Imran Remtulla c911cba670 fix: resolve 20 bugs, safety issues, and code quality problems
Critical fixes:
- Remove setTrustedCertificatesBytes which replaced the entire TLS trust store
- Fix late final async init race causing LateInitializationError crashes
- Fix infinite recursion in ObtainiumError.message for MULTI_ERROR code

High fixes:
- Fix identical() always returning false on badge icon (update count never shown)
- Clone form items before mutation to prevent cross-contamination between sources
- Log transient errors before removing apps on load failure
- Await uninstallApp calls instead of fire-and-forget
- Revert optimistic install on background workaround failure
- Log SAF errors before silently disabling export directory

Medium fixes:
- Remove dead GeneratedForm.fromDefinitions constructor and unused fields
- Replace Shizuku-specific param with generic installOptions map in Installer interface
- Add importable-keys allowlist to prevent arbitrary SharedPreferences writes
- Guard against stale Shizuku permission check callbacks with sequence counter
- Prevent ReceivePort leak in listenForDownloadCancelFromMain
- Add 500MB tarball size guard to prevent OOM on large archives
- Simplify ReDoS-vulnerable URL regex in html.dart
- Fix TOCTOU race between existsSync and length calls
- Log rename failures instead of empty catch blocks
- Use safe null-aware defaults in setFormValuesFromMap
2026-07-03 13:44:04 +01:00
2026-07-02 01:58:45 +01:00

Support Palestine

Obtainium Icon Obtainium

Get Android app updates straight from the source.

Obtainium allows you to install and update apps directly from their releases pages, and receive notifications when new releases are made available.

More info:

Currently supported App sources:

Finding App Configurations

You can find crowdsourced app configurations at apps.obtainium.page.

If you can't find the configuration for an app you want, feel free to leave a request on the discussions page.

Or, contribute some configurations to the website by creating a PR at this repo.

Installation

Get it on GitHub Get it on IzzyOnDroid Get it on F-Droid

Verification info:

Item Value
Package ID dev.imranr.obtainium
Signing cert SHA-256 B3:53:60:1F:6A:1D:5F:D6:60:3A:E2:F5:0B:E8:0C:F3:01:36:7B:86:B6:AB:8B:1F:66:24:3D:A9:6C:D5:73:62
PGP Public Key keyserver.ubuntu.com (verify APK hashes)

The signing certificate is also valid for the F-Droid flavour (a separate APK built from lib/main_fdroid.dart), thanks to reproducible builds.

Limitations

  • For some sources, data is gathered using Web scraping and can easily break due to changes in website design. In such cases, more reliable methods may be unavailable.

Troubleshooting

App not updating

  • Verify the URL matches the source's expected format (e.g. GitHub requires owner/repo)
  • Pull down on the apps list to force a refresh
  • If using GitHub, rate limits may block updates without a Personal Access Token configured in settings

Screenshots

Apps Page Dark Theme Material You
App Page App Options App Web View
Description
No description provided
Readme 60 MiB
Languages
Dart 98.1%
Shell 0.7%
Kotlin 0.6%
Dockerfile 0.4%
JavaScript 0.2%