AgePony 4.2.0

Fetch a recipient's key over Tor, encrypt to a YubiKey, and find your way around
a little more easily.

This release adds the network and hardware pieces people asked for, and fills in
the parts of the app that were doing their work without ever explaining
themselves. Nothing about the file format or the vault changes, so upgrading in
place keeps every identity, recipient and note.

Added

• Proxy for key lookup. The one time AgePony reaches the network, the GitHub
  key fetch under Add Recipient, can now go through a proxy, set in Settings >
  Network. Off (a direct connection, the default), Orbot (Tor, one tap for
  127.0.0.1:9050), or Custom (your own SOCKS5 or HTTP host and port). An optional
  username and password are sent as SOCKS auth; for Tor that is stream isolation,
  so AgePony's traffic rides its own circuit. The hostname is resolved at the
  proxy, not on the device, so a lookup over Tor does not leak the name to the
  local network.
• YubiKey recipients. AgePony now accepts age1yubikey1... recipients from
  age-plugin-yubikey and encrypts to them, using the piv-p256 format (P-256 ECDH,
  HKDF-SHA256, ChaCha20-Poly1305). Only the YubiKey can decrypt, so AgePony
  encrypts to one of these but does not read it back; the file opens with age
  and the key.
• Configurable auto-lock. Settings > Auto-lock now sets how long AgePony waits
  after you leave the app before it locks: immediately, 15 seconds, 30 seconds
  (the default), one minute, or five minutes. A quick switch to paste a key no
  longer costs you your place.
• Recently deleted. Deleting an identity or recipient now moves it to a recycle
  bin instead of erasing it, reachable from the Identities screen. Restore an
  accidental delete, or remove it for good; entries age out after 30 days. This
  matters most for identities, where a delete otherwise takes a private key with
  it.
• Key avatars. Identities and recipients now carry a small colored avatar
  derived from the key, so two age1... entries are easy to tell apart at a
  glance. The same key always draws the same avatar.
• In-app Help, Security, and Licenses. Settings gains a plain-language FAQ, a
  single page describing how AgePony protects your files and what it does not do,
  and the open-source notices for the libraries the app builds on.

Fixed

• Passphrase fields are hidden. The passphrase boxes on the Decrypt, Text
  decrypt, and Migrate screens showed what you typed in the clear. They are now
  masked and use a password keyboard, so the input is not offered to autocorrect.
  The other passphrase and PIN fields were already masked; these three were not.

Deliberate limits

• The proxy covers the key fetch, nothing else. That GitHub request is the
  only time AgePony reaches the network for key material, so it is the only thing
  routed. Links you open from Settings still go to the system browser.
• A half-set or dead proxy fails loudly. Enable a proxy with a blank host or
  port, or point it at something unreachable, and the fetch reports the failure
  rather than quietly falling back to a direct connection. A direct connection you
  did not ask for is the exact leak the proxy exists to prevent.
• AgePony encrypts to a YubiKey recipient but cannot decrypt for one. The
  private key never leaves the YubiKey, so decryption happens with age and the
  key, not in AgePony.

Compatibility

• No format change. agepony-core gains the piv-p256 recipient and a
  read-only helper for spotting a tar header, and nothing else. The age
  implementation, the other recipient types and the streaming payload cipher are
  untouched. Files written by 4.2.0 are ordinary age files, and files from earlier
  AgePony versions or the age CLI open unchanged.
• No vault change. Proxy and auto-lock settings are stored as app preferences,
  not in the encrypted vault, so upgrading in place keeps every identity, recipient
  and note.
• F-Droid gets everything. Every change lives in src/main and agepony-core;
  the foss flavor carries the whole release. The only Google dependency stays
  scoped to the play flavor, as before.

versionCode 15, versionName 4.2.0.

Verifying this build

This release is reproducible. Two independent builds from clean clones of the v4.2.0 tag are byte-identical, and the published APK matches them; the same check runs in F-Droid's clean room.

• Content hash (signatures ignored, for reproducible-build verification): a906e2ef85203f831e07f45949f46b7e3d6707745137adc0ea789cd479255af7
• Whole-file SHA-256 of the download: 3f61ef5b2c77e56c7ee3a7e6a0354ae4964943e30fdd1951245c376e259484cf (also in AgePony-4.2.0-foss.apk.sha256)
• Signature: AgePony-4.2.0-foss.apk.asc, made with the NorseHorse release key, the same key F-Droid distributes.

The foss APK is the F-Droid build; it installs over an F-Droid copy with no uninstall.