Buzz — unofficial Android builds

Automated, unofficial CI builds of the block/buzz mobile app (Apache-2.0), for people who want Buzz on Android via Obtainium — upstream currently publishes no Android APKs anywhere.

Not affiliated with or endorsed by Block. Built verbatim from upstream source at their mobile-v* release-candidate tags, using their Hermit-pinned toolchain, in public GitHub Actions (auditable: see .github/workflows/build.yml).

Install with Obtainium

Tap on the device with Obtainium installed:

obtainium://add/https://github.com/fredabood/buzz

or add https://github.com/fredabood/buzz manually. Default settings work — every release has exactly one universal APK, marked non-prerelease. New upstream mobile tags are detected within 6 hours and released automatically.

Verify what you install

Every APK is signed with the same personal certificate:

SHA-256: C0:20:5E:95:FC:AA:56:DC:21:8B:8A:82:9B:6A:C5:3D:28:BD:C5:E4:55:89:B1:1D:22:18:81:A0:29:99:30:D7

Check with apksigner verify --print-certs buzz-mobile-*.apk. CI refuses to publish if a build's certificate deviates from this fingerprint.

Caveats

• Signature conflict with any future official build. These APKs keep upstream's applicationId (xyz.block.buzz.mobile) but use a different signing key than anything Block might ship later. Android forbids cross-signature updates: to switch to an official APK you must uninstall this one first (chat data lives on your relays; your identity is your Nostr key, so loss is minimal — export/back up your key first regardless).
• No relay is baked in. These builds carry no compile-time server default, so a fresh install starts with upstream's http://localhost:3000 fallback and you add your community in-app, as usual. (Earlier releases — up to and including mobile-v0.16.0-rc.2 — did bake one in. That was dropped because this repo is public and the value was a private host's address; see the note below.)
• Versions mirror upstream mobile-vX.Y.Z-rc.N tags. Upstream cuts release candidates roughly weekly; whatever they tag is what gets built, unmodified.
• If upstream starts publishing official Android builds (block/buzz#2845), prefer those — this repo exists only to fill that gap and will be archived when it closes. CI watches for that and opens a discontinue notice on its own.

How it works

build.yml runs every 6 hours (and on manual dispatch), and delegates everything that isn't Buzz-specific to fredabood/apk-forge — the shared scaffold this repo is the worked example for:

1. apk-forge/resolve-ref lists upstream mobile-v* tags (upstream has tags but no mobile releases), ranks them semver-aware — plainly, because git/matching-refs sorts lexically and 0.10.0 arrives before 0.4.0 — and exits early if this repo already has that release.
2. Checks out block/buzz at the tag and activates upstream's own Hermit toolchain (Flutter, JDK).
3. .github/actions/build runs flutter build apk --release with --build-name/--build-number derived from the tag (upstream's pubspec is intentionally 0.0.0+1; version injection is the release pipeline's job), signing via upstream's BUZZ_ANDROID_UPLOAD_* environment contract with a keystore held only in GitHub Actions secrets.
4. apk-forge/verify-and-publish checks the signing certificate against the fingerprint above and refuses to publish on any deviation — an unsigned or differently-signed APK can never update an installed one — then cuts the release.

A note on the relay URL

Until 2026-09-02 this repo baked a specific relay URL in as a compile-time default, and named that host in the README, in the workflow, and in every release body. It was removed because this repo is public and the value was a private host's address. It is not repeated here, for the same reason.

Being straight about what that fixes: the name is still in this repo's git history, in the bodies of already-published releases, and compiled into every APK downloaded before the change. Removing it stops further disclosure; it does not unpublish. History was deliberately not rewritten — it would reach neither the published artifacts nor the installed APKs, and the host is reachable only on its owner's private network, so what leaked is an unreachable name rather than an exposed service.