v0.9.9 — upstream engine repin

v0.9.9 — upstream engine repin (under-the-hood)

Rebases the native chat engine (libchat) onto the latest upstream so Peers stays
current (d2124fd → 462a4884, +9 commits). No new user-facing features — the goal is
currency, stability, and groundwork. Your existing conversations carry over.

🔁 Engine / infrastructure (#427)

• Rebased the entire Peers fork onto upstream libchat main (+9 commits): #184
  delivery-based key/account publishing, #188/#189 roster + participant listing, #194
  one-step group-with-members creation, and upstream CI/build fixes.
• Re-homed our offline-contact-card feature and the GHSA-xxgx-7757-3qq6 key-package
  device-binding onto upstream's rewritten registry. The online binding is now enforced
  by upstream's own authenticated key retrieval; the offline-card path keeps our verify.
• Deferred upstream's XWING post-quantum ciphersuite flip — kept MLS_128 so this build
  stays wire- and storage-compatible with v0.9.8 (existing chats + old-version peers keep
  working). XWING will land later as a proper dual-suite migration.

✅ Verification

• 85 native (Rust) tests + 37 provenance/ABI tests + 508 app tests, all green.
• New arm64 liblogoschat.so rebuilt from the single consolidated patch (26 FFI symbols);
  fail-closed security-marker assertions pass; provenance refreshed in SBOM.md +
  SHA256SUMS. On-device runtime smoke passed (loads + runs, no crash).

Native core published by xAlisher/logos-libchat-mls-android@3c38687.

v0.9.8 — data-loss + duress-PIN hardening

v0.9.8 — data-loss + duress-PIN hardening

🐛 Fixes

• Encrypted-DB migration (#488): closes a rare window where a crash during the at-rest
  encryption migration could delete a valid encrypted chat database. The migration now confirms
  the file with a keyed open before ever treating it as a leftover.
• Duress PIN (#489): blocks setting a main PIN that collides with the duress PIN (which could
  silently wipe on the next unlock), resolves any pre-existing collision to unlock rather than
  wipe, and removes a visible "Preparing…" cue so a duress unlock looks like a normal one.

App-side only — the native library is unchanged. Seamless update; just refresh F-Droid.

Thanks to @x0net for both reports.

v0.9.7 — security hardening

v0.9.7 — security hardening

🔒 Security

• Hardened the native MLS core (group membership + offline contacts): a KeyPackage
  fetched for a device is now cryptographically bound to that device before it can
  join a group, and offline contact cards must carry a valid device signature over
  their key package before they're used. Closes a group-membership integrity gap.
  Coordinated with upstream libchat; details will follow in a security advisory.

🔁 Other

• Native library bump (liblogoschat.so); provenance + SBOM updated to match.

Seamless update from 0.9.x — just refresh F-Droid. No re-add or restore needed.

v0.9.6-media — media viewer polish (download, video, cleaner controls)

Seamless update from 0.9.x. Polish + bug fixes for the new media viewer (#483).

🐛 Fixes

• Download now works — it was silently no-op'ing (swallowed error, no feedback). It saves the
  photo/GIF/video to your gallery and confirms with a toast.
• Video actions work in full-screen — the native video was eating taps, so the controls never
  appeared. Now tap reveals the bar and download / share / forward work for video too.
• First tap is clean — opening media shows it full-screen with no controls; the close button
  appears only on the second tap.
• Smoother close — removed the animations/transitions that glitched while closing.
• GrapheneOS — no more empty bar above the chat header after closing a photo (stopped hiding
  the status bar).

🔁 Other

• Removed the redundant close from the bottom action bar (top-right X + swipe-down + back remain).
• Bigger tap targets on the viewer's action icons.

v0.9.5-media — new full-screen media viewer + HQ photos

Seamless update from 0.9.x — same signing key, F-Droid updates in place.

✨ Features

• Brand-new full-screen media viewer (#479). Tap any photo, GIF, or video and it opens
  edge-to-edge (fixing the old "sits under the title bar" bug). Tap to toggle a bottom bar
  (sender + download / share / forward / close) and a top-right close. Pinch to zoom,
  swipe down to dismiss, and swipe left/right to page through every photo/GIF/video in the
  chat — one viewer for all media, video plays inline.
• Share media out of the app. The viewer's share icon opens the Android share sheet for the
  photo/video.
• HQ photos (#423). A small HQ toggle by the composer thumbnail (gray off / orange on) sends
  a photo in high quality via storage instead of the compressed inline version — and it's decided
  at Send, so toggling works before or after attaching. Disabled in storage-off groups.

🐛 Fixes

• #422 — photo + camera are always available in a storage-off group (they never used storage;
  only GIF/video do).

🔁 Other

• Adds react-native-gesture-handler + reanimated (New Architecture) as the media-viewer foundation.
• Repo hygiene: issue/PR templates + rate-limited Dependabot (#456); metadata-privacy SoK research
  doc (#317).

v0.9.4 — fewer false error banners + tidier group recovery

Seamless update from any 0.9.x build — same signing key, so F-Droid updates in place (no reinstall).

🐛 Fixes

• No more "welcome not addressed to this member" banner (#455). Adding a member broadcasts an
  MLS Welcome to the whole group, and every member who isn't the one being added would see a red
  banner for it — normal group traffic, not an actionable error. It's now filtered (same treatment
  as the 0.9.3 "No matching key package" fix), so the banner only shows for a real failure.

🔁 Other

• Tidier group recovery (#324/#433). When you tap "Ask to be re-added" after falling out of
  sync, the request now goes only to the group's creator — the one member who can actually
  re-add you — instead of being broadcast to everyone. Same experience for the person asking; less
  traffic, less metadata, and no stray recovery message landing in every other member's 1:1.

v0.9.3 — no more stuck 'key package' banner

Seamless update from any 0.9.x build — same signing key, so F-Droid updates in place (no reinstall).

🐛 Fixes

• No more stuck "No matching key package" banner (#446). The red top banner reading
  "No matching key package was found in the key store" could appear during ordinary group
  catch-up — when a member is briefly offline, reinstalled, or their key package was already
  consumed — and stay stuck even though nothing was actually wrong. These benign reconcile
  errors are now filtered, so the banner only shows for a real, actionable failure
  (e.g. you genuinely can't be added to a group).
• Failed group sends now read as "catching up", not broken (#446). If a group message
  fails to send right after a restore/reinstall (you're briefly behind the group's MLS epoch),
  the app shows "catching up with the group — tap the message to retry in a moment" and kicks
  a catch-up automatically. 1:1 sends keep the plain "send failed — tap the message to retry".

🔁 Other

• CI hardening (#449). The test workflow can now be re-run by hand (workflow_dispatch) so a
  PR whose checks were dropped during a GitHub Actions webhook throttle can be unblocked without
  an empty commit. Added a unit test for the send-failure copy. No app-facing change.

v0.9.2-fixes — member count, avatar reset, precise ping-creator

Rollout polish — seamless update from 0.9.1 (same signing key, just refresh F-Droid).

✨ Features

• Group member count in the header (#444). Open a group and the member count shows as a second line under the name, matching the conversation list.

🐛 Fixes

• Reset now clears your custom avatar (#441). Resetting your identity (or restoring a backup) no longer keeps the previous identity's custom sigil — a fresh identity shows its own generated identicon; a restore re-hydrates the backed-up one.
• "Ping creator" targets the real creator (#442, #433). In an ended group, Ping creator now DMs the group's actual recorded creator (read from authenticated MLS group state) instead of the first member on the roster. Groups created before this record no creator and fall back to a best guess.
• Smoother restore into groups (#446, partial). After restoring a backup the app forces a catch-up, shrinking the window where a just-restored member can't post yet.

🔁 Other

• Native liblogoschat.so gains a group_creator accessor (the #442 enabler); rebuilt + re-provenanced (c5293f89…).

Known issues

• #446: the full auto-retry + friendlier "catching up / member offline" message (instead of the raw "No matching key package") is still in progress.
• #442: the fix is verified/deployed; the final on-screen assertion awaits a dead post-#349 group to test against.

v0.9.1-signed — GrapheneOS restore fix

Hotfix: restore now works on GrapheneOS. Same signing key as 0.9.0 — updates seamlessly.

🐛 Fix

• GrapheneOS reinstall+restore (#445). On hardened ROMs, app data / the database key could survive an uninstall, so a fresh install refused to open its database and blocked Restore from backup with "secure storage unavailable / ChatRepo.init not called". 0.9.1 recognises that state as a clean first run and restores normally.

Who needs this

• On 0.9.0 already? Seamless F-Droid update, no reinstall (same key).
• Doing the 0.9.0 signing-key reinstall for the first time? Use 0.9.1 — it restores cleanly on GrapheneOS.
• Hit the error on 0.9.0? Update to 0.9.1 and restore again (or clear Peers storage once and retry — your backup file in Downloads is untouched).

Signer unchanged: CN=Peers, SHA-256 67083e…68bf.

v0.9.0-signed — production signing (one-time reinstall + restore)

The signing migration — one manual reinstall, then seamless forever.

Peers is now signed with our own production key (CN=Peers) instead of the throwaway Android debug key. That's a real security fix — nobody can forge a build as "Peers" — but Android won't auto-update across a signing-key change, so this release needs a one-time uninstall + reinstall. The identity backup shipped in v0.8.9 is what carries you across it.

Do it in this order

1. Back up first (if you didn't on v0.8.9): About → Back up identity + chats → passphrase → save the file off your phone.
2. Uninstall Peers.
3. Install v0.9.0 from F-Droid (refresh the repo).
4. Restore: About → Restore from backup → passphrase → pick the file. Same address, chats back.

No backup = no way back. Full steps: https://github.com/xAlisher/peers/blob/main/docs/TESTING.md#what-to-test-in-this-release

🔒 What changed

• Production release signing (#356). APK now verifies as CN=Peers / SHA-256 67083e…68bf, not the Android debug key.
• Everything from v0.8.9 (identity backup + restore, group desync auto-recovery) carries forward.

🔁 After this

Updates go back to being seamless — no more reinstalls.