search

casimir / frigoligo

Your articles with you
MIT License
37 stars 3 forks source link

Publish on app stores #161

Open casimir opened 3 months ago

casimir commented 3 months ago

The big ones:

The would nice ones:

IzzySoft commented 1 month ago

Maybe consider per-ABI APKs here? Then it could go live at IzzyOnDroid within 24h. Scanner results look fine, so the only thing not meeting the IzzyOnDroid App Inclusion Criteria would be the APK size (limit is 30 MB).

casimir commented 1 month ago

The app has been included in F-Droid repo yesterday. Does it make sense to be published in both repos?

Love the concept of your repo btw!

IzzySoft commented 1 month ago

Does it make sense to be published in both repos?

That's probably a question without a clear yes/no answer. Guess someone (neutral) should create a Matrix comparing the two. Currently, the big pro of F-Droid.org is that they build the apps from source, so you can be sure what's inside the APKs – while the big pros of IzzyOnDroid are much faster updates (usually < 24h compared to F-Droid's ~5 days) and additional security measures, to name a few. And that gap ("know what's inside") is about to be closed soon (hopefully), in a way (details on that are not public yet, but will be announced before Q4 this year when we are ready for it).

Love the concept of your repo btw!

Thanks, glad to hear! :heart_eyes:

casimir commented 1 month ago

@IzzySoft the APKs are available in the latest release https://github.com/casimir/frigoligo/releases/tag/v1.0.10

IzzySoft commented 1 month ago

Then let's add it! While integrating, I've stumbled upon this:

SigningBlock blobs:
-------------------
0x504b4453 (DEPENDENCY_INFO_BLOCK; GOOGLE)

which can easily be avoided:

android {
    dependenciesInfo {
        // Disables dependency metadata when building APKs.
        includeInApk = false
        // Disables dependency metadata when building Android App Bundles.
        includeInBundle = false
    }
}

For some background: that BLOB is supposed to be just a binary representation of your app's dependency tree. But as it's encrypted with a public key belonging to Google, only Google can read it – and nobody else can even verify what it really contains.

For IzzyOnDroid, this will just be important for the APK – so if you think you'll need it for PlayStore, just skip the includeInBundle so the blob remains in the AAB. Would be great it you'd consider this.

Now, Frigoligo will become available here with the next sync around 6 pm UTC. Be welcome to pick a badge to point there e.g. from next to the PlayStore badge in your Readme then. Welcome aboard! :smile:

PS: For your above check-list: