This is the complete source code and the build instructions for the official alternative Android client for the Telegram messenger, based on the Telegram API and the MTProto secure protocol via TDLib.
$ brew install git git-lfs wget gsed && git lfs install
# apt install git git-lfs
$ git lfs install
for the current user, if you didn't have git-lfs
previously installedgit
, wget
, and make
utilities:
$ git lfs install
for the current user, if you didn't have git lfs
previously initialized$ git clone --recursive --depth=1 --shallow-submodules https://github.com/TGX-Android/Telegram-X tgx
— clone Telegram X with submodules--recursive
flag, cd
into tgx
directory and: $ git submodule init && git submodule update --init --recursive --depth=1
keystore.properties
file outside of source tree with the following properties:keystore.file
: absolute path to the keystore filekeystore.password
: password for the keystorekey.alias
: key alias that will be used to sign the appkey.password
: key password.$ cd tgx
$ scripts/./setup.sh
and follow up the instructionsgoogle-services.json
with the one that's suitable for the app.id
you need./gradlew assembleUniversalRelease
.arm64
: arm64-v8a build with minSdkVersion
set to 21
(Lollipop)arm32
: armeabi-v7a buildx64
: x86_64 build with minSdkVersion
set to 21
(Lollipop)x86
: x86 builduniversal
: universal build that includes native bundles for all platforms.If you are developing a contribution to the project, you may follow the simpler building steps:
$ git clone --recursive https://github.com/TGX-Android/Telegram-X tgx
$ cd tgx
local.properties
file in the root project folder using any text editor:# Location where you have Android SDK installed sdk.dir=YOUR_ANDROID_SDK_FOLDER # Telegram API credentials obtained at previous step telegram.api_id=YOUR_TELEGRAM_API_ID telegram.api_hash=YOUR_TELEGRAM_API_HASH
$ scripts/./setup.sh
— this will download required Android SDK packages and build native dependencies that aren't part of project's CMakeLists.txt./gradlew assemble
commands in terminalAfter submitting a pull request and its initial review, special build including your contribution will be published in @tgx_prs channel, where it can be tested by the community. In case any issues or bugs found, you may push more commits to an existing PR that address them and request to publish a newer build by using comments section of pull request or in @tgx_dev chat.
In order to verify that there is no additional source code injected inside official APKs, you must use Ubuntu 21.04 for builds published before 26th May 2023 or Ubuntu 22.04.2 LTS for any newer releases, and comply with the following requirements:
vk
with the home directory located at /home/vk
tgx
repository to /home/vk/tgx
fetchPr
and squashPr
taskscd
into tgx
folder and install dependencies: # apt install $(cat reproducible-builds/dependencies.txt)
$ apkanalyzer apk compare --different-only <remote-apk> <reproduced-apk>
In future build reproduction might become easier. Here's a list of related PR-welcome TODOs:
.so
files, so user & project location requirement could be removed.comment
ELF section differs from the one built with Linux version of NDK. It must be removed or made deterministic without any side-effects like breaking native-debug-symbols.zip
(or should be reported to NDK team?)$ scripts/./reset.sh
and $ scripts/./setup.sh --skip-sdk-setup
.PS: Docker is not considered an option, as it just hides away these tasks, and requires that all published APKs must be built using it.
If you downloaded Telegram X APK from somewhere and would like to simply verify whether it's an original APK without any injected malicious source code, you need to get checksum (SHA-256
, SHA-1
or MD5
) of the downloaded APK file and find whether it corresponds to any known Telegram X version.
In order to obtain SHA-256 of the APK:
$ sha256sum <path-to-apk>
on Ubuntu$ shasum -a 256 <path-to-apk>
on macOS$ certutil -hashfile <path-to-apk> SHA256
on WindowsOnce obtained, there are three ways to find out the commit for the specific checksum:
@tgx_bot
@tgx_log
. You can do so without need in installing any Telegram client by using this URL format: https://t.me/s/tgx_log?q={checksum}
(click to see in action). Note: unpublished builds cannot be verified this way.Telegram X
is licensed under the terms of the GNU General Public License v3.0.
For more information, see LICENSE file.
License of components and third-party dependencies it relies on might differ, check LICENSE
file in the corresponding folder.
List of third-party components used in Telegram X can be found here. Additionally you can check the specific commit of the third-party component used, for example, here and here.
Telegram X welcomes contributions. Check out pull request template and guide for contributors to learn more about Telegram X internals before creating the first pull request.
If you are a regular user and experience a problem with Telegram X, the best place to look for solution is Telegram X chat — a community with over 4 thousand members. Please do not use this repository to ask questions: if you have general issue with Telegram, refer to FAQ or contact Telegram Support.