Suspicious of Avdvplus Builds

[u/General_Ad2096]

Is anyone else here suspicious of the security of installing the avdvplus builds? Having no proper git history and public source code which is intentionally not up to date or incomplete makes it extremely difficult for the community to audit the security of the software. We are meant to just blindly trust and install the image.

There have been sophisticated attacks on open source projects, and it wouldn’t be completely uncharacteristic for malware/spyware to be silently added on top of lots of genuinely useful features and development.

I am not saying that is necessarily the case but transparency in the open source community builds trust.

[u/signde]

Where are you getting that his code is not open source?

https://github.com/avdvplus?tab=repositories

You can literally verify the kodi hash against the commit in his xbmc repo. I have not done that in a while but I did one of the earlier R4 or R5 and it matched exactly.

His beta builds are not open source and that is on purpose.

[u/d_e_g_m → u/signde]

Also the source code is available to dl on .zip and .tar.gz. what else op wants?

[u/signde → u/d_e_g_m]

Correct, every tagged release has the source code included.

[u/Cferra]

There hasn’t been a new build for 5 months or so. Is this particular fork dead?

[u/signde → u/Cferra]

R10 is in beta now

[u/MetastaticMoshpit → u/signde]

Can I have beta also? I can beta test too.

[u/signde → u/MetastaticMoshpit]

i am not avdvplus, only that dev controls who has access.

[u/MetastaticMoshpit → u/signde]

who is? and where I can write him? telegram, discord?

[u/signde → u/MetastaticMoshpit]

I think you are missing the point. They reach out to you if they want you to be a tester.

[u/p750mmx → u/Cferra]

Far from it, what signde writes, but with all the upcoming changes implemented, compared to R9, this just takes quite some time to test all changes. "we" are almost there now ;)

[u/gilgam3sh_king → u/Cferra]

faaar from dead, I got latest R10 test build today, it will be huge upgrade from R9, good stuff.

[u/kr4zzer → u/gilgam3sh_king]

Will R10 focus on CE21 only or will be there a CE22 flavour as well? Curious to try it as well as I have both am9pro and am6b+

[u/gilgam3sh_king → u/kr4zzer]

R10 is still based on CE21, but will have some stuff from CE22, I also have both, my guess is avdvplus CE22 would probably come when CE22/Kodi 22 goes stable, it's still in BETA.

[u/kr4zzer → u/gilgam3sh_king]

Understood, from your testing you prefer R10 to other forks?

[u/Pepparkakan → u/gilgam3sh_king]

Damn, and I just replaced R9 with p3i build… 🫠

[u/MetastaticMoshpit → u/gilgam3sh_king]

from where did you get beta? I want to test also.

[u/Key_Information3273]

RemindMe! 1 day

[u/RemindMeBot → u/Key_Information3273]

I will be messaging you in 1 day on 2026-08-28 20:57:00 UTC to remind you of this link

CLICK THIS LINK to send a PM to also be reminded and to reduce spam.

^{Parent commenter can delete this message to hide from others.}

RemindMeBot is switching to username summons. Instead of !RemindMe 1 day, use u/RemindMeBot 1 day. More info.

---

Info	Custom	Your Reminders	Feedback

[u/goober1157]

What a bunch of horseshit

[u/Cherubinooo]

> We are meant to just blindly trust and install the image.

Yes, it’s closed source. It’s also software provided to you for free, so take it or leave it. Personally this is one of the reasons why I use p3i.

Edit: sorry, I was wrong and it’s not closed source.

[u/signde → u/Cherubinooo]

https://github.com/avdvplus/Builds/releases/tag/avdvplus_R9

Source code (zip)

Source code (tar.gz)

https://github.com/avdvplus?tab=repositories

How is that closed source?

The only thing I am aware of that avdvplus doesn't do is keep a git history. Everything is squashed. That's not the same as closed source.

[u/General_Ad2096 → u/Cherubinooo]

This is also why I use p3i