obfusk

+ git clone --recurse-submodules -b 1.0.0 -- https://github.com/FossifyOrg/File-Manager.git /build/repo
++ git rev-parse HEAD
+ test feef6998a0fc79aa859f54699d783df4f0a0c147 = feef6998a0fc79aa859f54699d783df4f0a0c147
+ '[' yes = yes ']'
+ git clone https://github.com/obfusk/gradle-wrapper-verify /tmp/gradle-wrapper-verify
Cloning into '/tmp/gradle-wrapper-verify'...
+ shopt -s globstar
+ /tmp/gradle-wrapper-verify/gradle-wrapper-verify ./gradle/wrapper/gradle-wrapper.jar
checking ./gradle/wrapper/gradle-wrapper.jar ...
OK

obfusk

#!/usr/bin/python3
# encoding: utf-8
# SPDX-FileCopyrightText: 2024 FC (Fay) Stegerman <flx@obfusk.net>
# SPDX-FileCopyrightText: 2024 Izzy
# SPDX-License-Identifier: GPL-3.0-or-later

import argparse
import logging
import os
import sys

obfusk

import base64
import hashlib
import sys
t = str.maketrans("ABCDEFGHIJKLMNOPQRSTUVWXYZ234567", "ybndrfg8ejkmcpqxot1uwisza345h769")
print(base64.b32encode(hashlib.sha1(sys.argv[1].encode().lower()).digest()).decode().translate(t))

obfusk

#!/usr/bin/python3
# encoding: utf-8
# SPDX-FileCopyrightText: 2024 FC (Fay) Stegerman <flx@obfusk.net>
# SPDX-License-Identifier: GPL-3.0-or-later

import apksigtool
import dataclasses
import sys

# Usage: cat_sigblock.py [--prepend] APK_A APK_B

obfusk

Edit: originally posted here on 2023-11-17.

Edit 2: "blocking protecting marginalised community members from abuse" refers to the events during the incident (which was never made public, which unfortunately leaves me unable to provide more detail) that prompted the creation of the Community Council to begin with.

Edit 3: please note that this statement was originally addressed to the F-Droid team, not a general audience.

Leaving F-Droid

With a heavy heart, I have no choice but to leave @fdroid, effective immediately.

obfusk

Bug: baseline.profm not deterministic

See https://issuetracker.google.com/issues/231837768

Should be fixed by this commit, which is not yet part of an Android Gradle plugin release.

Analysis by @obfusk

obfusk

HOWTO: diff & fix APKs for Reproducible Builds

NB: assumes signed APK from upstream named upstream-release.apk, and unsigned APK from F-Droid CI named fdroiddata-ci.apk.

NB: also assumes a working directory in which it is okay to create temporary files & directories.

Links

obfusk

// See https://developer.android.com/studio/publish/app-signing#secure-shared-keystore
def keystorePropertiesFile = rootProject.file("keystore.properties")
def keystoreProperties
def signedReleases = keystorePropertiesFile.exists()

if (signedReleases) {
    println("Using ${keystorePropertiesFile} for release signingConfig...")
    keystoreProperties = new Properties()
    keystoreProperties.load(new FileInputStream(keystorePropertiesFile))
}

obfusk

do_stuff && screen -X -S $( screen -ls | awk '{print $1}' | grep "^$PPID\." ) quit

obfusk

#!/bin/bash
diff -Naur \
  <( sed -n '/name="locale_values"/,/string-array/p' < app/src/main/res/values/settings.xml \
       | grep '<item>' | sed -r 's!.*>(.*)<.*!\1!' | sort | grep -v '^en$' ) \
  <( ls app/src/main/res/values-* -d | sed 's!.*values-!!' | grep -Ev 'night|w600dp' ) \
  | bat -p -l diff