6eero / NewPass

🔐 NewPass is a free and open source password manager which will allow you to generate and store your passwords securely, saving them locally and encrypting them on your phone's memory
http://www.newpass.solutions/
GNU General Public License v3.0
216 stars 15 forks source link

Releasing a build #1

Closed gdimoff closed 7 months ago

gdimoff commented 7 months ago

Hey,

I've just tested your app and it looks great on my Android. Do you plan to release prebuild version ? If you are interested I can list it on my open source repo at https://openapk.net/ so other people can try it !

6eero commented 7 months ago

Yes sure. I still need to implement a few more functions, then I will be able to release the prebuilt version

6eero commented 7 months ago

Done, I released it!

IzzySoft commented 7 months ago

@6eero please take care for versioning, too! This is how the APK at v1.1.0 identifies:

package: name='com.gero.newpass' versionCode='1' versionName='1.0'

it should have been versionCode='2' and versionName='1.1.0' (versionCode is what Android uses internally to tell versions apart – so in the current situation, v1.1.0 would not be considered an update to the previous version as the code didn't change; versionName is what is displayed to the human who then mentions it when reporting something to you). So you could never tell which version they talk about, as they all look the same…

IzzySoft commented 7 months ago

PS, while I'm here, my scanner also reported

! repo/com.gero.newpass_1.apk contains signature block blobs: 0x504b4453 (DEPENDENCY_INFO_BLOCK; GOOGLE)

which can be easily avoided:

android {
    dependenciesInfo {
        // Disables dependency metadata when building APKs.
        includeInApk = false
        // Disables dependency metadata when building Android App Bundles.
        includeInBundle = false
    }
}

For some background: that BLOB is supposed to be just a binary representation of your app's dependency tree. But as it's encrypted with a public key belonging to Google, only Google can read it – and nobody else can even verify what it really contains.

Thanks in advance!

6eero commented 7 months ago

@6eero please take care for versioning, too! This is how the APK at v1.1.0 identifies:

package: name='com.gero.newpass' versionCode='1' versionName='1.0'

it should have been versionCode='2' and versionName='1.1.0' (versionCode is what Android uses internally to tell versions apart – so in the current situation, v1.1.0 would not be considered an update to the previous version as the code didn't change; versionName is what is displayed to the human who then mentions it when reporting something to you). So you could never tell which version they talk about, as they all look the same…

Thanks, I didn't know that. I'm still a beginner. So, for every release I publish, do I need to increment the versionCode and update the versionName to match the version of the release I'm deploying? Right?

IzzySoft commented 7 months ago

Yupp, that would fit, thanks! Increasing versionCode is the most important part there. My updater currently evaluates the tag name to see if the APK should be pulled from it, so that part would be nice if covered, too.

Oops, forgot to mention maybe… your app is listed in my repo. So if you wish, you can also pick a badge to e.g. place next to that Github one in your Readme and link it there :wink:

6eero commented 7 months ago

Thank you! i'll do it!

IzzySoft commented 7 months ago

Worked out fine :partying_face: And thanks for adding the badge! :star_struck: