hhmx.de

· Föderation EN Fr 12.07.2024 12:16:00

@matchboxbananasynergy
We had reports that obtanium was also affected: digitalcourage.social/@cryptgo
Other ROMs don't seem to be affected.

Can you get us logcat from the moment you pressed 'update'?

Föderation EN Fr 12.07.2024 21:22:45

@grote To me, there seem to be two "issues" here. One is automatic updates not occurring, which I am unable to reproduce.

The second issue, which I've only ever seen from F-Droid is the issue mentioned by @uvok here, where it seems that F-Droid Basic is trying to take ownership of updates despite already being the owner of updates.

Which issue are we referring to here?

Föderation EN Fr 12.07.2024 21:26:24

@matchboxbananasynergy We may have found the cause of the first issue: gitlab.com/fdroid/fdroidclient
The second one may be caused by that one. It had the ownership already and now updates without session installer. Would explain the confusing dialog. We'll know for sure once first issue is fixed.

Föderation EN Fr 12.07.2024 21:35:08

@grote Thanks for the link. So it seems to be specific to F-Droid, right? I'm puzzled about someone saying Obtainium doesn't auto update on GrapheneOS cause it has been for me. Then again, its developer isn't an Android developer and it's known the the Flutter plugins used for it aren't the most reliable.

It's also worth noting that it's not just GrapheneOS that adds the sensors permission. Unless I'm severely mistaken, DivestOS does too, as do other projects based on GrapheneOS, so it would be good to get this fixed for people not using GrapheneOS as well. It sounds like the check in question might not be necessary at all?

I don't see a reason for the modern installer and for auto updates to not be used by default. The way to differentiate whether the OS the app is running on should be done by checking the Android version, right?

Föderation EN Fr 12.07.2024 21:41:38

@matchboxbananasynergy the check can be necessary to validate claimed permissions, but I opened gitlab.com/fdroid/fdroidclient to remove the current action it takes. This should fix the issue.

However, giving all apps a permission they don't have in their manifest is breaking how permissions work on Android and breaking other things besides F-Droid is expected.

Föderation EN Fr 12.07.2024 21:41:58

@grote I also wanted to additionally comment on "thanks! The log shows, that every app automatically gets the android.permission.OTHER_SENSORS permission without even asking for it which is a weird thing to do as it is isn't how permissions in Android work and may break other things."

The reason why the permission is granted to apps by default is for app compatibility. Since this permission isn't a regular one, apps expect to be able to use sensors. There is a setting that can deny this permission to apps by default, in which case when an app tries to access the device's sensors covered by that permission, the user is notified and can optionally grant sensors access to that specific app.

Föderation EN Fr 12.07.2024 21:43:32

@matchboxbananasynergy It surely is a nice feature, but IMHO not implemented correctly. tl;dr If you give apps a permission they didn't ask for, then at least also fake (as the OS) that they asked for it.