PGPonyAndroid - GitLite

KO | EN

gitlite — search

#typescript #llm #go #android #deep-learning #linux #java #windows #cli #awesome-list #vue #mcp #openai #open-source

PGPonyAndroid

(★ 58)

Private OpenPGP for Android. Hardware security keys, password-store, no tracking. Open source.

파일 탐색기

최종 버전 다운로드 (.zip)

- - reproducible.yml
- build.gradle.kts
- proguard-rules.pro
- PQC_1024_INTEROP.md
- REPRODUCIBLE_BUILDS.md
- V6_INTEROP_MATRIX.md
- - gradle-wrapper.jar
  - gradle-wrapper.properties
- pgpony_feature_graphic_1024x500.png
- pgpony_play_icon_512.png
- fetch_rfc9580_vectors.sh
- verify_repro.sh
.gitignore
build.gradle.kts
gradle.properties
gradlew
gradlew.bat
LICENSE
PGPony-4.1.1-foss.apk.asc
PGPony-4.2.0-RC2-foss.apk.asc
PGPony-4.2.0-RC2-foss.apk.sha256
PGPony-4.2.0-RC3-foss.apk.asc
PGPony-4.2.0-RC3-foss.apk.sha256
PGPony-4.2.0-RC4-foss.apk.asc
PGPony-4.2.0-RC4-foss.apk.sha256
PGPony-4.2.0-RC5-foss.apk.asc
PGPony-4.2.0-RC5-foss.apk.sha256
PGPony-4.2.0-RC6-foss.apk.asc
PGPony-4.2.0-RC6-foss.apk.sha256
PGPony-4.2.1-RC1-foss.apk.asc
PGPony-4.2.1-RC1-foss.apk.sha256
README.md
RELEASE_NOTES_4.2.0.md
RELEASE_NOTES_4.2.1.md
RELEASE_NOTES_4.3.0.md
RELEASE_NOTES_4.3.1.md
RELEASE_NOTES_4.3.2.md
REPRODUCIBLE_BUILDS_PLAYBOOK.md
settings.gradle.kts

# 설치 가이드

1. 코드 내려받기

git clone https://github.com/norsehorse-dev/PGPonyAndroid

깃허브에서 프로젝트 코드 전체를 내 컴퓨터로 내려받습니다.

cd PGPonyAndroid

방금 내려받은 프로젝트 폴더 안으로 이동합니다.

2. Gradle (Java/Kotlin)

보통 추천

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
JDK (Java) Java/Kotlin 프로젝트를 빌드/실행하려면 필요합니다.
Gradle 레포에 포함된 gradlew(Gradle Wrapper)를 쓰면 Gradle을 따로 설치할 필요가 없습니다.

./gradlew assembleFossRelease

Gradle로 빌드를 진행합니다.

./gradlew assemblePlayRelease

Gradle로 빌드를 진행합니다.

✅ BUILD SUCCESSFUL 메시지가 뜨면 성공입니다. build/ 폴더에 결과물이 생성됩니다.

이 레포의 README에 적힌 실제 명령어를 그대로 가져왔습니다.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# PGPony for Android

OpenPGP for Android. Encrypt, decrypt, sign, and verify messages and files,
manage your keyring, and use a hardware security key over NFC, all on device.

PGPony has no accounts, no ads, no analytics, and no tracking. The `foss`
build contains no Google services and runs fully on de-Googled devices.

## Features

- Encrypt, decrypt, sign, and verify text and files
- Modern key generation, including RFC 9580 (OpenPGP v6) Ed25519 and X25519,
  with Argon2id passphrase protection
- Hardware security keys over NFC (YubiKey 5 NFC, Token2): on-card key
  generation, decrypt, sign, PIN management, and factory reset
- Read-only password-store (pass) support, including hardware-key entries
- Key discovery via WKD and the keys.openpgp.org verifying keyserver
- Optional contacts integration, QR import and scanning
- Biometric lock and secure-screen protection

## Build

The app ships two product flavors:

- `play`: Google Play build. Includes the Play In-App Review dependency.
- `foss`: F-Droid / IzzyOnDroid / direct APK. No Google Play dependencies.

```
./gradlew assembleFossRelease
./gradlew assemblePlayRelease
```

Debug variants are `assembleFossDebug` and `assemblePlayDebug`.

## Verify a release

Every release is built reproducibly, so you can rebuild the APK from the
tagged source and confirm it matches the published binary bit for bit,
and you can confirm the published APK is signed with the project's own
key. You do not have to trust the download.

Verify the signature and certificate. The release APK is signed with the
PGPony release key; its certificate SHA-256 fingerprint is:

```
446bf9e621222a40c66cd2476e1a97105ccb2a9b16a01a91c1c7eb90765b50dc
```

Check a downloaded APK against it with the Android build tools:

```
apksigner verify --print-certs PGPony-<version>-foss.apk
```

The printed "certificate SHA-256 digest" must equal the fingerprint
above. A detached OpenPGP signature (`.asc`) and a `.sha256` are
published beside every release APK; the release notes carry the
whole-file SHA-256 for downloaders and a content hash for rebuilders,
each labeled with what it means.

Rebuild from source and compare. The release gate script clones a tag
twice into clean, isolated build roots, proves the two builds are
byte-identical, and compares them against a candidate APK:

```
tools/verify_repro.sh rebuild v<version> PGPony-<version>-foss.apk
```

It requires an Android SDK and network access for the clone and
dependency downloads, and prints per-dex SHA-256s and the canonical
content hash. The full procedure, and how this maps to F-Droid's own
verification, is in `REPRODUCIBLE_BUILDS_PLAYBOOK.md` and
`docs/REPRODUCIBLE_BUILDS.md`.

## License

Apache License 2.0. See `LICENSE`.

The cryptographic core is maintained separately as open source:
[PGPonyCore-Kotlin](https://github.com/norsehorse-dev/PGPonyCore-Kotlin).

## Links

- Website: https://pgpony.app
- Source: https://github.com/norsehorse-dev/PGPonyAndroid
- Desktop: https://github.com/norsehorse-dev/PGPonyDesktop