and so was an app whose access window had already run out. A failure to read your stored decisions was also passed over rather than refusing the request.
Your refusals, your access windows and a failed read are now all checked before the signing policy, so none of them can be stepped over.
An expired app has to be approved again
When an app's access window ran out, Keep removed everything it knew about that app, including your explicit refusal, and left its background-signing permission in place. The app then counted as unknown rather than expired and fell back to your default policy, which could approve it automatically. A window that was meant to limit access could end by widening it.
An expired window now withdraws what it granted and nothing more. Background signing is switched off, so the app has to be approved again rather than quietly resuming under your default. A refusal is kept for as long as you set it, and an explicit Ask is kept too, because neither is part of what the window granted.
keep moves to v0.11.0
keep.version moves to keep v0.11.0, which carries the gate reordering above. The rejection reasons are unchanged; what changed is which requests reach them.
Install
Download the APK for your device's architecture from the Assets below. Min SDK 33 (Android 13+).
keep-android-v1.3.1-arm64-v8a.apkfor physical deviceskeep-android-v1.3.1-x86_64.apkfor emulators and x86_64 hardware
Both per-ABI APKs reproduce bit-for-bit from source: the Reproducibility workflow rebuilds each one in a pinned container and compares it against the published artifact with apksigcopier compare, so a mismatch fails rather than passing quietly.
Verifying this release
Download SHA256SUMS, SHA256SUMS.asc, privkeyio-signing-key.asc and your APK into one folder:
gpg --import privkeyio-signing-key.asc
gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum --ignore-missing -c SHA256SUMS
Look for Good signature from "Kyle Santiago <kyle@privkey.io>" on key A47D99B6DB0D715D40C59A2023AE8A8EA7E24E38, and OK for your file. The warning that the key is not certified is expected, and means only that you have not marked it trusted yourself.
The APK carries its own signature, which is what Android checks on install and what F-Droid pins as AllowedAPKSigningKeys:
apksigner verify --print-certs keep-android-v1.3.1-arm64-v8a.apk
That must report certificate SHA-256 digest 3eb0e6f6f4e0962ebd717f84eea47428b73087b686c956633d6a9fcc4c854f50.
The git tag is signed with the same GPG key, so git verify-tag v1.3.1 checks the source this release was built from.