Releases: retransmit/Atrium
Release list
Atrium 1.0.7
A normal update over 1.0.6. No reinstall this time.
What's new
A refreshed look. The app moved to a new theming engine with a cleaner,
flatter surface. The Settings preview updates live as you change the accent
color or switch between light and dark, inputs stay clearly outlined, and the
Glances gauges follow your theme instead of fixed colors.
Deeper Radarr and Sonarr. Radarr's settings now match Sonarr's, so both
services can be configured to the same depth from the app. Log views keep
loading as you scroll instead of stopping after the first page, and the wanted
lists and detail screens picked up a range of smaller improvements.
Smoother scrolling. Series and movie detail screens scroll noticeably more
smoothly and the back-to-top button eases in and out instead of popping.
Scrolling no longer over-stretches at the edges, dashboard widgets keep their
state as you move around, and the dashboard gauges animate to their values.
Which APK
Most phones want app-arm64-v8a-release.apk. Use armeabi-v7a for older
32-bit devices, and x86_64 only for emulators and Chromebooks. Android 7.0
(API 24) or newer.
Same key as every release so far, so this installs straight over 1.0.6:
5ebad1ff2f9cdc63f28b364addf9e858330db26909d9eba8dfbccb998de37351
Free software under the GPL-3.0-or-later.
Atrium 1.0.6
A normal update over 1.0.5. No reinstall this time.
What's new
Pull to refresh is unified across every screen, with a smoother, more
responsive indicator, and it no longer fires when you swipe a poster row
sideways.
Detail screens fade their title into the app bar as you scroll, the bottom
bar tucks away while you scroll down, and the back button from a secondary tab
returns you to the dashboard.
Seerr artwork (posters, backdrops, cast photos) now loads from your own
Seerr server rather than from TMDB directly, the same way the rest of the app
already loads its artwork.
Which APK
Most phones want app-arm64-v8a-release.apk. Use armeabi-v7a for older
32-bit devices, and x86_64 only for emulators and Chromebooks. Android 7.0
(API 24) or newer.
Same key as every release so far, so this installs straight over 1.0.5:
5ebad1ff2f9cdc63f28b364addf9e858330db26909d9eba8dfbccb998de37351
Free software under the GPL-3.0-or-later.
Atrium 1.0.5
If you installed 1.0.0 to 1.0.4 from this page, Android will refuse this as
an update. You have to uninstall and reinstall once. Export your profiles
from Settings first, or you will lose your server configuration.This is a one-off. Nothing after 1.0.5 is affected, and installs from F-Droid
are unaffected.
Nothing changes in the app itself.
Why the reinstall
Android decides whether one build is newer than another using an internal
number, not the version you see. Atrium was letting Flutter pick that number
automatically. F-Droid asks Flutter apps to set it themselves instead, because
Flutter's automatic scheme has changed between releases, and a build number that
moves on its own is a bad foundation for a store that rebuilds your app.
So the numbering changed, and the new numbers are lower than the old ones.
Android reads lower as older and refuses to install over the top. There is no
way around it other than doing it once, and doing it now, days in, is as cheap
as it will ever be.
Why it is worth doing at all
F-Droid has now confirmed it can rebuild Atrium from source on its own machines
and get a byte-for-byte identical result, on all three architectures. That means
F-Droid can publish these exact APKs, carrying this signature rather than
their own, so you can move between this page and F-Droid without reinstalling
again.
That had to be settled before the first F-Droid publish. Once an app ships under
F-Droid's key it stays under F-Droid's key.
The F-Droid submission is still open and not yet merged.
Which APK
Most phones want app-arm64-v8a-release.apk. Use armeabi-v7a for older
32-bit devices, and x86_64 only for emulators and Chromebooks. Android 7.0
(API 24) or newer.
Same key as every release so far:
5ebad1ff2f9cdc63f28b364addf9e858330db26909d9eba8dfbccb998de37351
Free software under the GPL-3.0-or-later.
Atrium 1.0.4
Nothing changes in the app itself. If you are on 1.0.3 there is no reason to
update.
What this fixes
F-Droid verifies a release by rebuilding it on their own machines and checking
the result against the published APK. Their rebuild of 1.0.3 came out 20 bytes
different, out of 25 MB, and nothing else: a fingerprint the compiler stamps
into one library, derived from where the build tools happened to live on disk.
The path itself never reaches the APK, but that fingerprint does.
The build now uses the same tool locations F-Droid does, and their rebuild
matches byte for byte.
Why it is worth a release
Once this works, F-Droid can ship APKs carrying this signature instead of
their own. Without it, an Atrium install from F-Droid and one from this page have
different signatures, and Android refuses to update across a signature change:
you would have to uninstall, losing your profiles, to move between them.
It also cannot be added later. Once an app ships under F-Droid's key, it stays
under F-Droid's key.
The F-Droid submission is still open and not yet merged.
Which APK
Most phones want app-arm64-v8a-release.apk. Use armeabi-v7a for older
32-bit devices, and x86_64 only for emulators and Chromebooks. Android 7.0
(API 24) or newer.
Same key as every release so far, so this installs as a normal update.
apksigner verify --print-certs should report:
5ebad1ff2f9cdc63f28b364addf9e858330db26909d9eba8dfbccb998de37351
Free software under the GPL-3.0-or-later.
Atrium 1.0.3
Nothing changes in the app itself. If you are on 1.0.2 there is no reason to
rush.
What this is for
These APKs are the first built by CI rather than by hand. That is what lets
F-Droid rebuild the same tag on their own machines, check the result matches
these files byte for byte, and then publish these signatures rather than
their own.
Which matters for one reason: today, an Atrium install from F-Droid and one from
this page would carry different signatures, and Android refuses to update across
a signature change. You would have to uninstall, losing your profiles, to move
between them. Reproducible builds remove that. It also has to be set up before
the first F-Droid publish, because once an app ships under F-Droid's key it can
never be moved to the developer's.
The F-Droid submission is still open and not yet merged.
For anyone building from source
A release build is now unsigned unless you supply your own
app/android/key.properties, where it used to fall back to the debug key. An
unsigned APK will not install. To try a release build without a key of your own:
flutter build apk --release -PdebugSignRelease=true
Debug builds are unaffected. The unsigned default is deliberate: F-Droid's check
copies the signature off the published APK onto their own build, which only
works if their build has no signature of its own.
Which APK
Most phones want app-arm64-v8a-release.apk. Use armeabi-v7a for older
32-bit devices, and x86_64 only for emulators and Chromebooks. Android 7.0
(API 24) or newer.
Same key as every release so far, so this installs as a normal update.
apksigner verify --print-certs should report:
5ebad1ff2f9cdc63f28b364addf9e858330db26909d9eba8dfbccb998de37351
Free software under the GPL-3.0-or-later.
Atrium 1.0.2
Removes a Google-only blob from the APK, and does the groundwork for the F-Droid
listing. No functional changes.
If you are still on 1.0.0, read the 1.0.1
notes first. It
fixed a security issue and you should rotate your Sonarr and Radarr API keys.
What changed
The Android Gradle Plugin writes an encrypted list of an app's dependency tree
into the APK signing block, so that Google Play Console can read it. It was in
every Atrium APK, including the published 1.0.0 and 1.0.1:
0x7109871a v2 signature
0x504b4453 dependency metadata <- this
0x42726577 padding
Nothing ever transmitted it. It is passive, and only read if an APK is uploaded
to Play, which Atrium never is. So the no-telemetry promise was never affected.
But nothing here reads it back either, F-Droid will not publish an APK carrying
a blob it cannot inspect, and an encrypted Google artifact has no place in a
GPL app you are trusting with server credentials. It is now switched off, and
verified gone from all three ABIs.
Also fixes a bug in the repo's own build helper: it walked into the pub cache
and ran code generation inside downloaded dependencies whenever the cache lived
inside the checkout.
Which APK
Most phones want app-arm64-v8a-release.apk. Use armeabi-v7a for older
32-bit devices, and x86_64 only for emulators and Chromebooks. Android 7.0
(API 24) or newer.
Signed with the same key as 1.0.0 and 1.0.1 (CN=Atrium, O=Atrium), so this
installs as a normal update. apksigner verify --print-certs should report:
5ebad1ff2f9cdc63f28b364addf9e858330db26909d9eba8dfbccb998de37351
Free software under the GPL-3.0-or-later.
Atrium 1.0.1
A security fix. Update if you ran 1.0.0.
What was wrong
1.0.0 sent your Sonarr or Radarr API key to third-party artwork sites.
The "recently downloaded" dashboard widget attached the instance's key as an
X-Api-Key header on its poster requests, and those requests went to whichever
artwork site your *arr server had recorded for the image: TheTVDB, TMDB or
Fanart.tv. So the key rode along to a host that has no business receiving it.
A Sonarr or Radarr API key is full control of that server: read paths, change
settings, add and delete media, run commands.
If you ran 1.0.0, consider rotating the API key of every Sonarr and Radarr
instance you used with it. Settings, General, API Key on the server itself.
There is no way to know whether a given key was retained by anyone, so rotating
is the safe assumption rather than a certainty that it was taken.
What else changed
Posters and backdrops on the dashboard and in the calendar were being fetched
from those artwork sites directly, so they saw your IP address and which titles
you were browsing. Your Sonarr and Radarr servers already cache that artwork and
serve it themselves, so Atrium now loads it from them instead. The rest of the
app was already doing this; the dashboard and calendar were the exceptions.
One consequence worth knowing: artwork now follows your instance's URL, local or
external, like every other request. It needs your server reachable, where before
it would load from a public CDN regardless.
Search results for titles you have not added yet still load artwork remotely,
and have to. Your server has nothing cached for something it has never seen.
Which APK
Most phones want app-arm64-v8a-release.apk. Use armeabi-v7a for older
32-bit devices, and x86_64 only for emulators and Chromebooks. Android 7.0
(API 24) or newer.
Signed with the same key as 1.0.0 (CN=Atrium, O=Atrium), so this installs as a
normal update. apksigner verify --print-certs should report:
5ebad1ff2f9cdc63f28b364addf9e858330db26909d9eba8dfbccb998de37351
Free software under the GPL-3.0-or-later.
Atrium 1.0.0
Superseded by 1.0.1. Do not use this build.
This release sent your Sonarr or Radarr API key to third-party artwork
sites (TheTVDB, TMDB, Fanart.tv) as a header on poster requests. Those
keys grant full control of the server. If you ran this build, update to
1.0.1 and consider rotating the API key of every Sonarr and Radarr
instance you used with it.Kept here because the tag is public and should not be rewritten.
The first release of Atrium, an Android controller for a self-hosted media
stack. Point it at your own servers and manage the whole stack from your
phone. No account, no telemetry, nothing phoning home.
Atrium is a controller, not a media player. It browses and manages your media
servers; playback stays with the official apps.
Which APK
Most phones want app-arm64-v8a-release.apk. Use armeabi-v7a for older
32-bit devices, and x86_64 only for emulators and Chromebooks. Android 7.0
(API 24) or newer.
What's in it
Services
- Sonarr and Radarr, at full depth: library, queue, wanted, history, blocklist,
system and the settings tree - Prowlarr: indexers, search and grab, history, system
- Bazarr: series and movies, wanted, manual subtitle search
- Seerr (Overseerr and Jellyseerr): discover, search, request management
- Tautulli: activity, history, statistics, users, terminate
- Jellyfin, Emby and Plex: libraries, item detail, seasons, music, resume rows
and now-playing sessions - qBittorrent and SABnzbd: transfers and queue control
- Glances: CPU, memory, GPU and disk usage of the host
App
- A reorderable dashboard of at-a-glance widgets: active downloads, now
streaming, upcoming releases, recently added, recently downloaded, requests
and server info - Multiple profiles, so one phone can carry more than one stack
- Every instance holds a LAN URL and a WAN URL; Atrium probes the LAN URL,
caches the verdict per network, and falls back to WAN. Force-Local and
Force-External can be pinned per instance - Wake-on-LAN for your machines, sent over pure Dart UDP
- Global and per-instance custom HTTP headers, for Authelia or Cloudflare
Access style reverse proxies - API keys held in the Android Keystore, with an optional biometric unlock
- Profile import and export as JSON
- Material 3 Expressive throughout, with dynamic color and custom palettes
Notes
Verify the download if you like. All three APKs are signed with the Atrium
release key (CN=Atrium, O=Atrium). Running
apksigner verify --print-certs app-arm64-v8a-release.apk
should report this SHA-256 fingerprint:
5ebad1ff2f9cdc63f28b364addf9e858330db26909d9eba8dfbccb998de37351
An F-Droid submission is in progress. The F-Droid build will be signed with
F-Droid's key rather than this one, so once it lands, pick one source and stay
on it. Android will not update an APK across a signature change.
Free software under the GPL-3.0-or-later.