search

Akylas / oss-weather

An OSS weather app for iOS/Android
MIT License
162 stars 13 forks source link

Question on permissions #86

Closed IzzySoft closed 3 months ago

IzzySoft commented 5 months ago

Now that all new features of my APK scanner are active (see #72) and the next update of your nice weather app comes in, it finds something to complain about again:

! repo/com.akylas.weather_87.apk declares sensitive permission(s):
 android.permission.READ_EXTERNAL_STORAGE android.permission.ACCESS_COARSE_LOCATION
 android.permission.ACCESS_FINE_LOCATION android.permission.READ_PHONE_STATE

So once more I need your help for clarification :pray:

Let me check what I can find from your code, not being an Android dev myself I can at least read changelogs :see_no_evil:

So may I ask your help for clarification once more?

image

As for DEPENDENCY_INFO_BLOCK, that's rather easy when you use gradle (no idea what you use for signing here):

android {
    dependenciesInfo {
        // Disables dependency metadata when building APKs.
        includeInApk = false
        // Disables dependency metadata when building Android App Bundles.
        includeInBundle = false
    }
}

For some background: that BLOB is supposed to be just a binary representation of your app's dependency tree. But as it's encrypted with a public key belonging to Google, only Google can read it – and nobody else can even verify what it really contains.

IzzySoft commented 4 months ago

Ah, good: looks like READ_PHONE_STATE is gone now. So is the DEPENDENCY_INFO_BLOCK, cool! :star_struck: So only the storage one is left. Can you tell me what is saved to/read from "external storage"?

farfromrefug commented 4 months ago

@IzzySoft i use it to import/export app settings. And thanks again for your amazing support!

IzzySoft commented 3 months ago

to import/export app settings

thanks, added to the "green list" with that explanation then. For future versions you might consider switching to SAF (Storage Access Framework), which is available since Android 5 (corresponding to your minSdkVer). To export/import a single file this should be fully sufficient and you's no longer need the storage permissions. Instead folks using your app and wanting to export/import settings would be asked to pick a location they wish to grant your app access to.

thanks again for your amazing support!

:heart_eyes: gladly given, thanks!

farfromrefug commented 2 months ago

@IzzySoft i have a question for you. With my apps in droid-ify all my apps version number appear as 1.6.0.61 where 1.6.0 is the versionName and 61 is the versionCode. Though for all other apps their version number would appear as only 1.6.0. Do you know why? I dont think users need to see the 61 and i would prefer for it not to show in fdroid or droid-ify. But i dont see what i do to make it so.

Also another question for which i might already know the answer, do you think you will ever support split apk (multiple apks) for a single app version ? More users are asking me cause they dont see armv7 versions of my apps as i dont release universal (for apk size concerns). I might use my own fdroid server to do that but i would prefer not to. I did add support for it in my fdroid server fork, dont know if fdroid server officially supports it now.

IzzySoft commented 1 month ago

Afraid the Droid-ify question you'll have to ask the Droid-ify devs, I cannot tell or change that.

As for multiple ABIs / split APKs, no plans yet. And I don't think I'll address that in the near future: 2 per-ABI APKs will even exceed the size of the "fat build", so at the current stage that doesn't make much sense. Not saying "never", though – but I wouldn't expect it this year.

farfromrefug commented 1 month ago

@IzzySoft you are right why did i asked you about the build number and how it appears in droid-ify :s my bad must have been too tired ...

I understand about the multiple / splits APK. You are right it would in many cases induce much bigger per release assets. Had to ask, now i can answer my users. I will turn back on my personal repo for those users. Thanks!

IzzySoft commented 1 month ago

Sure, and no prob! We're not in stasis, so things might change. Maybe next year, I cannot tell yet. Schedule is already well-filled with good things to come, stay tuned!