Install BreathGate
Version 0.14.1 · Android 8.0+ · GPL-3.0-or-later
Three routes. Each one carries the fingerprint to check it against, so you can confirm you have the build I signed.
Three ways to install it. Each one comes with a long code beside it. Compare that code against what your phone shows and you know the app is the one I made, unchanged.
01 F-Droid
Add the repository to the F-Droid client and it updates like any other app.
aureliusxradix.github.io/fdroid/repo
repository fingerprintA859EAFDA0219053FFEEEA63155CDB4C62B12959F61DF53A3839B5554BB8E504
Paste the URL up to the ?, then compare the fingerprint the client shows against the one here.
02 Obtainium
Point Obtainium at the source and it tracks each release directly.
github.com/Aureliusxradix/BreathGate
APK signing key, SHA-256d0b6b276aa2cffc4b1b2850d2373dd3958c92bd68aa29a6ed76c17ffb25d75b0
Add a no-scope GitHub token in Obtainium's settings, so a rate limit reads as a rate limit rather than as 'up to date'.
03 Sideload
Download the APK from the release page and install it by hand.
github.com/Aureliusxradix/BreathGate/releases
APK signing key, SHA-256d0b6b276aa2cffc4b1b2850d2373dd3958c92bd68aa29a6ed76c17ffb25d75b0
Every release is downloaded back and compared against the signed build before it is announced.
What the manifest declares
Six permissions, readable before you install. INTERNET sits outside the list, which is what makes the offline claim checkable rather than promised.
Android makes an app list every power it wants before you install it. BreathGate lists six, and every one of them acts on your phone alone. Internet access sits outside that list, which is why "it works offline" is something you can check rather than something I ask you to believe.
PACKAGE_USAGE_STATS | sees which app comes to the foreground |
|---|---|
SYSTEM_ALERT_WINDOW | draws the gate over the app you opened |
FOREGROUND_SERVICE | keeps watching while you use the phone |
FOREGROUND_SERVICE_SPECIAL_USE | the category Android requires for that service |
POST_NOTIFICATIONS | the ongoing notice the service is obliged to show |
RECEIVE_BOOT_COMPLETED | starts again after a restart |
The release script halts if a build acquires a permission outside this list, so the check runs on every release rather than on memory.
The script that publishes each new version stops dead if the app has picked up any power outside this list. So the check happens every single release, instead of depending on me remembering.
What it does