Obtainium – Get Android App Updates Directly from the Source

by gray_charger • 3 years ago

2 5 3 years ago

jqpabc123• 3 years ago

So I guess the world of apps has come full circle --- from direct download to app store extortion back to direct download.

ggm2• 3 years ago

hmmm. mediated access. how do I know to trust the hash checksum checks? Feels like it requires an independent tool to verify what I should get and what I do get because .. trust isn't transitive through a proxy.

westurner2• 3 years ago

There could be asset hashes in sigstore: https://sigstore.dev/

Is there a good way to run native mobile app GUI tests with GitHub Actions?

A VM/container emulator like anbox, waydroid, (or all of ChromeOS Flex in KVM) in a GitHub Action is probably enough to run GUI tests?

A SLSA builder for Android apps would be good: "Build your own SLSA 3+ provenance builder on GitHub Actions" https://slsa.dev/blog/2023/08/bring-your-own-builder-github

FWIU e.g. Fdroid does not do SafetyNet-like SAST scans of APKs.

ggm2• 3 years ago

Yea I can see how you could know. The problem is.. a tool like this has the awesome and can say "oh yes I checked all those this random APK is definitely the one you wanted"

Thats what F-Droid and Google store (and the apple store) do: they stand their assets as "if we lied, you know where to find us" regarding the provenance of what they pass. They do of course, also routinely (ok not Apple mostly) pass apps which do heinous bad things, because it turns out there's only so much automated tests can find.

As you observe, sometimes the promise is hollow. (F-Droid)

Obtainium – Get Android App Updates Directly from the Source

Related Stories