Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
floss.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
For people who care about, support, and build Free, Libre, and Open Source Software (FLOSS).

Administered by:

Server stats:

685
active users

floss.social: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.7

IzzyOnDroid ✅

Great to see you're adopting some of the features we've implemented earlier this year at @fdroidorg! Maybe you want to check our documentation on them?

android.izzysoft.de/articles/n

* it's SIGNING blocks, not FROSTING blocks
* MEITUAN is about payload, not metadata
* there's no fixed number of blocks as your code assumes (gitlab.com/fdroid/fdroidserver)

The article you link to (bi-zone.medium.com/easter-egg-) tells you the same :wink:

screenshot from the merge request adding checks for signing blocks, calling them "frosting blocks", the Meituan Payload block "metadata", and the frosting block "Google metadata"
screenshot from an issue comment to developers, describing the DEPENDENCY_INFO_BLOCK as "frosting block"
Nov 06, 2024, 08:21 PM·Public
5boosts·9favorites
Public
IzzyOnDroid ✅

@fdroidorg Only what you call "Google metadata" (0x2146444E) is the Google Play Frosting Block, neither the DEPENDENCY_INFO_BLOCK (0x504b4453) nor the MEITUAN_APK_CHANNEL_BLOCK (0x71777777) are. And Meituan calls their block Payload themselves:

github.com/search?q=repo%3AMei

screenshot from code by Meituan, clearly addressing their block with a "PayloadWriter"
Public
IzzyOnDroid ✅

@fdroidorg PS: you can find our corresponding code here:

gitlab.com/IzzyOnDroid/repo/-/

Note the "UNKNOWN" towards the end of the screenshot, to make sure yet unknown blocks are not missed.

screenshot from a part of IzzyOnDroid's code to check for signing blocks, also covering "unknown" blocks should they appear so they can be investigated
Public
Fay 🏳️‍🌈

@IzzyOnDroid

My Android APK signing block payload PoC from Feb 2023 can use either a custom block or hide the payload in the verity padding block.

The IzzyOnDroid scanner will catch either variant, but the F-Droid scanner will miss both.

github.com/obfusk/sigblock-cod

GitHubGitHub - obfusk/sigblock-code-poc: android apk signing block payload pocandroid apk signing block payload poc. Contribute to obfusk/sigblock-code-poc development by creating an account on GitHub.
Explore
About