/ security

Security

The full policy is in SECURITY.md. The model in one sentence: transparency, not trust.

Trust model All installer and package scripts are plain bash in this repository. Installing a third-party tool (via zero or pkg) runs its build steps on your device — that is the intended Termux design. Review scripts before installing anything you do not trust.

What runs on your device

zero install <module> [--tool …] runs that module's installers, pulling from official npm/pip/gem/cargo registries or the tool's official GitHub releases — never from Zero-Termux infrastructure.
Tool installers may write into $PREFIX (bin symlinks, share data); shell and ui modules write user-level config under $HOME (~/.zshrc additions, ~/.termux, ~/.config). zero voice records microphone audio only when you invoke it.
APT packages: each postinst downloads the tool's source/release from its official repo, builds it, and symlinks the command into $PREFIX/bin. Data may land under $PREFIX/share/lib; a minority (themes, fonts, config packs) intentionally writes into $HOME. Check the package's DEBIAN/ scripts before installing.

APT repository signing

Every build-repo run signs the Release file (→ signed InRelease) with an ed25519 key.
Key: Zero-Termux Signing <zero-termux@users.noreply.github.com>, fingerprint DF2C7FCDABF96DF4298E953BB0C7EC7C1BB9C494.
Public key ships in the repo (assets/zero-termux.gpg) and at https://vaizer0.github.io/zero-termux/zero-termux.gpg.
Private key exists only in GitHub Actions secrets (PRIVATE_GPG_KEY + GPG_PASSPHRASE). Treat any other source of it as compromised. It has never been committed.

Supply chain

Rolling tools resolve the latest release from official upstream at install time; no silent stale fallback — installers fail with a clear error if the upstream API is unreachable.
Pins are limited to build-critical/source-tag cases, individually justified (# Zero-Termux: justified pin — <reason> + manifest entry); CI fails on new unapproved pins.
All downloads over HTTPS, pointing at each tool's official source — never at this project's servers.
CI validates every PR; the Pages deploy serves the signed repo and public key from the same pipeline that built them.

What we do NOT claim Packages are not "safe just because they are in the repo" — installing executes their postinst. And not every tool avoids touching your config; check before you install. Security tooling is for systems you own or are authorized to test.

Responsible disclosure

Do not open a public issue for an active vulnerability affecting other users.
Open an issue prefixed [SECURITY] (or use the maintainer contact on the repo) with: tool/package + version, reproduction steps, impact, optional fix.
Ack within 3 business days; fix or documented mitigation within 14 days.

Verifying the key

curl -fsSL https://vaizer0.github.io/zero-termux/zero-termux.gpg -o key.gpg
gpg --show-keys key.gpg
# pub   ed25519 2026-08-12 [SC]
#       DF2C 7FCD ABF9 6DF4 298E  953B B0C7 EC7C 1BB9 C494
# uid   Zero-Termux Signing <zero-termux@users.noreply.github.com>