GrapheneOS's repositories
PdfViewer
Simple Android PDF viewer based on pdf.js and content providers. The app doesn't require any permissions. The PDF stream is fed into the sandboxed WebView without giving it access to content or files. CSP is used to enforce that the JavaScript and styling properties within the WebView are entirely static.
linux-hardened
Minimal supplement to upstream Kernel Self Protection Project changes. Features already provided by SELinux + Yama and archs other than multiarch arm64 / x86_64 aren't in scope. Only tags have stable history. Shared IRC channel with KSPP: irc.freenode.net ##linux-hardened. Currently maintained at https://github.com/anthraxx/linux-hardened.
os-issue-tracker
Issue tracker for GrapheneOS Android Open Source Project hardening work. Standalone projects like Auditor, AttestationServer and hardened_malloc have their own dedicated trackers.
matrix.grapheneos.org
Matrix and Element Web server
discuss.grapheneos.org
Discussion forum server
branding-extra
Branding for everything outside the OS. This is not used as part of the OS.
fastboot.js
JavaScript implementation of the Android fastboot protocol, using WebUSB
sqlite4java
Fork of sqlite4java with updated SQLite, modernized / hardened SQLite configuration and basic compiler hardening.
branding-tools
Scripting for generating branding.
tls-pinning
Utilities for setting up TLS key pinning for Android app network security configuration. We pin the keys of trusted roots and backup keys in order to avoid needing to rotate the pinned keys. Backup keys are never intended to be used unless the roots stop being available and then only need to be used until the pins expire or get updated.