Borehole · Project · free tier
gitlab.com/fdroid/fdroidclient
Free reading: not for reliance
18d55eb · 11,175 commits · 2,960 files
Read 2026-10-04

gitlab.com/fdroid/fdroidclient: technical due diligence, read from its repository

What Borehole read in gitlab.com/fdroid/fdroidclient's code and history at 18d55eb: its licence, security advisories, releases, review practice, tests, dependencies and operations. Every finding cites the file and line it rests on. The full report also covers the team and asks the questions the code cannot answer.

DimensionRating
Architecture & Codebase — including AI provenancestrong
Engineering Process & SDLC Maturitystrong
Product & Engineering Maturityadequate
Security & Reliability Postureadequate
Observability & Operationsnot assessable
Fit with the Acquirernot assessable

What the repository says

  • COPYING: Relicensed: GPL-2.0 → GPL-3.0 (2013-04-12)
  • .gitmodules:1: 1 submodule(s) this survey does not read: fastlane

Architecture & Codebase — including AI provenance

strong
01.6

app/src/full/java/vendored/org/apache/commons/codec/digest/DigestUtils.java is 1,744 lines, 18× this codebase's median file

adequate

The median source file here is 93 lines. 3 files exceed 1,000 lines, the largest being 1,744. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down.

Evidence
app/src/full/java/vendored/org/apache/commons/codec/digest/DigestUtils.java:1 — 1,744 lines (18× median)
app/src/full/java/org/fdroid/fdroid/nearby/SwapWorkflowActivity.java:1 — 1,626 lines (17× median)
libs/database/src/main/java/org/fdroid/database/AppDao.kt:1 — 1,020 lines (10× median)

Engineering Process & SDLC Maturity

strong

No finding.

Product & Engineering Maturity

adequate
04.19

19% of bug fixes add or change a test

adequate

Of 129 fixes in the last 24 months, 24 touched a test. A fix without the test that would have caught the bug can quietly come back, and the suite never learns from what went wrong.

Evidence
24 of 129
04.38

6 files still carry code deprecated more than two years ago

adequate

6 files were marked deprecated over two years ago and still are, the oldest since Nov 2022. A deprecation is a promise to remove. Ask what still depends on these, and whether removing them is scheduled.

Evidence
libs/download/src/androidMain/kotlin/org/fdroid/download/HttpDownloader.kt — deprecated since Nov 2022
libs/download/src/androidMain/kotlin/org/fdroid/download/HttpDownloaderV2.kt — deprecated since Dec 2022
libs/download/src/commonMain/kotlin/org/fdroid/download/DownloadRequest.kt — deprecated since Dec 2022
libs/index/src/androidMain/kotlin/org/fdroid/index/IndexUtils.kt — deprecated since Jan 2023
libs/database/src/main/java/org/fdroid/database/RepositoryDao.kt — deprecated since Aug 2023

Security & Reliability Posture

adequate
05.2

None of the standard security guard rails are configured

adequate

There is no disclosure policy, no automated dependency updates, no named code owners and no pre-commit configuration. None of these is load-bearing on its own. Their collective absence says that security posture here is whatever the current team happens to remember to do, which is not a posture that survives the team changing.

Evidence
checked 5 kinds of guard rail across 2,960 tracked files; 0 present
05.51

The app allows plain HTTP to any server

adequate

The app's manifest allows unencrypted HTTP app-wide (NSAllowsArbitraryLoads, or cleartext traffic permitted), rather than for named domains. Anything sent over plain HTTP can be read on the network, and enterprise security reviews ask about it. Some apps need it by nature (a podcast or feed reader fetches whatever URL a feed gives), so ask which case this is.

Evidence
app/src/full/AndroidManifest.xml:46 — cleartext allowed app-wide
app/src/full/res/xml/network_security_config.xml:3 — cleartext allowed app-wide
05.60

Relicensed: GPL-2.0 → GPL-3.0 (2013-04-12)

adequate

The root licence changed 1 time(s). Code taken under earlier terms stays under them; check which terms any fork or customer relied on.

Evidence
COPYING — GPL-2.0 from 2010-10-21
COPYING — GPL-3.0 from 2013-04-12

Observability & Operations

not assessable

Not rated: only 5 of 16 checks could reach a conclusion here; the rest do not apply to this repository or could not read it.

Fit with the Acquirer

not assessable

Not rated: structurally not assessable from a repository.

Read more, or read your own

The full report on gitlab.com/fdroid/fdroidclient: every dimension, the questions for the room, and the audit log.

Survey a repository: free on public repositories. Private code is read on your own machine by a collector whose source you can read first.