bitchat-android @ v2.0.3

integrity

size: 15.7 MiB
downloaded: 2026-10-23 10:02 UTC
last checked: 2026-10-23 10:02 UTC

source https://github.com/permissionlesstech/bitchat-android · available · github

release notes

Bitchat Android 2.0.3

Signed phone and Wear OS builds from v2.0.3 (source commit dfc67dad41691128bc6e7425bd69f2f409cb5bbf). Canonical unsigned outputs were built independently twice and matched byte-for-byte before local signing.

Highlights

Smoother busy chats: reduce UI stalls during bursts of geohash presence and mesh activity, batch identity updates, and compose participant lists lazily.
Bounded resource use: cap packet-processing queues and pace sync responses to keep heavy traffic from creating an unlimited backlog.
More reliable connectivity: continue retrying Nostr relays after network and DNS failures, with refreshed relay data.
Messaging correctness and security: verify incoming geohash event signatures before duplicate detection; preserve original compressed packet bytes for cross-client signature verification and forwarding; improve duplicate detection and geohash channel routing.
Safer panic wipe: remove the private-conversation database files if normal conversation erasure fails.
Wear OS polish since 0.1.1: shape-aware layouts for small round displays and larger fonts, compact fading chat headers, steadier scroll controls and autoscroll, refreshed icons, and an ongoing activity for returning to the mesh session.

History retention

Public chat and channel timelines now retain the latest 1,000 messages each, with up to 20 recently active channel timelines in memory. Older public messages are not archived by this change. Private-conversation history keeps its existing persistent retention policy.

Versions

Phone: 2.0.3 (40), minimum API 26, target API 37.
Wear OS: 0.1.5 (1000000006), minimum API 33, target API 37.
Both use application ID com.bitchat.droid.

The Wear layout, icon, and ongoing-activity changes above are new relative to the previous GitHub release, but were already included in the separate Play Wear 0.1.4 release. Wear 0.1.5 additionally incorporates the shared mesh, sync, and identity fixes.

Verification and known limitations

Independent local and tagged CI builds matched. Exact-tag provenance, signatures, signing continuity against prior artifacts, bundle validation, payload comparisons, and release checksums passed. Unit and contract checks passed (860 tests passed, 3 skipped). A clean installation and an in-place upgrade from the signed 2.0.1 APK launched to onboarding on a disposable emulator.

Known issue: QR scanner initialization can crash in this release; the pending crash fixes are not included. Full physical-device/cross-client/endurance and Play-delivered install/upgrade testing have not been completed. Existing lint errors and unavailable changed-line coverage remain; these are not claimed as passes.

Downloads and signing

Only four signed APKs, the two signed Play-upload AABs, and three reproducibility metadata files are attached. No unsigned APK or AAB is published; BITCHAT_SHA256SUMS.unsigned contains their canonical hashes, not binaries.

bitchat-android-arm64.apk — modern Android phones.
bitchat-android-universal.apk — compatibility fallback.
bitchat-android-x86_64.apk — x86_64 devices and emulators.
bitchat-android-wear.apk — direct Wear OS installation.
bitchat-android-play-upload.aab — signed phone bundle for Google Play.
bitchat-android-wear-play-upload.aab — signed bundle for the dedicated Wear OS track.

Certificate SHA-256 fingerprints:

GitHub APK and existing Play upload certificate: 3b03fa66a5451321100792f5b55a7b4966d5c8dc10c6daa40aa95ea489531bca.
Google Play app-signing certificate: 5e651dd0c80d1f57f2617964955085e28949dd04addac7b53fe9d2f11e172aa2.

Google signs Play-delivered APKs with its separate app-signing key; those APKs are not expected to be byte-identical to GitHub APKs.

Reproducible-build verification

Use Git, Docker with sufficient memory, and the GitHub CLI:

git clone https://github.com/permissionlesstech/bitchat-android.git
cd bitchat-android
git checkout v2.0.3
tools/reproducible-builds/build-in-container.sh .reproducible-build/verify-v2.0.3
gh release download v2.0.3 --pattern 'BITCHAT_BUILDINFO.json' --pattern 'BITCHAT_SHA256SUMS*' --dir .reproducible-build/metadata-v2.0.3
gh attestation verify .reproducible-build/metadata-v2.0.3/BITCHAT_BUILDINFO.json --repo permissionlesstech/bitchat-android
gh attestation verify .reproducible-build/metadata-v2.0.3/BITCHAT_SHA256SUMS.unsigned --repo permissionlesstech/bitchat-android
cmp .reproducible-build/verify-v2.0.3/SHA256SUMS.unsigned .reproducible-build/metadata-v2.0.3/BITCHAT_SHA256SUMS.unsigned

To verify all downloaded release files without rebuilding:

gh release download v2.0.3 --repo permissionlesstech/bitchat-android --dir .reproducible-build/download-v2.0.3
(cd .reproducible-build/download-v2.0.3 && shasum -a 256 -c BITCHAT_SHA256SUMS)

Full changelog: https://github.com/permissionlesstech/bitchat-android/compare/v2.0.1...v2.0.3

download

unix · zip

curl -fL -o v2.0.3.zip https://ratatoskr.space/pkg/bitchat-android/v2.0.3.zip
                    printf '%s  %s\n' '3801c132494046bab096239919be3d57ec75930d6c5958ae68dee496e5aa51ed' 'v2.0.3.zip' | sha256sum -c -

windows · zip

$url = "https://ratatoskr.space/pkg/bitchat-android/v2.0.3.zip"
$out = "v2.0.3.zip"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "3801c132494046bab096239919be3d57ec75930d6c5958ae68dee496e5aa51ed") { throw "sha256 mismatch" }

unix · tar.gz

curl -fL -o v2.0.3.tar.gz https://ratatoskr.space/pkg/bitchat-android/v2.0.3.tar.gz
                    printf '%s  %s\n' 'fb751cd051bf908bf949579a79a31016da07da13bf0dee197bf64e415137fe4a' 'v2.0.3.tar.gz' | sha256sum -c -

windows · tar.gz

$url = "https://ratatoskr.space/pkg/bitchat-android/v2.0.3.tar.gz"
$out = "v2.0.3.tar.gz"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "fb751cd051bf908bf949579a79a31016da07da13bf0dee197bf64e415137fe4a") { throw "sha256 mismatch" }

download via yggdrasil mesh

unix · zip

curl -fL -o v2.0.3.zip http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/bitchat-android/v2.0.3.zip
                    printf '%s  %s\n' '3801c132494046bab096239919be3d57ec75930d6c5958ae68dee496e5aa51ed' 'v2.0.3.zip' | sha256sum -c -

windows · zip

$url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/bitchat-android/v2.0.3.zip"
$out = "v2.0.3.zip"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "3801c132494046bab096239919be3d57ec75930d6c5958ae68dee496e5aa51ed") { throw "sha256 mismatch" }

unix · tar.gz

curl -fL -o v2.0.3.tar.gz http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/bitchat-android/v2.0.3.tar.gz
                    printf '%s  %s\n' 'fb751cd051bf908bf949579a79a31016da07da13bf0dee197bf64e415137fe4a' 'v2.0.3.tar.gz' | sha256sum -c -

windows · tar.gz

$url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/bitchat-android/v2.0.3.tar.gz"
$out = "v2.0.3.tar.gz"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "fb751cd051bf908bf949579a79a31016da07da13bf0dee197bf64e415137fe4a") { throw "sha256 mismatch" }

artifact	format	size	hashes
v2.0.3.zip	zip	16.2 MiB	blake3-24 f507f1cc8f65fa6f3ad44a36c57c199fcc6dce852ecb5d70 sha256 3801c132494046bab096239919be3d57ec75930d6c5958ae68dee496e5aa51ed sha1 49238a2b0b3eb954e11be19b8183fa8743ed5108
v2.0.3.tar.gz	tar.gz	15.8 MiB	blake3-24 364e81e3043c773d07d0922a0d079869df47411e4b44afad sha256 fb751cd051bf908bf949579a79a31016da07da13bf0dee197bf64e415137fe4a sha1 5f5943729b08cb08ed7c77da43cf3595dd29600d

install

bazel

http_archive(
    name = "bitchat-android",
    urls = ["https://ratatoskr.space/pkg/bitchat-android/v2.0.3.tar.gz"],
    integrity = "sha256-+3Uc0FG/kIv5SVeaeaMQFtoH2hO/De4Ze/ZOQVE3/ko=",
    strip_prefix = "bitchat-android-v2.0.3",
)

zig

.url = "https://ratatoskr.space/pkg/bitchat-android/v2.0.3.tar.gz",

install via yggdrasil mesh

bazel

http_archive(
    name = "bitchat-android",
    urls = ["http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/bitchat-android/v2.0.3.tar.gz"],
    integrity = "sha256-+3Uc0FG/kIv5SVeaeaMQFtoH2hO/De4Ze/ZOQVE3/ko=",
    strip_prefix = "bitchat-android-v2.0.3",
)

zig

.url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/bitchat-android/v2.0.3.tar.gz",

v2.0.1 →