obfusk

import code; code.interact(local=dict(globals(), **locals()))

obfusk

APK Signing Block considerations

Some considerations regarding the APK Signing Block and how F-Droid handles Reproducible Builds.

Block types

APK Signature Scheme Block

The signature part of the APK Signing Block can contain more than one signature.
AFAIK android and apksigner (unlike apksigtool) only check the one with the strongest supported signature algorithm ID, not all of them.

obfusk

openssl req -x509 -newkey rsa:4096 -sha512 -outform DER -out cert.der -days 10000 -nodes -subj '/CN=test key' -keyout - | openssl pkcs8 -topk8 -nocrypt -outform DER -out privkey.der

obfusk

import dataclasses
import sys
import zipfile

from pathlib import Path

import PIL
import PIL.Image
import apkrepotool
import apkrepotool.xml_icons as xml_icons

obfusk

// firefox only
(async () => { for (const x of document.querySelectorAll("img:-moz-broken")) { x.src = x.src; await new Promise(r => setTimeout(r, 100)); console.log(x) }; console.log("done") })()

// generic
(async () => { for (const x of document.querySelectorAll("img")) { if (!x.naturalWidth) { x.src = x.src; await new Promise(r => setTimeout(r, 100)); console.log(x) } }; console.log("done") })()

obfusk

                    GNU GENERAL PUBLIC LICENSE
                       Version 3, 29 June 2007

 Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
 Everyone is permitted to copy and distribute verbatim copies
 of this license document, but changing it is not allowed.

                            Preamble

  The GNU General Public License is a free, copyleft license for

obfusk

#!/usr/bin/python3
# encoding: utf-8
# SPDX-FileCopyrightText: 2024 FC (Fay) Stegerman <flx@obfusk.net>
# SPDX-License-Identifier: AGPL-3.0-or-later

import os
import struct
import zipfile

from dataclasses import dataclass

obfusk

#!/usr/bin/python3
import struct
import sys
import zipfile

zfile, entry = sys.argv[1:]

with zipfile.ZipFile(zfile) as zf:
    info = zf.getinfo(entry)
    with open(zfile, "rb") as fh:

obfusk

#!/usr/bin/env python3
import hashlib
import sys

import apkrepotool

from pathlib import Path

for apk in sys.argv[1:]:
    certs, _ = apkrepotool.get_signing_certs(Path(apk))

obfusk

import glob
import json
import sys

from typing import Dict

appid, = sys.argv[1:]
results: Dict[str, int] = {}
for json_file in sorted(glob.glob("apk_downloads/*/*.json")):
    with open(json_file, encoding="utf-8") as fh: