[concern] cypwn uploading Debs with different file sizes

whoeevee / EeveeSpotify

A tweak to get Spotify Premium for free, just like Spotilife

2.39k stars 184 forks source link

[concern] cypwn uploading Debs with different file sizes #211

Closed avitzavi closed 3 months ago

avitzavi commented 3 months ago

Is this issue appropriate?

[X] I have read the document in its entirety

Is this issue unique to EeveeSpotify?

[X] I was unable to reproduce my issue using the stock Spotify app

Have you searched the existing issues?

[X] This is a unique issue

Describe the bug.

A repo called cypwn is mirroring your Debs but they don’t have the same file size. Concerned that there could be spyware. Are see official uploads? consider making a repo so people won’t resort to unsafe mirrors.

asdfzxcvbn commented 3 months ago

how big is the difference? i know cypwn changes the bundle id of every package, if it's only a few (kilo)bytes then it should be fine

cypwn is trusted after all, i wouldnt be too worried

Are see official uploads?

not as far as im aware

consider making a repo so people won’t resort to unsafe mirrors.

no, just watch the repo and install new debs when necessary, or join our telegram (search EeveeSpotify IPAs)

whoeevee commented 3 months ago

Hey,

Thanks for your concern. Cypwn repacks the debs with their package identifier, xyz.cypwn.spotify, instead of com.eevee.spotify. The difference in file sizes is due to the different compression levels used. I've just checked, and Cypwn binaries are the same and have the same checksum, so there’s no malware (as of now).

Nevertheless, it's much better to download tweaks from official sources. EeveeSpotify doesn't have an official jailbreak repository, but you can follow @SpotilifeIPAs on Telegram to get updates, and download debs from GitHub Releases or GitHub Actions.

avitzavi commented 3 months ago

Approximately 2x larger on cypwn.. 400kb vs 200. Same with the dependency package On Jun 23, 2024, at 11:20 PM, zx @.***> wrote: how big is the difference? i know cypwn changes the bundle id of every package, if it's only a few (kilo)bytes then it should be fine cypwn is trusted after all, i wouldnt be too worried

Are see official uploads?

not as far as im aware

consider making a repo so people won’t resort to unsafe mirrors.

no, just watch the repo and install new debs when necessary, or join our telegram (search EeveeSpotify IPAs)

—Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you authored the thread.Message ID: @.***>