Verify a BitGab download

curl -O https://dl.bitgab.app/app-libre-release.apk
curl -O https://bitgab.app/SHA256SUMS
sha256sum -c SHA256SUMS

sha256sum -c prints app-libre-release.apk: OK when the file matches. To see the digest without the check, run sha256sum app-libre-release.apk.

Expected SHA-256 for this release:

The checksums file currently reads RELEASE_PENDING when no release metadata is published. That is a placeholder, not a digest. Do not install a file that only matches a placeholder.

The full checksums file is at /SHA256SUMS. It covers the libre APK. The gms APK is a separate artifact and carries its own published checksum with the release.

apksigner verify --print-certs app-libre-release.apk

The expected certificate SHA-256 fingerprint is:

apksigner prints the digest without colons. Compare it with:

7757e7bb2d2f8a4d5d0e86b90efbc0cf89b6ae2b30a2d9d32782fbb351ca78b3

A matching signature proves the APK was signed by this key. It does not prove the code is safe, and it does not prove what the server does. There is no third-party audit.

curl -sI https://bitgab.app/

The response must include the headers below. Cloudflare may add others; these must be present and must not be weakened.

Content-Security-Policy: default-src 'none'; script-src 'none'; style-src 'self'; img-src 'self'; font-src 'none'; connect-src 'none'; form-action 'none'; frame-ancestors 'none'; base-uri 'none'; upgrade-insecure-requests
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: accelerometer=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
Cross-Origin-Opener-Policy: same-origin
X-Frame-Options: DENY

The policy is generated in _headers and applied to every path. script-src 'none' means no executable script can run, including inline handlers. The two JSON-LD data blocks are not JavaScript; they are inert data and are not executable.

The app pins explicit hosts, not a wildcard subtree:

• bitgab-api.bitgab.workers.dev
• bitgab-api-development.bitgab.workers.dev
• bitgab.app
• api.bitgab.app
• dl.bitgab.app

www.bitgab.app is deliberately not pinned.

The pin set expires on 2027-06-30. After that date Android ignores the pins and falls back to public CA validation. An installed app is not bricked by the expiry; the pin guarantee ends.

Pinning raises the cost of a misissued certificate. It does not protect against a CA that can issue for a pinned CA, and it does not hide traffic timing or volume.

The source is not published. BitGab does not commission third-party audits, and there is no SOC 2 report or ISO 27001 certificate. A customer may commission an assessment of its own deployment at its own expense, with an assessor of its choosing.

The server claims in privacy and limitations are documented against the private repository. They are not independently audited. If a claim matters to your decision, ask for dated evidence under NDA as part of a pilot.

The machine-readable claim index is at /claims.json. Its evidence paths refer to the private repository; they are listed for traceability, not as public source.

Send the URL you downloaded from, the file name, the SHA-256 you computed, the signer output from apksigner, and the headers you observed to security@bitgab.app.

See the security and disclosure policy for scope and what to include. BitGab does not promise response times.