Question on permissions

[IzzySoft]

The scanners at IzzyOnDroid just reported:

! repo/eu.darken.bluemusic_25801000.apk declares sensitive permission(s): android.permission.SYSTEM_ALERT_WINDOW
! repo/eu.darken.bluemusic_25801000.apk contains signature block blobs: 0x504b4453 (DEPENDENCY_INFO_BLOCK; GOOGLE)

Could you please clarify what SYSTEM_ALERT_WINDOW is needed for? As for DEPENDENCY_INFO_BLOCK, that can easily be avoided with a minor change to your build.gradle:

android {
    dependenciesInfo {
        // Disables dependency metadata when building APKs.
        includeInApk = false
        // Disables dependency metadata when building Android App Bundles.
        includeInBundle = false
    }
}

For some background: that BLOB is supposed to be just a binary representation of your app's dependency tree. But as it's encrypted with a public key belonging to Google, only Google can read it – and nobody else can even verify what it really contains. More details can be found e.g. here: Ramping up security: additional APK checks are in place with the IzzyOnDroid repo.

Thanks in advance!

[d4rken]

Could you please clarify what SYSTEM_ALERT_WINDOW is needed for?

As far as I remember it was a workaround for restriction on launching the app from background 🤔 I'd probably achieve this in a different way now, but I don't have the motivation to rewrite everything just for that while it works like it is.

38e20f2

As for DEPENDENCY_INFO_BLOCK, that can easily be avoided with a minor change to your build.gradle:

I'll make a PR

[IzzySoft]

I'll make a PR

Thanks!

but I don't have the motivation to rewrite everything just for that

So what shall I put as "justification" to the "green list" then? To see what I mean, here's the "green list" from Capod:

android.permission.ACCESS_COARSE_LOCATION: needed to access BLE broadcasts in earlier Android versions
android.permission.ACCESS_FINE_LOCATION: needed to access BLE broadcasts in earlier Android versions
android.permission.ACCESS_BACKGROUND_LOCATION: needed to scan for BLE while the app is in background
android.permission.BLUETOOTH_SCAN: needed to access BLE broadcasts in newer Android versions
android.permission.SYSTEM_ALERT_WINDOW: needed to display the pop-up window with battery infos when the airpods case is opened

[d4rken]

Needed on newer Android versions to change/monitor volume while the app is in the background

[IzzySoft]

Thanks! Updated and deployed.