[???] Download Termux Apk 0.119.1 (Latest version) [???]

[sruocco-i2r]

I am a casual user of Termux 0.118.0 on my smartphone (Samsung S23 Ultra) and now I am setting it up in my tablet (Samsung Tab S9 Ultra).

After a Google search I landed by chance on this page, pointing at an APK with the "latest version" 0.119.1 which is NOT published on GitHub. Of course I did NOT download to install it.

I didn't spend much time researching the source web page, or if anyone else spotted this.

Any opinions?

Thanks in advance for developing Termux and for your advice in this matter.

Sergio

[twaik]

There is no 0.119.1 version. If some site offers you to download this version it is definitely malicious.
If you want to download latest available version you should go to this page and choose latest workflow. On the workflow page you will see build artifacts list. This list contains the link to the archive with latest build.

[sylirre]

Always download Termux from trusted release source such as F-Droid.

Neither GitHub nor something else can be trusted. Particularly, on GitHub we publish debug builds signed by test key shared with community.

Explaining what is that "test key":

this is a dedicated signature key used to sign builds which our contributors can test on their device. For convenience and make development & testing easier, like contributors can interchange our builds with their own, this key and its passphrase in clear text were published on GitHub.

• https://github.com/termux/termux-app/blob/master/app/testkey_untrusted.jks

• termux-app/app/build.gradle

  Lines 82 to 83 in 8e3a898

  	storePassword 'xrj45yWGLbsO7W0v'
  	keyPassword 'xrj45yWGLbsO7W0v'

This however doesn't prevent people from crafting own Termux apk files pretending to be the GitHub update: the crafted apk can be used to upgrade legit installation from GitHub.

This is also stated in https://github.com/termux/termux-app?tab=readme-ov-file#github:

Security warning: APK files on GitHub are signed with a test key that has been shared with community. This IS NOT an official developer key and everyone can use it to generate releases for own testing. Be very careful when using Termux GitHub builds obtained elsewhere except https://github.com/termux/termux-app. Everyone is able to use it to forge a malicious Termux update installable over the GitHub build. Think twice about installing Termux builds distributed via Telegram or other social media. If your device get caught by malware, we will not be able to help you.

So, if you are not Termux contributor or just don't understand side effects of using debug builds, install Termux only from F-Droid.

---

Edit: the key itself is only part of issue (it is only GitHub test builds identity). Termux is open source application which lets other people to create own builds, either from original source or with modifications.

Considering this fact, please don't be surprised if you find something like Termux 2.0 or Termux Ultra Mod on trashy web sites. We can't stop people from making derivatives for obvious reasons.

What user can do is to either choose to follow Termux developer suggestions (download app from F-Droid) or go the own way with taking all potential risks.