Option to install with izzy-on-droid greyed out

[Gooberpatrol66]

Doesn't support Android 12?

[Foxpace]

Hi, sorry for late response.
I will have to push new version here at the github, so easy droid can pick it up. Thanks for the reminder. Unfortunately, I am currently not the most reachable person, but by the end of the year, I should get to it and update it.

[IzzySoft]

Maintainer of IzzyOnDroid here. You didn't specify what year 😜 but while on it:

A scan (see here for details and background) just revealed the APKs at your releases are signed using a debug key. As that has security implications, may I ask you to please switch to a proper release key, and provide the corresponding APK signed with it? Thanks in advance!

[IzzySoft]

@Foxpace any word?

[Foxpace]

@IzzySoft https://github.com/Foxpace/SensorBox/releases/tag/v4.3.5-nf

[IzzySoft]

Thanks @Foxpace!

$ iod repo get motionapps.sensorbox
motionapps.sensorbox: looking for 'https://api.github.com/repos/Foxpace/SensorBox/releases'
motionapps.sensorbox: checking tag 'v4.3.5-nf'
motionapps.sensorbox: lastRelNo set to '4.3.5', checking for files
motionapps.sensorbox: Upstream file date (2024-02-21 22:22) is newer than ours (2021-12-20 01:00).
motionapps.sensorbox: returning ['4.3.5','https://github.com/Foxpace/SensorBox/releases/download/v4.3.5-nf/wear-nofirebase.apk',1708550532]
motionapps.sensorbox: 3.4.1/4.3.5, https://github.com/Foxpace/SensorBox/releases: https://github.com/Foxpace/SensorBox/releases/download/v4.3.5-nf/wear-nofirebase.apk
- Grabbing update for motionapps.sensorbox: OK
- Checking 'repo/motionapps.sensorbox_1000048.apk' for libraries and malware …
- Checking the app's AndroidManifest.xml …
! repo/motionapps.sensorbox_1000048.apk declares sensitive permission(s): android.permission.ACCESS_COARSE_LOCATION android.permission.ACCESS_FINE_LOCATION android.permission.ACCESS_BACKGROUND_LOCATION
! repo/motionapps.sensorbox_1000048.apk contains signature block blobs: 0x504b4453 (DEPENDENCY_INFO_BLOCK; GOOGLE)
motionapps.sensorbox: check if repo contains FUNDING.yml
motionapps.sensorbox: looking for 'https://api.github.com/repos/Foxpace/SensorBox/contents/.github'
motionapps.sensorbox: Github reports "Not Found" for https://api.github.com/repos/Foxpace/SensorBox/contents/.github
motionapps.sensorbox: looking for 'https://api.github.com/repos/Foxpace/SensorBox/contents/'
motionapps.sensorbox: looking for 'https://api.github.com/repos/Foxpace/.github/contents/'
motionapps.sensorbox: Github reports "Not Found" for https://api.github.com/repos/Foxpace/.github/contents/
motionapps.sensorbox: no FUNDING.yml detected.
motionapps.sensorbox: calling 'getFastlaneMeta(github,[host:github.com,owner:Foxpace,repo:SensorBox,path:/fastlane/metadata/android])'
motionapps.sensorbox: FastlaneFeatures title,shortdesc,fulldesc,changelogs,icon,featureGraphicJPG
motionapps.sensorbox: looking for 'https://api.github.com/repos/Foxpace/SensorBox/contents/fastlane%2Fmetadata%2Fandroid'
motionapps.sensorbox: looking for 'https://api.github.com/repos/Foxpace/SensorBox/contents/fastlane%2Fmetadata%2Fandroid%2Fen-GB'
motionapps.sensorbox: looking for 'https://api.github.com/repos/Foxpace/SensorBox/contents/fastlane%2Fmetadata%2Fandroid%2Fen-GB%2Fchangelogs'
motionapps.sensorbox: looking for 'https://api.github.com/repos/Foxpace/SensorBox/contents/fastlane%2Fmetadata%2Fandroid%2Fen-GB%2Fimages'
motionapps.sensorbox: looking for 'https://api.github.com/repos/Foxpace/SensorBox/contents/fastlane%2Fmetadata%2Fandroid%2Fen-GB%2Fimages%2FphoneScreenshots'
motionapps.sensorbox: checking locale 'en-GB'
motionapps.sensorbox: updating 'metadata/motionapps.sensorbox/en-GB/short_description.txt'
motionapps.sensorbox: updating 'metadata/motionapps.sensorbox/en-GB/title.txt'
motionapps.sensorbox: updating 'repo/motionapps.sensorbox/en-GB/featureGraphic.jpg' from 'featureGraphic.png'
motionapps.sensorbox: updating 'repo/motionapps.sensorbox/en-GB/icon.png'

should become available with the next sync. I've added the location permissions to the allow-list (needed for "location sensor").

If you want to have the other gaps filled, please provide the reasons for them and I gladly add them.

The DEPENDENCY_INFO_BLOCK is easy to get rid of:

android {
    dependenciesInfo {
        // Disables dependency metadata when building APKs.
        includeInApk = false
        // Disables dependency metadata when building Android App Bundles.
        includeInBundle = false
    }
}

For some background: that BLOB is supposed to be just a binary representation of your app's dependency tree. But as it's encrypted with a public key belonging to Google, only Google can read it – and nobody else can even verify what it really contains.

Btw: currently your app is set to "static", i.e. only monthly update checks. Should you plan more frequent updates (i.e. more than once every 3 months or so) please let me know and I lift your app back to daily checks.

[IzzySoft]

@Foxpace one more question: what's the difference of the 2 APKs at the releases – so I know which one should preferably be taken? Without pinning our updater to one of them, it would pick them randomly (depending on which one the Github API mentions first). I could not find any hints towards that. Is the wear* one just intended for wear devices (i.e. to be installed on the watch), and the other is the counter-part for the smartphone? I've now "pinned" it to the mobile variant. Unfortunately, both have the same PackageName – but the wear variant has a much hier versionCode, so once that gets pulled, updates might be stuck if the mobile variant is being picked.

Reference: #2 (comment)

So just for clarification: by "the tags" you mean "separate tags for -nf", and I don't need to check the file names, right?

Exactly, it will end with - nf

Guess we missed the "but there will be 2 files, you still need to match mobile" then…

One other point while I'm here, our scanners reported

SigningBlock blobs:
-------------------
0x504b4453 (DEPENDENCY_INFO_BLOCK; GOOGLE)

This can easily be avoided with a minor addition to your build.gradle:

android {
    dependenciesInfo {
        // Disables dependency metadata when building APKs.
        includeInApk = false
        // Disables dependency metadata when building Android App Bundles.
        includeInBundle = false
    }
}

For some background: that BLOB is supposed to be just a binary representation of your app's dependency tree. But as it's encrypted with a public key belonging to Google, only Google can read it – and nobody else can even verify what it really contains. More details can be found e.g. here: Ramping up security: additional APK checks are in place with the IzzyOnDroid repo.

Thanks in advance!

[IzzySoft]

PS: I've tried to build the app according to the description in the Readme (just skipping the Firebase part), but running gradle assembleNfrelease fails:

FAILURE: Build failed with an exception.

* What went wrong:
Could not determine the dependencies of task ':app:lintVitalReportNfrelease'.
> Could not resolve all task dependencies for configuration ':app:nfreleaseCompileClasspath'.
   > Could not resolve project :SensorServices.
     Required by:
         project :app
      > No matching configuration of project :SensorServices was found. The consumer was configured to find a library for use during compile-time, preferably optimized for Android, as well as attribute 'com.android.build.api.attributes.BuildTypeAttr' with value 'nfrelease', attribute 'com.android.build.api.attributes.AgpVersionAttr' with value '8.2.2', attribute 'org.jetbrains.kotlin.platform.type' with value 'androidJvm' but:
          - None of the consumable configurations have attributes.
   > Could not resolve project :wearoslib.
     Required by:
         project :app
      > No matching configuration of project :wearoslib was found. The consumer was configured to find a library for use during compile-time, preferably optimized for Android, as well as attribute 'com.android.build.api.attributes.BuildTypeAttr' with value 'nfrelease', attribute 'com.android.build.api.attributes.AgpVersionAttr' with value '8.2.2', attribute 'org.jetbrains.kotlin.platform.type' with value 'androidJvm' but:
          - None of the consumable configurations have attributes.

Just a guess: are you building on Windows? Because there's indeed no :SensorService project, just :sensorservice (directory name is all lowercase). Eh, indeed: ln -s sensorservices SensorServices solves that, but then we get:

FAILURE: Build failed with an exception.

* What went wrong:
Could not determine the dependencies of task ':app:lintVitalReportNfrelease'.
> Could not resolve all task dependencies for configuration ':app:nfreleaseCompileClasspath'.
   > Could not resolve project :wearoslib.

OK, there it's the other way around. So: ln -s WearOsLib wearoslib, and we get to:

* What went wrong:
Execution failed for task ':app:processNfreleaseGoogleServices'.
> File google-services.json is missing. 
  The Google Services Plugin cannot function without it. 
  Searched locations: /build/repo/app/src/nfrelease/google-services.json, /build/repo/app/src/nfrelease/google-services.json, /build/repo/app/src/google-services.json, /build/repo/app/src/nfrelease/google-services.json, /build/repo/app/src/Nfrelease/google-services.json, /build/repo/app/google-services.json

So no chance to build the app without some Firebase registration stuff? I thought this was a NoFirebase build? (Not meant as accusation, just as clarification – maybe I just missed something, and I could put "something" into that file but just don't know what?)

[IzzySoft]

@Foxpace no pressure, just asking for orientation: is there any chance we can get somewhere with this here – or maybe even an ETA when you plan to pick up again?

[Foxpace]

Hi,
sorry for the late reply. Unfortunately, I do not have the resources to maintain this repo and from this day I plan on archiving it. One day I will revive it, but do not take my word for it. It is not happening in the foreseeable future.