$ show GrapheneOS/Vanadium
Vanadium is a hardened fork of Chromium for Android, developed by GrapheneOS. It serves as both the default browser and the system WebView provider on GrapheneOS devices. The repository contains a large set of patches (over 300) applied to the Chromium source tree, modifying default settings to enhance privacy and security: disabling telemetry, network prediction, third-party cookies, safe browsing, sign-in, media router, background sync, sensors, and many other features. It enables strict security policies like HTTPS-only mode, strict site isolation, partitioned connections, and Do Not Track. The build system uses GN with custom extension files to inject downstream code into Chromium targets. A separate 'config APK' delivers runtime feature flags and ad-blocking filter lists. The repository also includes patches for GrapheneOS-specific OS integration (custom permissions, connectivity checks, seccomp-bpf sandboxing). The codebase is actively maintained with frequent rebases to upstream Chromium, but the high patch count introduces significant merge conflict risk.
The LLM identified 4 files worth highlighting for reuse:
A standalone Java class that parses a signed config APK to extract feature flags, component updates (e.g., ad-blocking rulesets), and configuration specs. It is designed to avoid Chromium source dependencies, making it reusable in other Android projects. Implements version comparison, device condition checks, and caching of parsed configs via a future-based background parser.
A utility class for atomic file writes with proper fsync to guarantee data integrity. Provides methods to write bytes to a temporary file and atomically rename it, ensuring crash-safe persistence. Can be extracted and used in any Java project needing reliable file updates.
A set of typed wrapper classes for Android SharedPreferences (e.g., BoolSharedPref, IntSharedPref) that encapsulate key management and default values. Includes validation and consistent access patterns. Useful for any Android project that wants to avoid raw SharedPreferences API calls.
Implements seccomp-bpf sandbox rules to restrict dynamic code execution in child processes. Provides helper functions (RestrictMmapFlagsNoWX, RestrictMprotectFlagsNoWX, RestrictShmatFlags) that can be used to disallow W+X mappings and prevent making memory executable. Demonstrates advanced Linux sandboxing techniques and can be adapted for other sandboxed processes.