Run scan for DependencyInfoBlock on a full repo mirror

Based on fdroidserver#1056

Local repo mirror synced up to Aug 04 2024 index updates.

Folder repo/ holds the repo mirror files

$ git clone https://github.com/obfusk/apksigtool
$ cd apksigtool
$ pipx install -e .
$ export PATH=~/.local/bin:$PATH
$ git clone https://gitlab.com/fdroid/fdroiddata scanblock
$ grep -e Binaries\: -e binary\: scanblock/metadata/*.yml | cut -d "/" -f3 | cut -d ":" -f1 | sort -u | sed 's/.yml//g' | wc -
416 (apps in repo that use Binaries/binary, but some are archived/disabled)
$ mkdir -p scanblock_result/repo
$ for i in $(grep -e Binaries\: -e binary\: scanblock/metadata/*.yml | cut -d "/" -f3 | cut -d ":" -f1 | sort -u | sed 's/.yml//g'); do find repo/ -iname "$i*.apk" \( -exec echo {} \; -exec sh -c "apksigtool parse --json {} | jq -r '.pairs[].value._type' > scanblock_result/{}.log" \; \); done
$ grep DependencyInfoBlock -r scanblock_result | cut -d ":" -f1 | sed 's/.apk.log//'|rev|cut -d "_" -f2-|rev|sort -u|wc -l
293 (apps that have at least one APK with it)

App list: $3735070

Next step, I'll peruse the logs to find those that got it fixed in the latter versions.

Up next I guess open an issue to each app and ask them to opt-out:

android {
    dependenciesInfo {
        // Disables dependency metadata when building APKs.
        includeInApk = false
        // Disables dependency metadata when building Android App Bundles.
        includeInBundle = false
    }
}