ARPrelease pocket

Local release verification

Hand users an APK they can trust.

Verify the signer, version, SDK, ABI, and every byte—then publish a tiny install page with QR guidance and signed rollback history.

Checking latest release…Detecting your platform Install another way

Looking for the latest verified CLI build…

01 no uploads

02 no re-signing

03 immutable rollback

04 JSON for CI

A release, not an attachment

One check at the counter.

Generic file hosts stop at “download.” ARP carries the publisher identity and device fit all the way to the person installing.

  1. 01 / inspect

    Read what will ship

    Parses the manifest for package, version code, SDK range, and native ABIs.

  2. 02 / verify

    Prove who signed it

    Checks the v2 signer signature and independently recomputes the APK content digest.

  3. 03 / pocket

    Publish the handoff

    Writes an install page, QR link, checksums, release JSON, and immutable prior builds.

Install the inspector

One command. No account.

The installer reads the signed GitHub Release manifest and verifies SHA-256 before placing arp on your path.

release-counter
$curl -fsSL https://apk-release-pocket.sociobot.in/install.sh | sh
PSirm https://apk-release-pocket.sociobot.in/install.ps1 | iex
Then:arp release app-release.apk --out ./pocket --base-url https://downloads.example.com
Native packagesHomebrew & ScoopFull CLI reference

! macOS and Windows builds are unsigned in v0.1.0. Always compare the published checksum; the installers do this automatically.

What users see

The release receipt stays with the APK.

✓ VERIFIED

Pocket Notes 1.4.2

Package
in.example.notes
Version code
10402
Android
Min 26 · target 35
ABI
arm64-v8a · x86_64
Publisher SHA-256
51:87:B3:05:9A:7C:21:08:34:9D:AD:7A:61:F0:88:CE…

Every byte checked · prior signed releases retained

Keep the lights on

Free locally. Team-ready once.

Open counter

$0 forever

  • Unlimited local APK checks
  • Static release pockets
  • Publisher pinning and rollback
  • JSON CI output
Install free

Already bought it?

Restore your team unlock

Your token stays in this browser. Verification runs at most once per day.

The safety boundary

No shortcuts around Android.

ARP verifies and explains legitimate direct-install releases. It does not create signatures, disguise packages, collect device credentials, disable protections, or promise that a verified publisher is trustworthy. Users still choose whether to install.