cleartext traffic?

[IzzySoft]

Just wondering what for TraevellDroid needs cleartext traffic, as my updater just "alerted" me (warning level only, so the update was published fine):

! repo/de.hbch.traewelling_138.apk declares flags: usesCleartextTraffic

This flag is disabled by default, so I assume there's some reason behind explicitly enabling it – but I have no clue what for. Are there still sites TD needs to connect to that do not use https?

[jheubuch]

I thought this had something to do with issues occuring with osmdroid if not enabled. I'll have a look at it.

[IzzySoft]

Thanks! Should it be needed, I'll add it to your app's allow-list (with a clear reason as comment – please let me know then). If not, it should preferably be removed of course :wink:

[jheubuch]

Removed it

[IzzySoft]

Thanks! Looking forward then to the next release :smiley:

[IzzySoft]

Removed it

Thanks, it's gone:

If you want the DEPENDENCY_INFO_BLOCK gone as well (only useful to Google anyhow):

android {
    dependenciesInfo {
        // Disables dependency metadata when building APKs.
        includeInApk = false
        // Disables dependency metadata when building Android App Bundles.
        includeInBundle = false
    }
}

For some background: that BLOB is supposed to be just a binary representation of your app's dependency tree. But as it's encrypted with a public key belonging to Google, only Google can read it – and nobody else can even verify what it really contains.