Multiple IceRaven browsers

Build multiple IceRaven Browser APKs with different package ids and app names to simulate Firefox profiles on Android.

Info

This repository builds multiple IceRaven APK profiles from one upstream IceRaven release. The upstream source is cloned during the build and is not committed here.

Fork this repo, set up the signing key, and edit variants.yml to add or remove APK profiles:

variants:
  - id: personal
    appName: IceRaven Personal
    applicationId: org.iceraven.personal

All configured variants are built as arm64-v8a APKs only. The build script generates Gradle product flavors from this file and builds the selected flavors in one Gradle invocation.

The upstream forkRelease build type still appends IceRaven's package suffix, so org.iceraven.personal becomes org.iceraven.personal.iceraven.

Android signing key

Every APK must be signed with the same key for Android to accept future updates. The build requires these repository secrets:

• ANDROID_SIGNING_KEYSTORE_BASE64: the base64-encoded PKCS#12 keystore.
• ANDROID_SIGNING_PASSWORD: the password for the keystore and its iceraven key alias.

Generate the key without installing anything

The included GitHub Actions workflow generates the key entirely on a GitHub runner. You only need a browser:

1. Open the repository on GitHub and go to Settings → Secrets and variables → Actions → New repository secret.

2. Create ANDROID_SIGNING_PASSWORD with a unique, randomly generated password of at least 32 characters, like this:

   openssl rand -base64 24

3. Open Actions → Generate Android signing key → Run workflow.

4. When it finishes, download the iceraven-signing-key artifact. It expires after one day.

5. Open iceraven-signing.p12.base64 from the artifact and copy its complete single line into a new repository secret named ANDROID_SIGNING_KEYSTORE_BASE64. GitHub does not let you download a secret after storing it.

6. Delete the key-generation workflow run and its artifact, then run the normal build workflow.

The PKCS#12 file in the short-lived artifact is encrypted with ANDROID_SIGNING_PASSWORD. Because this is a public repository, other GitHub users may be able to download that artifact until it is deleted or expires. The 32-character random password protects the private key, but you should still delete the workflow run immediately after storing the secret.

Obtainium updates

Every new GitHub Release includes obtainium.json, generated from variants.yml. It contains one entry per variant, using the variant's real Android package id and an APK filename filter. This lets Obtainium select the matching APK instead of asking which variant to download on every update.

Import it once:

1. Use the badge above to download obtainium.json from the latest release, or download it from any individual GitHub Release.
2. Open Obtainium's Import/Export page and import the downloaded file.
3. Keep the variants you use and delete any unwanted entries.
4. Run one update check so Obtainium loads the current release details.

You do not need to import the file again for later releases. Obtainium cannot discover a configuration file merely because it is attached to a release; the first download and import is manual. If the repository was already added to Obtainium without a variant filter, remove that old entry before importing to avoid a duplicate unfiltered entry.

The file removes the APK selection prompt. Fully unattended installation still depends on Obtainium's installation method and Android permissions.

The import always lists every variant in variants.yml, including when a manual workflow builds only a subset. Publish all variants at least once so each imported entry has a release APK available.

Manual builds

Run the Build IceRaven APKs workflow from GitHub Actions. It always runs, even when the latest upstream tag was already built.

Inputs:

• upstream_ref: use latest-release, a tag, branch, or commit.
• variants: use all or a comma-separated list like personal,work.

Successful builds upload the APKs and obtainium.json, then publish them to one GitHub Release named like IceRaven 2.45.0.

Daily upstream check

The Daily upstream IceRaven check workflow runs every day at 13:00 UTC. It checks the latest IceRaven release tag and builds only when the tag differs from latest-upstream-tag.txt stored on the separate state branch.

The workflow also has a manual force_rebuild input for testing the scheduled path without waiting for a new upstream tag.