Note
DollBloom is a renamed derivative of the open-source BitChord project, released under GPLv3. Original author and third-party notices are retained in the source. DollBloom artwork is used throughout: Logo.png, the launcher icons, and Banner.png, whose left-hand lockup was redrawn onto the original background.
Every app build variant uses the Android application ID com.doll.bloom. Dev/prod and debug/release builds are not separate installs: installing one replaces the other. DollBloom installs separately from BitChord and will not update or replace an existing BitChord installation.
Important
DollBloom is not affiliated with, endorsed by, or connected to YouTube or Google in any way. Use it at your own discretion.
|
|
Once a release is published, get the APK from DollBloom Releases. Sideloading requires enabling "Install unknown apps" for whichever app you download it with.
Repository maintainers can build from Actions → Android Release Build → Run workflow, which needs nothing typed: press Run and it builds, signs, and replaces the APK on the rolling latest release. Fill in the version boxes to publish a versioned release instead — the name takes letters as well as numbers, e.g. 1.8-beta2 or DollBloom2026. Either way the workflow builds the minified production Release and uploads one universal APK as a 14-day artifact, provided it is at most 100 MB. Native libraries are compressed in the APK to reduce download size; no app features or supported ABIs are removed.
We welcome contributions to DollBloom! Please review our Contributing Guide and Code of Conduct before submitting a pull request.
Contributing Guide · Code of Conduct · Maintainers · Additional Docs
No DollBloom-specific donation links are configured yet. Support details can be added by the DollBloom maintainers later.
DollBloom is an independent, community-driven third-party audio player and client. It is not associated with Google LLC, YouTube Music, Deezer, Telegram, or any of their parent companies.
- No Media Hosting: DollBloom does not host, upload, or store copyrighted music files. It operates strictly as an interface to scan local device storage or stream media directly from public, public-facing, or user-authenticated APIs.
- Fair Use & API Usage: This software is created solely for personal research, educational, and fair-use purposes. The user is entirely responsible for ensuring their usage aligns with their local copyright laws and YouTube Terms of Service.
- No Ad-Blocking Guarantee: DollBloom focuses on a clean listening environment but does not guarantee permanent bypasses or modifications to commercial third-party platform conditions.
- Copyleft: DollBloom is free software under the GPLv3. Any distribution must include the Corresponding Source under the same license.
This project is licensed under the GNU General Public License v3.0 (GPLv3). See the LICENSE file for details.
Requires JDK 17 and the Android SDK/NDK configured for this project.
./gradlew assembleDevDebug
./gradlew testDevDebugUnitTestRelease builds are signed with DollBloom's own key, which lives in this
repository as one locked file — signing/dollbloom-release.keystore.enc, a
4096-bit RSA key under AES-256-CBC, opened by a passphrase through
PBKDF2-HMAC-SHA256 at 600,000 iterations. The release workflow holds that
passphrase, so when a build runs the lock opens itself and the key is there for
as long as signing takes. See signing/README.md for what that does and does not
protect — the short version is that anyone who can read the workflow can read the
passphrase, which is the price of a build that needs nobody.
# Unseal the key, then build. Needs openssl + keytool. The passphrase the
# workflow uses is in the workflow, in SIGNING_PASSPHRASE_BUILTIN.
DOLLBLOOM_SIGNING_PASSPHRASE='…' \
python3 signing/dollbloom_signing.py --passphrase-env DOLLBLOOM_SIGNING_PASSPHRASE unseal --out-dir .
./gradlew assembleProdRelease
rm -f dollbloom-release.jks keystore.properties # they are the private keyTwo kinds of build come out of the Android Release Build workflow:
- every push to
master(or a working branch) builds, signs, and replacesDollBloom-latest.apkon the rollinglatestpre-release. One stable URL, always the newest build, and a version code taken from the date so it installs over whatever is on the phone. - a dispatch that has a version filled in builds a properly versioned
release,
v<version name>— and letters are fine in that name, so1.8-beta2works. A dispatch with the form left empty is the same request as a push, and lands onlatesttoo. Run without typing anything is a complete sentence.
signing/README.md has the whole scheme, including how to rotate the passphrase,
how to verify a downloaded APK, and what all of this does and does not protect.
LISTEN_TOGETHER_SERVER can be set in local.properties, as an environment variable, or as the GitHub Actions repository variable of the same name for CI builds. If unset, the app still points at the original upstream Listen Together server, which is not DollBloom-hosted; configure your own backend and app-link domain before presenting those services as DollBloom-hosted.