Libellus Potionis

Write (push) access to the canonical repository (hosted on GitLab) requires two-factor authentication as a documented project policy: docs/GOVERNANCE.md ("Repository access and account security") states that any account with write access MUST have cryptographic 2FA enabled. Currently the sole maintainer is the only account with write access and has 2FA enabled; the policy binds any future account granted write access. GitLab additionally accepts no account password for git over HTTP/S at all — an access token or an SSH key is required — so a stolen password alone cannot push. Per-project 2FA enforcement is a group-level setting the project's plan does not offer, so the requirement is enforced by written policy.

On GitLab, project members are never added automatically: a user with the Owner role must explicitly invite each member and assign a role (Guest/Reporter/Developer/Maintainer/Owner), and no role grants itself an escalation. The project also currently has a single maintainer, so no additional members with elevated access exist. The set of accounts with write access is documented in docs/GOVERNANCE.md. Any future collaborator therefore requires a deliberate, manual permission grant by the owner.

The primary branch (main) on the project's GitLab repository is a protected branch whose "Allowed to push and merge" setting is "No one", so direct pushes are rejected server-side for every role including the project Owner, and changes reach main only through a merge request. All changes to main therefore go through a merge request, satisfying the enforcement requirement even though the project currently has a single maintainer.

The primary branch (main) is the repository's default branch and is additionally a protected branch. On GitLab a protected branch cannot be deleted while the protection rule is active, and the default branch cannot be deleted at all; removing the protection is itself a deliberate, separately audited settings change. Deleting the primary branch is therefore treated as a blocked, non-accidental action, exceeding the "require explicit confirmation of intent" requirement.

The project's CI/CD pipeline consumes no untrusted input, by construction rather than by sanitizing after the fact. .gitlab-ci.yml interpolates no forge-supplied string anywhere: no merge request title, branch name, commit message, fork payload or user-supplied variable appears in any job's script. The jobs run three fixed commands — tools/release-check.sh --Werror, make check-static and an osv-scanner source scan — each of which reads only the checked-out tree. The single CI variable the file references, CI_MERGE_REQUEST_TARGET_BRANCH_NAME, appears in a workflow: rule comparison, never in a shell command, so it cannot be interpreted as code. There is therefore no injection path from a proposed change into pipeline execution.

Untrusted code snapshots cannot reach privileged credentials, because the pipeline holds none. .gitlab-ci.yml defines no secret, no protected or masked variable and no deployment credential; its three jobs are read-only checks on a plain python:3-slim image. The project's privileged credentials — the release-signing keystore, the Google Play and App Store upload keys, and the GitLab release token in fastlane/gitlab-credentials.txt — exist only in the maintainer's local, git-ignored files and are never present in a CI environment; releases are built and published manually on a trusted local checkout. A merge request from a fork therefore executes only the fixed check commands, with nothing privileged in reach. The automatic CI job token is scoped to this project alone under Settings > CI/CD > Token Access.

All official project channels are served exclusively over encrypted transport. The canonical repository and issue tracker (gitlab.com/godisch/potillus) are reached over HTTPS (and Git over HTTPS/SSH), and the distribution page (f-droid.org/packages/de.godisch.potillus) is HTTPS-only; both GitLab and F-Droid enforce HTTPS with HSTS. No project URL uses plain HTTP.

The distribution channel is protected against adversary-in-the-middle attacks by cryptographically authenticated delivery, not transport security alone. The app is published on F-Droid (f-droid.org/packages/de.godisch.potillus) over HTTPS, where F-Droid cryptographically signs its repository index and signs the APK. The build is reproducible: F-Droid rebuilds the app from the published GPL-licensed source and verifies the result bit-for-bit against the developer-signed APK before publishing, so the distributed binary is provably the one built from public source. Clients therefore verify a signed index and a signed package whose provenance is independently reproducible. GitLab source access is likewise HTTPS-only. The planned Apple App Store channel likewise delivers Apple-signed packages over HTTPS; the App Store re-signs the binary with an Apple identity, so — like Google Play — the delivered artifact is not third-party-reproducible, though the underlying iOS build is verified reproducible by the two-build check in make release-ios.

The public repository leaks no valid private credentials. It contains no keystore or private-key files (no .jks/.keystore/.pem/.p12, no real keystore.properties) and no hard-coded passwords or API keys. Release signing material and the Google Play service-account key are explicitly git-ignored (/android/keystore.properties, /fastlane/play-store-credentials.json) and marked "SECRET, never commit"; only a documented placeholder template (android/keystore.properties.example) is committed, and the Play key is referenced only by path/SUPPLY_JSON_KEY, never embedded.

The project provides basic user documentation. A comprehensive, screen-by-screen User's Guide (localized into 21 languages) explains every screen and feature — Today, Calendar, Statistics, Drinks, and Settings (limits, backup/restore, security, appearance) — and is rendered and displayed inside the app itself (via tools/render-guide.py, shown in DocumentViewerScreen). The README additionally documents the app's purpose, feature set, platform requirements (Android 11+), and how to obtain it. The iOS port ships the same screen-by-screen guide (docs/guide/usersguide.ios.md), rendered inside the app, and targets iOS 17+.

Users submit bug reports through the project's GitLab issue tracker, with android@godisch.de offered as an alternative. This process is documented in the README's "Feedback & Contributing" section.

Discussion of proposed changes and issues takes place in the project's GitLab issue tracker and merge requests (gitlab.com/godisch/potillus/-/issues). This mechanism is full-text searchable; every issue, merge request, and comment is addressable by a stable URL; any person with a free GitLab account can open issues and join the discussion; and it is used entirely through a web browser, requiring no proprietary client-side software (GitLab's core is released as free software under the MIT licence).

The contribution process is documented in CONTRIBUTING.md, Section 2 "Submitting changes": contributors open an issue to discuss the change, then submit it as a merge request against main on GitLab (a patch by e-mail is accepted as an alternative); the change must meet the documented architecture, coding, testing, and translation conventions, and is reviewed and merged by the maintainer.

The GPL-3.0-or-later license for the repository contents is approved by the Open Source Initiative (OSI).

The software is released as Free/Libre and Open Source Software under the GNU General Public License v3.0 or later (GPL-3.0-or-later). The full license text is provided in LICENSE.md, the copyright notice in COPYING.md ("either version 3 of the License, or (at your option) any later version"), and the F-Droid metadata declares License: GPL-3.0-or-later.

The project's license is posted in a standard location at the repository root as LICENSE.md (full GPL-3.0-or-later text), which GitLab auto-detects and displays as the project license; COPYING.md sits alongside it with the copyright notice.

The released software assets carry the same GPL-3.0-or-later license as the source. In the repository the license is posted in a standard location at the root — LICENSE.md (full GPL-3.0-or-later text) with COPYING.md alongside — which GitLab auto-detects. The license also travels with the released application: each package bundles the verbatim text of every license it is obliged to reproduce, copied verbatim from the project-root license files at build time (Android: res/raw/license_gpl3.md, license_apache2.md, license_gpl2.md and license_bsd3.md; iOS: license_gpl3.md), and the in-app About screen states the app's own GPL notice with the App Store Distribution Exception in full and links to each verbatim text. F-Droid builds the published APK from this GPL-licensed source and distributes that source alongside the binary.

The project uses a publicly readable, version-controlled Git repository at a stable URL, gitlab.com/godisch/potillus — readable without an account and cloneable over HTTPS.

The project's source repository uses Git, which inherently records, for every commit, what changed (the diff/tree), who made the change (author and committer identity), and when (author and commit timestamps). The full history is publicly browsable on GitLab (commit list, diffs, and blame view) at gitlab.com/godisch/potillus/-/commits/main

External dependencies are declared in a computer-processable, versioned form and are obtained automatically by a standard build. The Gradle version catalog (android/gradle/libs.versions.toml) pins every library and plugin version in its [versions], [libraries], and [plugins] tables, referenced via alias(libs.…) in the build scripts; settings.gradle.kts configures the repositories (google, mavenCentral, gradlePluginPortal), so ./gradlew resolves and downloads all declared dependencies with no manual steps. The iOS port declares its dependencies the same way: ios/PotillusKit/Package.swift names them and ios/PotillusKit/Package.resolved pins each to an exact version and revision, which SwiftPM resolves automatically. Both builds additionally generate a CycloneDX 1.6 JSON SBOM of the release dependencies as a standardized machine-readable inventory (make sbom, make ios-sbom).

The project consists of a single source repository (gitlab.com/godisch/potillus) with no Git submodules and no separate subproject repositories. As the project does not span multiple repositories, this requirement's precondition does not apply. Should the project ever split into multiple repositories, the constituent codebases would be documented (e.g. in README.md/docs/).

The version control system contains no artifacts generated by the project's own build. All build outputs (APK/AAB, AAR, .dex, .class, compiled libraries) are produced under git-ignored directories (android/build, android/app/build, android/.gradle) and are never committed. The only committed binary is gradle/wrapper/gradle-wrapper.jar, the upstream Gradle bootstrap wrapper whose in-repository presence is the Gradle-recommended practice; it is not a project-generated artifact. Its integrity is addressed under OSPS-QA-05.02. The iOS port is the same: Xcode build products (DerivedData, .build) and the XcodeGen-generated ios/Potillus.xcodeproj are git-ignored and never committed, and no iOS binary is checked in.

The only executable/library binary committed to version control is gradle/wrapper/gradle-wrapper.jar, the standard Gradle Wrapper bootstrap (committing it is Gradle's recommended practice and is required to build without a pre-installed Gradle). It is not an opaque, unreviewable blob: it is a stock Gradle Wrapper jar whose authenticity is independently verifiable via the OpenSSF/Gradle wrapper-validation tooling. The build additionally pins the Gradle distribution by cryptographic checksum in gradle/wrapper/gradle-wrapper.properties (distributionSha256Sum, with validateDistributionUrl=true), so the wrapper can only bootstrap an authenticated official Gradle release; the pinned checksum was verified against the value Gradle publishes for that release. On every Gradle update the wrapper is regenerated from the verified distribution (documented in CONTRIBUTING.md §7), so the committed jar remains a stock, verifiable wrapper regardless of version. All other binary files are content assets explicitly excluded by this control — graphical images (PNG, SVG), TTF fonts, and sample report PDFs. No executable application binaries or opaque library files are committed. On the iOS side no binary is committed at all: SwiftPM resolves dependencies from source, pinned by exact version and revision in ios/PotillusKit/Package.resolved, so there is no wrapper jar or prebuilt library to review.

The process for reporting vulnerabilities is published in SECURITY.md at the repository root (which GitLab surfaces as the project's security policy) and is linked from the README's "Security" section. Reporters are asked to disclose privately via PGP-encrypted e-mail to android@godisch.de rather than opening a public issue.