Libellus Potionis

遵循以下最佳实践的项目将能够自愿的自我认证，并显示他们已经实现了核心基础设施计划（OpenSSF）徽章。

没有一套可以保证软件永远不会有缺陷或漏洞的做法；如果规范或假设是错误的，即使合适的方法也可能失败。也没有哪些做法可以保证一个项目能够维持健康和运作良好的开发者社区。但是，遵循最佳做法可以帮助改善项目的成果。例如，一些做法可以在发布之前进行多人评估，这可以帮助您找到其他难以找到的技术漏洞，并帮助建立信任，并希望不同公司的开发人员之间进行重复的交互。要获得徽章，必须满足所有“必须”和“禁止”的条款，满足所有“应该”条款或有合适的理由，和所有“建议”条款必须满足或未满足（至少希望考虑）。欢迎通过 GitHub网站创建问题或提出请求进行反馈。另外还有一个一般讨论邮件列表。

如果这是您的项目，请在您的项目页面上显示您的徽章状态！徽章状态如下所示： 项目13480的徽章级别为passing 这里是如何嵌入它：
您可以通过将其嵌入在您的Markdown文件中：
[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/13480/badge)](https://www.bestpractices.dev/projects/13480)
或将其嵌入到HTML中来显示您的徽章状态：
<a href="https://www.bestpractices.dev/projects/13480"><img src="https://www.bestpractices.dev/projects/13480/badge"></a>


这些是黄金级别条款。您还可以查看通过或白银级别条款。

Baseline Series: 基准等级1 基准等级2 基准等级3

        

 基本 2/5 ●

  • 常规

    请注意，其他项目可能使用相同的名称。

    Libellus Potionis is a privacy-first, free, open-source, ad-free alcohol-consumption tracker that helps users monitor, pace, and manage their drinking habits entirely offline. It needs no invasive device permissions — no camera, microphone, or location access — and works completely without network connectivity.

    Key features

    • Intelligent logging: predefine custom beverages or use internationally common presets, and log drinks instantly or retroactively with precise timestamp corrections.
    • Concurrent limit tracking: set three simultaneous boundaries — a daily limit (grams of pure alcohol), a rolling 7-day weekly limit (grams), and a maximum number of drinking days per week — with visual progress bars in real time.
    • Blood-alcohol (BAC) estimation: enter your body weight for a live BAC approximation based on the established Widmark formula.
    • Addiction-counseling reports: generate a clear, well-organized two-page PDF report designed for consultations and counseling appointments.
    • Data portability: export your complete dataset as a standard CSV file for external processing (e.g. in LibreOffice Calc), or create secure JSON backups to migrate data between devices.
    • Granular adjustments: customize your "day start" time so late-night drinks count toward the correct evening, and define custom evaluation start dates for clean restarts.

    A comprehensive User's Guide is fully accessible in-app. The app is available on F-Droid.

    请使用 SPDX许可证表达格式;例子包括“Apache-2.0”，“BSD-2-Clause”，“BSD-3-Clause”，“GPL-2.0+”，“LGPL-3.0 +”，“MIT”和“(BSD-2-Clause OR Ruby)”。
    如果有多种语言，请将它们列为逗号分隔值（可选空格），并将它们从最多到最少使用。如果有长列表，请至少列出前三个最常见的列表。如果没有语言（例如，这是仅文档或仅测试项目），请使用单个字符“ - ”。请使用每种语言的常规大小写，例如“JavaScript”。
    通用平台枚举（CPE）是用于信息技术系统，软件和软件包的结构化命名方案。在报告漏洞时，它可用于多个系统和数据库。

    Libellus Potionis is a privacy-first, offline, ad-free Android app for tracking, pacing, and managing alcohol consumption. It requests no network permission and no camera/microphone/location access; all data stays on the device in the app's private, sandboxed storage, encrypted at rest (AES-256-GCM via the Android Keystore), with an optional biometric lock. It is Free Software under GPL-3.0-or-later, developed openly on Codeberg and distributed through F-Droid. The project is deliberately maintained as a teaching-quality codebase: every source file carries a license header and KDoc, and a release gate (tools/release-check.sh) enforces documentation, version consistency, English-only source, and translation completeness. Quality is guarded by a broad automated test suite (JVM unit tests plus instrumented Room-migration, Compose-UI, and locale tests) and by Android Lint and Kotlin compiler warnings promoted to build-breaking errors.

  • 先决条件


    不足以获得徽章。

    该项目必须拥有银级徽章。 [achieve_silver]

  • 项目监督


    不足以获得徽章。

    项目必须具有2个或更多的“公交车因子”。 (需要网址) [bus_factor]
    “公交车系数”（又名“卡车因子”）是指最少数量的项目成员，如果突然离开项目（“被公交车撞了”），项目会由于缺乏具备知识的或有能力的人员而暂停。 卡车因子 工具可以对GitHub上的项目进行估计。有关详细信息，请参阅Cosentino等人的评估Git存储库的卡车因子。

    Not met. This is a SHOULD at silver (and a MUST at gold): the badge allows a SHOULD to remain unmet where the rationale is documented, so it does not block the silver badge. Libellus Potionis has a single maintainer, so its bus factor is 1. This is not a considered design choice but a consequence of the project's size: a second significantly involved maintainer has not yet come forward, and one cannot be declared into existence. What the project does do to limit the consequences: the software is Free Software (GPL) in a public Codeberg repository and is therefore forkable by anyone; F-Droid builds from source and signs the APK with its own key, so continued distribution there does not depend on a signing key held by the maintainer; and the governance model, the key roles and the contribution process are documented (docs/GOVERNANCE.md, CONTRIBUTING.md), so a newcomer can see how decisions are made and how to join. Contributions and co-maintainers are welcome. Tracked in docs/ROADMAP.md under "Recommended, not blocking (SHOULD)" ("Raise the bus factor"); the gold-level MUST is noted under "Working toward the OpenSSF gold badge". The related silver MUST access_continuity is answered separately.


    不足以获得徽章。

    该项目必须至少有两个不相关的重要贡献者。 (需要网址) [contributors_unassociated]
    如果同一组织（作为雇员或承包商）支付工作费用，并且组织将从项目的结果中受益，则贡献者是相关联的。如果通过其他组织得到财务补助（例如，源自政府或非政府组织，支付给不同组织的科学补助金不会导致捐助者关联），不视为来自同一组织。重要贡献者定义为过去一年对项目做出了不平凡的贡献。一个重要贡献者的良好指标的例子是：编写至少1,000行代码，贡献50个提交或至少提交20页的文档。

    Not met. The project currently has a single significant contributor (the sole maintainer), so it does not have two unassociated significant contributors. This will be satisfied by bringing on a second, independent significant contributor; tracked in docs/ROADMAP.md ("Working toward the OpenSSF gold badge").


  • 其他


    足够获得徽章！

    项目必须在每个源文件中包含许可证声明。这可以通过在每个文件开头附近的注释中加入以下内容来实现： SPDX-License-Identifier: [SPDX license expression for project]。 [license_per_file]
    这可以通过在自然语言中包含许可证标识来完成。该项目还可以包括完整许可证文本，或者指向许可证文本的稳定URL。请注意，license_location条款要求项目许可证在标准位置。有关SPDX许可证表达式的更多信息，请参阅SPDX教程。请注意与 copyright_per_file 的关系，其内容通常在许可证信息之前。

    Met. The same header that provides the copyright statement in each hand-authored source file also provides a licence statement — the GNU GPL v3-or-later grant text — which is a fuller form than an SPDX-License-Identifier line. It is present in every Kotlin, Gradle KTS, Python, shell, ProGuard, XML (resources and manifest), version-catalog, and configuration source file. The excluded categories are identical to copyright_per_file: generated files, vendored third-party files, third-party fonts, and pure data/binary assets.


 变更控制 4/4 ●

  • 公开的版本控制的源代码存储库


    足够获得徽章！

    必须使用通用的分布式版本控制软件（例如，git，mercurial）作为项目的源代码存储库。 [repo_distributed]
    Git不是必须，项目在合适场景可以使用集中版本控制软件（如subversion）。

    The project uses Git, the most widely used distributed version control system, hosted on Codeberg (Forgejo). Repository: https://codeberg.org/godisch/potillus


    足够获得徽章！

    该项目必须清楚地识别新的或临时贡献者可以执行的小型任务。 (需要网址) [small_tasks]
    此标识通常通过在项目使用的一个或多个标签的问题跟踪器中标记所选问题来完成，例如 up- for-grabs ，仅限第一时间，“小修复”，微任务或IdealFirstBug。这些新任务不需要添加功能；他们可以改进文档，添加测试用例或其他有助于项目的内容，并帮助贡献者更了解项目。

    Met. Small tasks for new or casual contributors are identified in the tracker with the "good first issue" label and described in CONTRIBUTING.md ("Good first issues"), which highlights native-speaker translation review of the machine-generated locales, documentation, and test cases as good entry points. URL: https://codeberg.org/godisch/potillus/issues?labels=1948199


    足够获得徽章！

    项目必须要求开发人员使用双因素身份验证（2FA）来更改中央存储库或访问敏感数据（如私密漏洞报告）。这种2FA机制可以使用没有密码学机制的方案，如SMS（短消息），尽管不推荐。 [require_2FA]

    Met. Write (push) access to the canonical repository (hosted on Codeberg) requires two-factor authentication as a documented project policy: docs/GOVERNANCE.md ("Repository access and account security") states that any account with write access MUST have cryptographic 2FA enabled. Currently the sole maintainer is the only account with write access and has 2FA enabled; the policy binds any future account granted write access. Codeberg additionally blocks plain-password HTTP/S git operations once 2FA is enabled, so access requires a token or SSH key. The forge offers no per-project 2FA enforcement toggle, so the requirement is enforced by written policy. Reference: https://codeberg.org/godisch/potillus/src/branch/main/docs/GOVERNANCE.md


    足够获得徽章！

    项目的双因素身份认证（2FA）应该使用加密机制来防止仿冒。基于短消息服务（SMS）的2FA本身不符合此标准，因为它不被加密。 [secure_2FA]
    满足此条款的2FA机制将是一种基于时间的一次性密码（TOTP）应用程序，可自动生成在一段时间后更改的验证码。请注意， GitHub支持TOTP 。

    Met. The project's 2FA policy (docs/GOVERNANCE.md, "Repository access and account security") mandates a cryptographic method — a TOTP authenticator app or a hardware security key — and explicitly excludes SMS. The maintainer's Codeberg 2FA uses such a cryptographic method. Reference: https://codeberg.org/godisch/potillus/src/branch/main/docs/GOVERNANCE.md


 质量 4/7 ●

  • 编码标准


    足够获得徽章！

    该项目必须记录其代码检视需求，包括代码检视是如何进行的，必须检查的内容以及哪些是可接纳的内容。 (需要网址) [code_review_standards]
    另请参阅 two_person_review 和contribution_requirements 条款。

    CONTRIBUTING.md ("Code review requirements", Section 2) documents the project's code review process: how review is conducted (every change is reviewed before merge by the maintainer as reviewer and sole merger; the reviewer runs the build, the test suite, and tools/release-check.sh locally since there is no CI service yet), an explicit checklist of what must be checked (scope/privacy fit, architecture rules, coding and KDoc conventions, warnings-as-errors, mandatory tests, localization completeness, per-file licensing, DCO sign-off, and schema-freeze rules), and the acceptance criteria required for a change to be merged. URL: https://codeberg.org/godisch/potillus/src/branch/main/CONTRIBUTING.md


    不足以获得徽章。

    该项目必须至少有50％的修改（作者之外的人提出的）在发布之前审查，以确定是否是一个有价值的修改，并且没有已知的问题，会反对其包含 [two_person_review]

    The project currently has a single maintainer who authors and reviews all changes, so fewer than 50% of modifications are reviewed by a person other than the author. The review process and checklist are documented (CONTRIBUTING.md, "Code review requirements"); satisfying this criterion requires a second, independent reviewer. Tracked in docs/ROADMAP.md ("Working toward the OpenSSF gold badge").


  • 可工作的构建系统


    足够获得徽章！

    该项目必须具有可重复构建。如果没有发生构建（例如，直接使用源代码而不是编译的脚本语言），请选择“不适用”（N/A）。 (需要网址) [build_reproducible]
    可重复的构建意味着多方可以独立地重做从源文件生成信息的过程，并获得每比特完全相同的结果。在某些情况下，这可以通过强制某种排序来解决。 JavaScript开发人员可能会考虑使用npm shrinkwrap和webpack的OccurenceOrderPlugin。 GCC和clang用户可能会发现-frandom-seed选项有用。通常可以通过指定可用于重新构建的特定容器或虚拟机的加密散列来为外部方定义构建环境（包括工具集）。 可重复构建项目具有文档指导如何执行此操作。

    The Android build is reproducible. F-Droid builds the app from source and verifies that the result is bit-for-bit identical to the maintainer-signed APK before publishing it (F-Droid's Reproducible Builds process). This is documented in SECURITY.md ("Verifying releases"), and the F-Droid build recipe (fdroid/de.godisch.potillus.yml) pins the build and the allowed APK signing key, so anyone can rebuild from a release tag and compare against the published APK. URL: https://codeberg.org/godisch/potillus/src/branch/main/SECURITY.md This reproducibility guarantee applies to the productive distribution channels: the Codeberg release tags and F-Droid, both of which carry the maintainer's own signature and can be rebuilt and compared bit-for-bit from source. The planned store channels differ and are not author-reproducible in the same sense: Google Play re-signs the upload with a Google-held app-signing key, and the Apple App Store re-signs the submission with an Apple identity, so the published binary on those channels is signed by the store, not by the maintainer, and cannot be reproduced bit-for-bit by a third party. The iOS build itself is defined declaratively (XcodeGen project.yml, a pinned Swift package for the single dependency) and is deterministic from the repository, but App Store distribution does not offer F-Droid-style reproducible re-signing.


  • 自动测试套件


    足够获得徽章！

    测试套件必须以该语言的标准方式进行调用。 (需要网址) [test_invocation]
    例如“make check”，“mvn test”或“rake test”。

    The test suite is invoked in the standard way for a Gradle/Android project: ./gradlew test runs the JVM unit tests and ./gradlew connectedCheck runs the instrumented tests on a device or emulator. This conventional invocation is documented in CONTRIBUTING.md (Section 5, "Testing strategy", and the change-submission checklist in Section 2). URL: https://codeberg.org/godisch/potillus/src/branch/main/CONTRIBUTING.md The iOS tests are invoked the standard way too: swift test runs the PotillusKit unit tests, and the app-target tests run under xcodebuild. Both are wired into the Makefile's iOS targets.


    不足以获得徽章。

    该项目必须实施持续集成，将新的或更改的代码经常集成到中央代码库中，并对结果进行自动化测试。 (需要网址) [test_continuous_integration]
    在大多数情况下，这意味着每个在项目上全职工作的开发人员至少每天都会整合。

    Not currently implemented. The project is maintained by a single developer who builds and runs the full test suite and release gate (tools/release-check.sh) locally before each release, but there is no central CI service running automated tests on every change. This criterion is SUGGESTED at passing and a MUST at gold; the planned remediation is a Woodpecker pipeline (.woodpecker.yml) on Codeberg that runs the JVM unit tests (and lint/ktlint) on each push and reports success or failure — the same work as the silver automated_integration_testing item. Tracked in docs/ROADMAP.md.


    足够获得徽章！

    如果有至少一个FLOSS工具可以以所选语言度量此条款，该项目的FLOSS自动测试套件必须具有至少90％语句覆盖率。 [test_statement_coverage90]

    The JVM unit-test suite reaches ~97% statement (line) coverage, measured with Kover over the unit-testable code. Android-runtime-bound code (Compose UI, Room database/DAOs, DataStore preferences, Keystore, PDF/WebView rendering, and MediaStore import/export) is excluded from this figure and verified instead by the instrumented suite (src/androidTest). A build-breaking 90% line floor is enforced by the koverVerify Gradle task in the release gate (make cover-check). Methodology: CONTRIBUTING.md §5; scope/enforcement: app/build.gradle.kts.


    不足以获得徽章。

    如果有至少一个FLOSS工具可以以所选语言度量此条款，该项目的FLOSS自动测试套件必须具有至少80％分支覆盖率。 [test_branch_coverage80]

    Branch coverage is ~80% (Kover, unit-testable scope), with a 75% regression floor enforced via koverVerify. The remaining branches lie in Android-/Compose-adjacent code (ViewModel StateFlow assembly, resource-bound error mapping); reaching the ≥80% gold threshold is a tracked roadmap goal.


 安全 4/5 ●

  • 使用基础的良好加密实践

    请注意，某些软件不需要使用加密机制。

    足够获得徽章！

    项目生成的软件必须支持所有网络通信的安全协议，如SSHv2或更高版本，TLS1.2或更高版本（HTTPS），IPsec，SFTP和SNMPv3。默认情况下，FTP，HTTP，Telnet，SSLv3或更早版本以及SSHv1等不安全协议必须被禁用，只有在用户专门配置时才启用。如果项目生成的软件不支持网络通信，请选择“不适用”（N/A）。 [crypto_used_network]

    Not applicable. The application performs no network communication: it does not declare the INTERNET permission, works entirely offline, and transmits no data. There are therefore no network protocols whose security could be assessed.


    足够获得徽章！

    由项目生成的软件必须，如果支持或使用TLS，至少支持TLS版本1.2。请注意，TLS的前身称为SSL。如果软件不使用TLS，请选择“不适用”（N/A）。 [crypto_tls12]

    Not applicable. The application does not use TLS because it performs no network communication at all (no INTERNET permission, offline-only). There is no TLS configuration or version to assess.


  • 安全交付防御中间人（MITM）的攻击


    不足以获得徽章。

    项目网站，存储库（如果可通过网络访问）和下载站点（如果单独）必须包括具有非允许值的密钥加固头。 (需要网址) [hardened_site]
    请注意，GitHub是已知满足的。 https://securityheaders.io/ 等网站可以快速查看。主要头加固包含：内容安全策略（CSP），HTTP严格传输安全性（HSTS），X-Content-Type-Options（“nosniff”），X-Frame-Options和X-XSS-Protection。

    Not met. The criterion requires the repository and download sites to send four key hardening headers (CSP, HSTS, X-Content-Type-Options: nosniff, X-Frame-Options). The download site (F-Droid) sends all four. The repository host (Codeberg) sends strong HSTS (max-age two years, includeSubDomains, preload) and X-Frame-Options, but not CSP or X-Content-Type-Options. These headers are set by Codeberg, not by the project, and cannot be configured from the repository. Tracked in docs/ROADMAP.md; remediation is to request the missing headers from Codeberg or mirror on a compliant platform.


  • 其他安全问题


    足够获得徽章！

    该项目必须在过去5年内进行安全审查。此审查必须考虑安全需求和安全边界。 [security_review]
    这可以由项目成员完成和/或独立评估。此评估可能由静态和动态分析工具支持，但还必须进行人工审查，以确定工具无法检测到的问题（特别是设计问题）。

    A security review was performed in 2026 and is recorded in docs/ASSURANCE_CASE.md ("Security review record"). It takes into account the security requirements (SECURITY.md, "Security model") and the security boundary (the threat model and trust boundaries in the assurance case), combining that analysis with an Android-focused code/QA pass over the security-relevant areas (at-rest Keystore encryption, input and backup/import validation, CSV-injection neutralization, the permission surface and exported components, and the FLAG_SECURE / allowBackup / R8 hardening). No unresolved high-severity issues are known; residual risks are stated explicitly. URL: https://codeberg.org/godisch/potillus/src/branch/main/docs/ASSURANCE_CASE.md


    足够获得徽章！

    加固机制必须用于项目生产的软件，以便软件缺陷不太可能导致安全漏洞。 (需要网址) [hardening]
    加固机制可能包括HTTP头，如内容安全策略（CSP），用于减轻攻击的编译器标志（如-fstack-protector）或用以消除未定义行为的编译器标志。对于此条款的目的，最小权限不被认为是一种加固机制（最少权限是重要的，但是另有条款）。

    Met. Release builds apply R8 code shrinking and obfuscation (isMinifyEnabled = true) with resource shrinking and the optimizing ProGuard configuration. The manifest sets android:allowBackup="false" to prevent backup-based data exfiltration, and the app applies WindowManager FLAG_SECURE by default from cold start to block screenshots, screen recording, and Recents-thumbnail exposure. The permission set is minimal (no network or telephony; only USE_BIOMETRIC) and only the launcher activity is exported. These complement the hardware-backed Keystore at-rest encryption and the warnings-as-errors/lint gate. URL: https://codeberg.org/godisch/potillus/src/branch/main/android/app/build.gradle.kts


 分析 1/2 ●

  • 动态代码分析


    不足以获得徽章。

    必须在发布之前，至少将一个动态分析工具应用于软件任何候选发布的主要生产版本。 [dynamic_analysis]
    动态分析工具通过执行特定输入来检查软件。例如，项目可以使用模糊工具（例如， American Fuzzy Lop ）或Web应用扫描程序（例如， ZAP 或 w3af ）。在某些情况下， OSS-Fuzz 项目可以对您的项目应用模糊测试。为满足此条款，动态分析工具需要以某种方式改变输入，以寻找各种问题，或者将其作为一个具有至少80％分支覆盖率的自动测试套件。 动态分析维基百科页面和 OWASP的fuzzing页面 识别一些动态分析工具。分析工具可能专注于寻找安全漏洞，但这不是必需的。

    No dedicated dynamic analysis tool (fuzzer, sanitizer, or scanner) is applied before releases, and branch coverage is not yet measured, so the "automated test suite with ≥80% branch coverage counts as dynamic analysis" allowance cannot yet be claimed. The instrumented tests do exercise the app on a device/emulator, but without a measured ≥80% branch-coverage figure this does not yet meet the criterion. Remediation is tied to the Kover branch-coverage work in docs/ROADMAP.md; alternatively a dedicated dynamic tool could be added.


    足够获得徽章！

    项目应该在其生成的软件中包含许多运行时断言，并在动态分析期间检查这些断言。 [dynamic_analysis_enable_assertions]
    这个标准并不建议使生产过程中的断言;这完全取决于项目及其用户的决定。该标准的重点是在部署之前的动态分析过程中改善故障检测。在生产使用中启用断言与在动态分析（例如测试）期间启用断言完全不同。在某些情况下，在生产中使用断言是极其不明智的（尤其是在高完整性组件中）。存在许多反对在生产环境中启用断言的论点，例如，库不应使调用程序崩溃，它们的存在可能会导致应用商店拒绝，和/或在生产环境中激活断言可能会暴露诸如私钥之类的私有数据。请注意，在许多Linux发行版中都未定义NDEBUG ，因此C / C ++缺省情况下，assert（）将在这些环境中启用生产。对于那些环境中的生产，使用不同的断言机制或定义NDEBUG可能很重要。

    Not met (SHOULD). The criterion targets fault detection during dynamic analysis (testing), not production. The produced code contains a small number of always-on Kotlin preconditions (require/check/error) that are checked whenever the code runs, including under the test suite, but not "many". Remediation (tracked in docs/ROADMAP.md): add invariant assertions in the JVM-testable domain and data layers using Kotlin assert(), which Gradle's unit-test task runs with assertions enabled (-ea) by default, so they are checked during dynamic analysis while remaining disabled in ART release builds.



该数据可在社区数据许可协议 – 许可性，版本 2.0 (CDLA-Permissive-2.0)下获取。这意味着数据接收方可以共享数据，无论是否经过修改，只要数据接收方在共享数据时提供本协议文本。请注明Martin A. Godisch和OpenSSF最佳实践徽章贡献者。

项目徽章条目拥有者： Martin A. Godisch.
最后更新于 2026-07-04 04:21:04 UTC, 最后更新于 2026-07-17 02:54:37 UTC。 最后在 2026-07-04 08:45:54 UTC 获得通过徽章。