Tern

about

description

A lot of good Android apps never reach a store, or reach it days late. Their developers put releases on GitHub, GitLab, Codeberg, a repository they run, or a plain web page. Tern follows those places for you. Paste a link or share one from the browser and it figures out what it is looking at. Then it checks the file, because a release page can be tampered with and a download can be swapped on the way. The signature has to be from the same certificate as the app already on your phone. Tern remembers that certificate from the first install, and your export carries it to your next phone. If the publisher gave a checksum, the file has to match it. The file has to be the app you asked for, and not an older version of it. Tern reads the version and the signer out of a file while it is still on the server, a few kilobytes of it, so an update is only offered when there really is one. On Android 12 and newer, updates go in without asking once Tern has installed the app. With Shizuku or Dhizuku they go in without asking, first installs too. If Android does want a confirmation, you get a notification you can update from. Background checks use Android's own scheduler, as often as every 15 minutes, and you choose whether they run on mobile data or only while charging. No account. Nothing is reported to anyone. HTTPS only. Works on phones, tablets and Android TV, where the remote is all you need. On a TV, choose Send from a phone: scan the code it shows, and your phone sends links or your app list, sealed with that code so nobody else on the network can read or change them. Choose Orbot in the settings and everything Tern sends goes through Tor. If Orbot is not there, nothing is sent at all. For well-known apps Tern already carries the developer's certificate, so even the first install is checked. Make it look the way you like: colours from your wallpaper or your own, contrast, density, corners and icon shapes. English and 28 other languages; the translations are machine-made and corrections are welcome. Obtainium user? Import your export file and your apps come along, with every option they had. Tern writes Obtainium's format too. Sort, group and filter your list, give categories colours, and see what is waiting on a home-screen widget or a Quick Settings tile. Reads: GitHub releases and Actions builds, GitLab, Forgejo, Gitea, Codeberg, F-Droid, IzzyOnDroid, any F-Droid format repository (signature checked), web pages, direct links, Jenkins, SourceHut, SourceForge, itch.io, Telegram and Neutron Code. Off until you turn them on in Settings: the third-party stores APKPure, Aptoide, APKCombo, APKMirror (tracking only), Tencent, Huawei AppGallery, Samsung Galaxy Store and vivo. A store serves its own copies of apps, not files from the developer's own site, and Tern says so. The first install from a store decides which certificate later updates must carry, unless Tern already knows the developer's. Tern does not read sites that offer modified apps, or stores that answer only their own app. Who Tern talks to: the forges, repositories, instances and sites of the apps you add; for an F-Droid app also F-Droid's data on gitlab.com and the changelog it names; the icon hosts of those sources, such as raw.githubusercontent.com; a third-party store's own hosts only when stores are on and you add an app from it; and the places you tick when you search, which are GitHub, Codeberg, GitLab and search.f-droid.org at first. Every request says it comes from Tern. PRIVACY.md lists every host.

publisher

78ce6faa72264387284e647ba6938995735ec8c7d5c5a65737e55130f026307d

first seen

2026-10-04T20:45:01.050374+00:00

last event

2026-10-08 09:22 UTC

website

https://tern.munzzyy.dev/

install

zapstore.dev or any Zapstore-compatible client

topics

#app store & updater #security

source & build

repository

https://github.com/munzzyy/tern

arch flags

android-arm64-v8a android-armeabi-v7a android-x86 android-x86_64

manifest

missing

releases (kind 30063)

3 releases indexed; latest 0.4.0.

version	channel	released	event
0.4.0	main	2026-10-08 09:22 UTC	15fdc600…
0.3.0	main	2026-10-04 22:22 UTC	824218c6…
0.2.2	main	2026-10-03 19:53 UTC	418b35aa…

assets & verification

Every app, release and asset event is schnorr-verified (NIP-01 id + signature) before it enters the catalog, and assets are content-addressed by sha256. We subscribe read-only to the catalog relay — never write to it.

0.4.0 — io.github.munzzyy.tern_400.apk

sha256

66e80c86debe0dc2088fafe79ec9533afd6766506cbc950e0145cfbb647faac3

size

6.9 MB

archs

android-arm64-v8a, android-armeabi-v7a, android-x86, android-x86_64

version code

400

apk cert sha256

a894d9999c8e93a102a1d7afe86028980c25d76e7436dc3b143c5664c95b7003

download

io.github.munzzyy.tern_400.apk

0.3.0 — io.github.munzzyy.tern_300.apk

sha256

44969060c192a2a91c0d6d51d51f76007d8cbca3fef489fe7d5e3891a1273ae5

size

6.9 MB

archs

android-x86_64, android-arm64-v8a, android-armeabi-v7a, android-x86

version code

300

apk cert sha256

a894d9999c8e93a102a1d7afe86028980c25d76e7436dc3b143c5664c95b7003

download

io.github.munzzyy.tern_300.apk

0.2.2 — io.github.munzzyy.tern_202.apk

sha256

285cb1cab1e71a5af999eea23e4b17984365f7e7d513650798eb21a9b017287f

size

6.9 MB

archs

android-x86, android-x86_64, android-arm64-v8a, android-armeabi-v7a

version code

202

apk cert sha256

a894d9999c8e93a102a1d7afe86028980c25d76e7436dc3b143c5664c95b7003

download

io.github.munzzyy.tern_202.apk

Showing the newest 3 asset descriptors; the full set is in /api/apps/78ce6faa…