Thanks! What's the lean build, a stripped-down phone? If a file doesn't open, do let me know.

Thank you, that means a lot!

lmaoo

A lot of it was written with AI, yes, under my direction, and every push runs the test suite in CI.

The no-permissions part doesn't rest on trusting the code, though. The build fails if a permission is added, the About screen shows what Android says the app requests, and it's MIT, so the code is there to read.

If anything in it looks wrong, open an issue and I'll look into it: https://github.com/mokshablr/gander/issues

Glad the pptx worked!

The name is from "take a gander" which is like slang for "take a look". A gander is also a male goose hence the icon. 😛

Gander treats every file as untrusted. Documents render in a WebView that runs only Gander's own scripts and loads nothing except Gander's own code and the file you opened. With no internet permission, a file that got past that still couldn't reach the network.

Nobody outside has audited it yet, and you're right that it wouldn't hurt. SECURITY.md lists what a file should never be able to do, and how to report one privately: https://github.com/mokshablr/gander/blob/main/SECURITY.md

well no more of that now, glad i got to share 😄

It's a good one. It installs apps straight from their GitHub releases and keeps them updated. Gander's README has a one-tap link to add it.

Yes! I opened a request with F-Droid in July and it's waiting for a reviewer: https://gitlab.com/fdroid/rfp/-/work_items/4138

Until then, the GitHub releases work with Obtainium.

Done, thanks! The README's install section now has a one-tap link to add Gander to Obtainium: https://github.com/mokshablr/gander#install

Fair question. A lot of it(the README and code) was written with AI assistance under my direction, and every push runs with a the test suite in CI.

The no-permissions claim doesn't depend on trusting that tho.. the build fails if a permission is added, the About screen on the app also shows what Android says the app requests(isnt hardcoded), and it's open-source MIT licensed, so the code is there to read.

If you find something bad in it, you can open an issue and I'll definitely be there to look into it.

Thank you! Gander was built with a privacy-first approach since the beginning.

F-Droid is the one I actually want. The request has been open since July (https://gitlab.com/fdroid/rfp/-/issues/4138) but nobody from F-Droid has reviewed it yet, which seems to be normal there.

The one thing I expect review to bring up is that the renderers are vendored as minified JavaScript, and I've offered to swap in unminified copies or build them from source. Meanwhile, the APK on GitHub releases works with Obtainium.