Question on permissions of the Android app

[IzzySoft]

My scanner got some new checks implemented in January, on on today's release reported:

! repo/org.handmadeideas.floccus_5000010.apk declares sensitive permission(s):
  android.permission.READ_EXTERNAL_STORAGE
! repo/org.handmadeideas.floccus_5000010.apk contains signature block blobs: 0x504b4453 (DEPENDENCY_INFO_BLOCK; GOOGLE)

Can you please clarify what the storage permissions (READ and WRITE) are needed for? As for DEPENDENCY_INFO_BLOCK, that can easily be avoided:

android {
    dependenciesInfo {
        // Disables dependency metadata when building APKs.
        includeInApk = false
        // Disables dependency metadata when building Android App Bundles.
        includeInBundle = false
    }
}

For some background: that BLOB is supposed to be just a binary representation of your app's dependency tree. But as it's encrypted with a public key belonging to Google, only Google can read it – and nobody else can even verify what it really contains.

Thanks in advance!

[marcelklehr]

I guess the storage permissions are used for import/export of bookmarks

[IzzySoft]

Aren't you using Storage Access Framework (SAF) there? For export/import, just a single directory would be needed – and minSdk is set to 5.1, so SAF is available for all affected Android versions and would fit in nicely. If not, then of course this could be the reason (WRITE_EXTERNAL_STORAGE is requested as well, so export/import would be covered).

Can you please check, Marcel? And also include the includeInApk = false for the dependencyInfo? Thanks in advance!

[marcelklehr]

Yes, import/export in android was introduced by this commit b83bb67 which also added the permissions you cited.

[IzzySoft]

OK, thanks Marcel – added it to the "green list" then with the explanation of its being used for export/import. Should you one day go SAF for these and drop the permissions, my updater should tell me that and I can remove it again.

So only DEPENDENCY_INFO_BLOCK is left open for now.

[marcelklehr]

See 34a6c16

[IzzySoft]

Awesome, thanks!