4 F-Droid
Sergei Poljanski edited this page 2024-08-12 11:15:34 +00:00

F-Droid release

Bugs

  • channels listed in "Contacts"?
  • "Note to self" auto opening every time I toggle "Show offline" on and off?

Security

  • Base config is insecurely configured to permit clear text traffic to all domains. Scope: ['*'] Report

Build

  • Get rid of "+free" suffix
  • gradle/wrapper/gradle-wrapper.jar cannot be verified as free software because it does not match any listed on the official website: e2b82129ab64751fd40437007bd2f7f2afb3c6e41a9198e628650b22d5824a14 There is a gradle command for upgrading the wrapper:
./gradlew wrapper --gradle-version 8.2 \
  --gradle-distribution-sha256-sum 38f66cd6eef217b4c35855bb11ea4e9fbc53594ccccb5fb82dfd317ef8c2c5a3
  • missing distributionSha256Sum

gradle/wrapper/gradle-wrapper.properties is missing

distributionSha256Sum.

This means that the gradle download is not verified. We recommend explicitly setting the expected SHA-256 to protect you and your apps if a bad actor gets access to the Gradle servers or manages to MitM your internet connection. Please note that Android Studio supports this poorly, with only a weird text prompt inline in a log window, but it does work there. Here is an example of how to fix this:

#Sun Dec 17 21:30:13 CET 2023
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.2-bin.zip
zipStoreBase=GRADLE_USER_HOME
zipStorePath=wrapper/dists
distributionSha256Sum=38f66cd6eef217b4c35855bb11ea4e9fbc53594ccccb5fb82dfd317ef8c2c5a3
  • Icon
  • Readme ?
  • Fastlane
    • Pics
    • Short description (EN-RU-UA)
    • Long descriptopn (EN-RU-UA)
    • [?] Change logs

https://fdroid.gitlab.io/-/fdroiddata/-/jobs/7465821294/artifacts/public/issuebot/7465821294/15484/sdk.py.html