Skip to content

SetBeat v0.3.0 - installs on more phones: Standalone and Full editions

Pre-release
Pre-release

Choose a tag to compare

View all tags
@sultanmaliki sultanmaliki released this 21 Sep 07:58
· 4 commits to main since this release
v0.3.0
4a95d3f

v0.3.0 fixes the "App blocked to protect your device" message on other phones and makes SetBeat properly shareable: two editions, one of which installs anywhere, and releases signed with SetBeat's own private key.

Which file do I download?

Edition File What you get Installs
Standalone (recommended for sharing) setbeat-standalone-v0.3.0.apk Stopwatch and countdown, gestures, local video and audio with the negative-blend timer, playlists, background countdown alarm Any phone, from a browser or file manager
Full setbeat-full-v0.3.0.apk All of that plus companion mode (shows and controls what other music apps play) and the beat-reactive wave Needs Google Play or adb on phones that apply the block below

Why the block happened, and what changed

In some markets (Google has piloted India, Singapore, Thailand and Brazil), Google Play Protect automatically blocks apps installed from a browser, messaging app or file manager when they declare one of four sensitive permissions: reading SMS, accessibility control, or notification access (fraud apps abuse these to steal one-time passwords). The dialog has only an OK button. SetBeat's companion mode needs notification access, because that is the only way Android lets an app see what another app is playing, so the full app was blocked. It only reads media playback info, but Play Protect cannot tell that from the manifest. The tested phone never showed the block because installing over adb is not one of the sources Play Protect checks.

  • Standalone declares none of the blocked permissions (and no audio capture and no internet). On-device tests check the installed package for exactly this, so it cannot creep back in.
  • Full is unchanged: companion mode needs notification access. On a phone that blocks it, install it with adb install setbeat-full-v0.3.0.apk, or wait for a Google Play listing (Play installs are not blocked). Pausing Play Protect's scanning also lets it through but lowers your phone's protection while paused, so it is not recommended.
  • I did not try to hide or delay the notification-listener declaration to get past the scan: that would evade a fraud-protection control and could get the app flagged as harmful.

Signed with SetBeat's own key (breaking for old installs)

Earlier versions (0.1 to 0.2.3) were signed with a shared debug key. From 0.3.0 releases are signed with a private RSA-4096 key that stays off GitHub. Android will not update across a signing-key change, so uninstall an older SetBeat first (its playlists and timer are removed), then install this. The package id is unchanged.

Signing certificate SHA-256 (must match):

23:79:00:8C:6B:C1:D0:15:77:63:FD:A5:D3:23:4B:51:3E:A5:78:55:1E:A9:5E:5D:8E:3B:17:5D:13:DF:B8:6A

File checksums (SHA-256, also in SHA256SUMS.txt):

0845eca047fd01240aa4faa6939c42038654584ab67315dc129a3930c5be2b2a  setbeat-full-v0.3.0.apk
3fe75f7d7f71ac4e5ecd69da1c0766dcbfdc86d544a5ce9818bf64d220033561  setbeat-standalone-v0.3.0.apk

Other changes

  • README install guide rewritten: which edition, what the Play Protect message means, your options, and how to verify a download. CONTRIBUTING.md, DECISIONS.md, PLAN.md, STRUCTURE.md and CHANGELOG.md updated.
  • Both editions are non-debuggable release builds (developer test hooks off). Version 0.3.0 (standalone reports 0.3.0-standalone).

How it was tested

  • 123 JVM unit tests for each edition, lint clean for each, clean release builds.
  • On-device tests on the test phone: 34 for the standalone edition (real gestures, the whole timer flow, and four checks that the installed package declares no notification listener, no sensitive bind permission, no Record audio or Internet, and shows no "Now playing" entry) and 33 for the full edition (same flows, plus checks that the listener and audio capture are present). All passed.
  • Both APKs were inspected directly: aapt2 permissions and manifest, apksigner verify (v2, exit 0, signed by the certificate above), not debuggable.

Not verified / known limitations

  • Not verified: the standalone APK on a phone that actually applies the Play Protect block (only the test phone was available; the manifest was inspected and tested instead), and installing the release-signed APKs on a real phone (it needs uninstalling the debug-signed copy, so it was not done on the only test phone). Please try the standalone edition on the phone that showed the block and report back.
  • Still unverified from earlier: the countdown-finished notification and its sound (needs a tap on the permission dialog), rescheduling after a reboot, other music apps than Mi Music, other phones for the beat wave, and launcher-specific icon shapes.
  • Not published on Google Play (that needs a developer account, closed testing and a policy review of notification-listener, Record audio and exact-alarm use). A Play Protect appeal is possible but its outcome for a permission-based block is unknown.
  • R8/minification is not enabled (about 29 MB per APK); see DECISIONS.md.

Full diff: v0.2.3...v0.3.0

Assets 5
Loading