diff --git a/metadata/eu.siacs.conversations.txt b/metadata/eu.siacs.conversations.txt
index 3db4a5f4ae..3132901944 100644
--- a/metadata/eu.siacs.conversations.txt
+++ b/metadata/eu.siacs.conversations.txt
@@ -21,23 +21,39 @@ Noteable XEPs:
 * XEP-0198: Stream Management
 * XEP-0280: Message Carbons
 * XEP-0237: Roster Versioning
+
+This app uses precompiled binary libraries verified to match their
+upstream hashes.
 .
 
 Repo Type:git
 Repo:https://github.com/siacs/Conversations.git
 
-Build:0.1.2,8
-    disable=tried to remove jars, see maintainer notes
-    commit=0.1.2
+Build:0.1.3,9
+    srclibs=Otr4j-jitsi@33d95bb3710986d048fb4cbe42dc991f9ddd9de2,BouncyCastle@r1rv50
+    commit=0.1.3
     submodules=yes
+    rm=libs/android-support-v4.jar
+    extlibs=android/android-support-v4.jar
+    scanignore=libs/otr4j-0.10.jar,libs/bcprov-jdk15on-150.jar
 
 Maintainer Notes:
-    srclibs=Otr4j-jitsi@6d879761605dba48c80c0d3f44a6555b522d0c2e
-    prebuild=pushd libs && rm android-support-v4.jar bcprov-jdk15on-150.jar && \
-        git clone https://github.com/bcgit/bc-java.git && pushd bc-java && \
-        gradle jar && cp prov/build/libs/* ../ && popd && rm -fR bc-java && popd
 
-(Note: don't run git clone manually, use another srclib)
+This app uses precompiled open-source jars that have been verified to
+match hashes from upstream. 
+
+HASHES MUST BE RE-CHECKED ON CHANGE!
+
+However, we should built thoses jars from sourc asap, like:
+
+    rm=libs/android-support-v4.jar,libs/otr4j-0.10.jar,libs/bcprov-jdk15on-150.jar
+    prebuild=pushd $$BouncyCastle$$ && gradle jar && popd && cp $$BouncyCastle$$/prov/build/libs/* libs/ && \
+         cp -r $$Otr4j-jitsi$$/src/main src/
+
+Commits for otr4j:
+otr4j-0.10 33d95bb3710986d048fb4cbe42dc991f9ddd9de2
+otr4j-HEAD 6d879761605dba48c80c0d3f44a6555b522d0c2e
+
 .
 
 Auto Update Mode:None
diff --git a/srclibs/BouncyCastle.txt b/srclibs/BouncyCastle.txt
new file mode 100644
index 0000000000..78ac649bc8
--- /dev/null
+++ b/srclibs/BouncyCastle.txt
@@ -0,0 +1,15 @@
+# Source details (the only mandatory fields)
+Repo Type:git
+Repo:https://github.com/bcgit/bc-java.git
+
+# Comma-separated list of subdirs to use. The first existing subdirectory
+# found between those given will be used. If none is found or provided, the
+# root of the repo directory will be used instead.
+Subdir:
+
+# Any extra commands to prepare the source library
+Prepare:
+
+# If given "Yes", "android update project -p ." will be executed
+Update Project:
+