Question on permissions

[IzzySoft]

My scanner reported:

! repo/org.fossify.filemanager_2.apk declares sensitive permission(s):
  android.permission.REQUEST_INSTALL_PACKAGES android.permission.MANAGE_EXTERNAL_STORAGE android.permission.READ_EXTERNAL_STORAGE*
! repo/org.fossify.filemanager_2.apk contains signature block blobs: 0x504b4453 (DEPENDENCY_INFO_BLOCK; GOOGLE)

While storage permissions are quite clear for a file manager: REQUEST_INSTALL_PACKAGES is used for installing APKs from storage, or does it point to an integrated self-updater?

As for DEPENDENCY_INFO_BLOCK, that's easily avoided:

android {
    dependenciesInfo {
        // Disables dependency metadata when building APKs.
        includeInApk = false
        // Disables dependency metadata when building Android App Bundles.
        includeInBundle = false
    }
}

For some background: that BLOB is supposed to be just a binary representation of your app's dependency tree. But as it's encrypted with a public key belonging to Google, only Google can read it – and nobody else can even verify what it really contains.

[naveensingh]

REQUEST_INSTALL_PACKAGES is used for installing APKs from storage

Yep, that's what it is used for, nothing else.

org.fossify.filemanager_2.apk contains signature block blobs: 0x504b4453 (DEPENDENCY_INFO_BLOCK; GOOGLE)

Oops, I forgot to remove it from the file manager but it's done now.

Thanks :)

[IzzySoft]

Thanks for confirming! Updated in the YAML here so reasons will be shown transparently. Also thanks for caring about that blob 😉