Hackerskeyboard: Fix F-DROID error

[borrougagnou]

Hi!
I can't find your app easily in f-droid because your app posses a vulnerability...

Can you fix your app please:
error 1: https://f-droid.org/wiki/page/Antifeature:KnownVuln

error 2: https://f-droid.org/wiki/page/AntiFeature:DisabledAlgorithm

Regards

PS: You can now add a preview in f-droid app

[klausw]

I don't support f-droid, and it's unclear to me what the problem here is
supposed to be. Please get releases from Play Store or the releases page
here on GitHub.

I never uploaded any APK to f-droid, so it's possible someone else did so
with one they built themselves and used an obsolete signing method.

On Mon, Dec 10, 2018, 18:49 borrougagnou <[email protected] wrote:

Hi!
I can't find your app easily in f-droid because your app posses a
vulnerability...

Can you fix your app please:
error 1: https://f-droid.org/wiki/page/Antifeature:KnownVuln

error 2: https://f-droid.org/wiki/page/AntiFeature:DisabledAlgorithm

Regards

PS: You can now add a preview in f-droid app

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/klausw/hackerskeyboard/issues/699, or mute the thread
https://github.com/notifications/unsubscribe-auth/ABU-3990KXUJczGxAnL_OFLic7Cu3rRQks5u3x04gaJpZM4ZMkMX
.

[TPS]

Pinging @IzzySoft @Relan, &c: Is this something solvable by fixing HK's build script @ F-Droid? It looks like there actually isn't anything KlausW should/could do to fix this, correct?

[relan]

The weak algorithm issue is relevant only for old APKs. The most recent version (1.41.1) is safe.

[TPS]

@Relan It still shows antifeatures "weak security signature" & "known security vulnerability." If you say the latest version's safe, could these be removed?

[IzzySoft]

@TPS knownVuln (and with it the weak signature) to my knowledge are added automatically by fdroidserver, and not manually by us. Apart from that, I don't see that AntiFeature on the latest version (1.41.1), check for yourself: https://f-droid.org/packages/org.pocketworkstation.pckeyboard/

[TPS]

OIC: @borrougagnou: If 1 has F-Droid ___Archive___ setup in F-Droid app's repos, these antifeatures show (correctly) about the < v1.39.× versions from there. Disable the Archive, & the antifeatures automagically vanish. I think you can close this issue FTW.

@IzzySoft @Relan: Thanks for the assistance. 🙇 Has there been any discussion of clarifying this kinda situation in F-Droid app re: these antifeatures?

@KlausW Sorry for the unsupported chatter. You should know that HK is a _critical_ part of the F-Droid ecosystem & we're all deeply indebted to you for it. 🙇:bowing_woman:

[borrougagnou]

of course I can close

2 fix in one:
1- Just because I disabled f-droid archive,
ALL icon reappear!!
2- Yes the message has disappeared

[IzzySoft]

@TPS I just have heard multiple times that for some reason enabling Archive has the strangest side-effects: icons disappearing I knew, unrelated AntiFeatures added is new to me. AFAIR it is discussed somewhere, but nobody could figure out yet what's the reason. Add to that our permanently being understaffed, and you get an idea why things take that long …

[TPS]

@IzzySoft I'm sure this behavior w/ the antifeatures in this case isn't necessarily incorrect, just unclear. I'll eventually propose better behavior over @ https://forum.f-droid.org/.

[IzzySoft]

@TPS care to explain why it shouldn't be incorrect to show AntiFeatures for an app that has none – just because some other repo got enabled? Unless that "other repo" has a newer version coming with AntiFeatures, of course. Which IMHO isn't the case here.

[TPS]

@IzzySoft Example: In the last release or few, KlausW had to upgrade API compatibility. Depending on user's hw/OS config, the antifeature might be relevant for the available build.

So, the flag isn't necessarily incorrect, but F-Droid app would need more smarts built-in to determine it case-by-case/per-version/per-APK, &, as you say, there's permanent understaffing.…

[IzzySoft]

@TPS I still don't get it. What does the API update got to do with signing? DisabledAlgorithm relates to old signing algorithms such as MD5. As does KnownVuln. So both are "caused" by the signing process. Nothing to do with what API level the app targets.

[klausw]

I think this means that a user may need to use an old APK because their
device isn't compatible with the new API level required by current APKs,
and the old APK from the archive is using an old signature algorithm for
which the warning would indeed be appropriate.

That warning no longer applies to current versions, but it can't
retroactively fix old versions.

On Wed, Dec 12, 2018, 11:41 Izzy <[email protected] wrote:

@TPS https://github.com/TPS I still don't get it. What does the API
update got to do with signing? DisabledAlgorithm
https://f-droid.org/wiki/page/AntiFeature:DisabledAlgorithm relates to
old signing algorithms such as MD5. As does KnownVuln
https://f-droid.org/wiki/page/Antifeature:KnownVuln. So both are
"caused" by the signing process. Nothing to do with what API level the app
targets.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/klausw/hackerskeyboard/issues/699#issuecomment-446717807,
or mute the thread
https://github.com/notifications/unsubscribe-auth/ABU-34YNNLjQCZfRlAQV2uKKQRGo13qPks5u4VwFgaJpZM4ZMkMX
.

[IzzySoft]

Well summed up, @klausw -- that is my guess as well: those AntiFeatures apply to older versions in Archive (because KnownVuln is a reason an APK gets moved to archive automatically, so it cannot apply to main), and versions in Main cannot be affected.

@borrougagnou already indirectly confirmed that: by disabling Archive, the AntiFeatures were no longer shown. So it's safe to close this issue, @klausw.

Thanks!