IzzySoft
commented
2 months ago I was asked to establish the app with the IzzyOnDroid repo, which I'm currently doing (OuterTune will become available here with the next sync around 6 pm UTC). However, during the process some things came up. Scanners at IoD reported:
SigningBlock blobs:
-------------------
0x504b4453 (DEPENDENCY_INFO_BLOCK; GOOGLE)which can easily be avoided with a minor addition to your build.greadle:
android {
dependenciesInfo {
// Disables dependency metadata when building APKs.
includeInApk = false
// Disables dependency metadata when building Android App Bundles.
includeInBundle = false
}
}For some background: that BLOB is supposed to be just a binary representation of your app's dependency tree. But as it's encrypted with a public key belonging to Google, only Google can read it – and nobody else can even verify what it really contains. More details can be found e.g. here: Ramping up security: additional APK checks are in place with the IzzyOnDroid repo.
Next, I've tried to establish Reproducible Builds – which failed as the APK was not built from the commit the release tag points to, but from a commit that's not even public: 7fbc86c9b5beeac9b9edfd667352825a40e7bfa6 (according to the META-INF/version-control-info.textproto embedded in the APK). We've created some hints on reproducible builds which you might wish to take a look at – the culprit here is what we call the "First Basic Rule", as it's the cause for 80%+ of RB failures. We gladly assist you with establishing RBs, which are an additional security feature (also see Reproducible Builds, special client support and more at IzzyOnDroid for more details); if you can provide us with an APK built from a clean tree at a public commit, we can check again if that was the only culprit here. Currently, this is what the APK diff looks like:
-rw-r--r-- 0.0 unx 56 b- 52 defN 1981-01-01 01:01:02 b89973a3 META-INF/com/android/build/gradle/app-metadata.properties
- -rw-r--r-- 0.0 unx 120 b- 117 defN 1981-01-01 01:01:02 4e64fedf META-INF/version-control-info.textproto
+ -rw-r--r-- 0.0 unx 120 b- 117 defN 1981-01-01 01:01:02 470ee0f1 META-INF/version-control-info.textproto
-rw-r--r-- 0.0 unx 6028 b- 6028 stor 1981-01-01 01:01:02 6c3717f4 assets/dexopt/baseline.prof
-rw-r--r-- 0.0 unx 788 b- 788 stor 1981-01-01 01:01:02 4f15aed6 assets/dexopt/baseline.profm
-rw-r--r-- 0.0 unx 6339036 b- 2969104 defN 1981-01-01 01:01:02 e69f3e79 classes.dex
@@ -12,7 +12,7 @@
-rw-r--r-- 0.0 unx 518504 b- 518504 stor 1981-01-01 01:01:02 430213ea lib/arm64-v8a/libavformat.so
-rw-r--r-- 0.0 unx 710744 b- 710744 stor 1981-01-01 01:01:02 6233337e lib/arm64-v8a/libavutil.so
-rw-r--r-- 0.0 unx 7112 b- 7112 stor 1981-01-01 01:01:02 4f56ac38 lib/arm64-v8a/libdatastore_shared_counter.so
- -rw-r--r-- 0.0 unx 7864 b- 7864 stor 1981-01-01 01:01:02 9cb8ff23 lib/arm64-v8a/libffprobejni.so
+ -rw-r--r-- 0.0 unx 7864 b- 7864 stor 1981-01-01 01:01:02 7cf52308 lib/arm64-v8a/libffprobejni.so
-rw-r--r-- 0.0 unx 98536 b- 98536 stor 1981-01-01 01:01:02 724fe413 lib/arm64-v8a/libswresample.so
-rw-r--r-- 0.0 unx 608920 b- 608920 stor 1981-01-01 01:01:02 60f436e6 lib/arm64-v8a/libswscale.so
-rw---- 2.0 fat 1738 b- 782 defN 1981-01-01 01:01:02 2d73be70 DebugProbesKt.bin
@@ -102,10 +102,10 @@
-rw---- 2.0 fat 5 b- 7 defN 1981-01-01 01:01:02 6a2f0318 META-INF/kotlinx_coroutines_guava.version
-rw---- 2.0 fat 5 b- 7 defN 1981-01-01 01:01:02 6a2f0318 META-INF/kotlinx_coroutines_jdk8.version
-rw---- 2.0 fat 5 b- 7 defN 1981-01-01 01:01:02 6a2f0318 META-INF/kotlinx_coroutines_slf4j.version
- -rw---- 2.0 fat 6 b- 8 defN 1981-01-01 01:01:02 5de27171 META-INF/services/H4.e
- -rw---- 2.0 fat 52 b- 48 defN 1981-01-01 01:01:02 195cfebe META-INF/services/o4.g
- -rw---- 2.0 fat 6 b- 8 defN 1981-01-01 01:01:02 0b70b92a META-INF/services/r5.B
- -rw---- 2.0 fat 6 b- 8 defN 1981-01-01 01:01:02 09360773 META-INF/services/s5.a
+ -rw---- 2.0 fat 5 b- 7 defN 1981-01-01 01:01:02 1b649675 META-INF/services/H4.e
+ -rw---- 2.0 fat 51 b- 47 defN 1981-01-01 01:01:02 a1c62a19 META-INF/services/o4.g
+ -rw---- 2.0 fat 5 b- 7 defN 1981-01-01 01:01:02 3a68ee40 META-INF/services/r5.B
+ -rw---- 2.0 fat 5 b- 7 defN 1981-01-01 01:01:02 1145bd83 META-INF/services/s5.a
-rw---- 2.0 fat 625 b- 282 defN 1981-01-01 01:01:02 eb65be30 kotlin-tooling-metadata.jsonMETA-INF/version-control-info.textproto: as described above, caused by the APK being built from a different commit and thus easy to fix from your side.META-INF/services/*: you obviously build on Windows, as those files have Windows line endings (\r\n) – while we build on Linux and thus those files have Linux/Unix line endings (\n) here. Easy to fix on our end, so nothing you need to be concerned by.lib/arm64-v8a/libffprobejni.so: might be due to the different commit, or due to a different NDK version being used (please name yours for the retry then) – or by something else we cannot yet tell. A build from a clean tree (so no local changes, no caching) to compare against would help finding out.
Looking forward to your reply there – and as I wrote, gladly assisting you establish Reproducible Builds!
obfusk
mikooomich
DarkCrypt
Checklist
Feature description
I'm sure this is on the radar, but I thought it wouldn't hurt to track the progress. Adding OuterTune to F-Droid and perhaps even Accrescent would be very useful. Also it would be cool to get a "get it on Obtainium" link here on the GitHub.
Why do you want this feature?
Cause
Additional information
No response