Skip to main content

mastodon - Link to source

There is just an extra sync running now for our repo. We had added new known vulnerable certificates to our "badcert list" and were performing a full repo scan; 3 apps had to be removed. 2 of them haven't seen an update in years, for the 3rd one we informed the developers.

#IzzyOnDroid repo

#izzyondroid
in reply to IzzyOnDroid ✅

mat
gotosocial - Link to source
mat
• •
how to identify as a user which apps where removed from the repo, so that one could delete them as well from the phone?
in reply to mat

IzzyOnDroid ✅
mastodon - Link to source
IzzyOnDroid ✅
• •

@mat The apps in this case were quite specific, so I doubt they were "widely used". As with the download stats (which we now finally have available publicly), we need to establish an easy and transparent way for that.

For now, you can look at our transparency log: gitlab.com/IzzyOnDroid/iodrepo… is last (and here relevant) commit; scroll to "repo/filesystemlog.json" to see what was removed: DroidFrida, WebInspector, BTCMap.

BTCMap at F-Droid.org is NOT affected, that's signed by F-Droid themselves.


fdroid update (70806436) · Commits · IzzyOnDroid / iodrepo_binary_transparency_log · GitLab

a binary transparency log of apt.izzysoft.de/fdroid
GitLab
@mat
in reply to IzzyOnDroid ✅

IzzyOnDroid ✅
mastodon - Link to source
IzzyOnDroid ✅
• •
For those who wonder: there's an automated monthly scan in place, too, so we cannot forget to scan existing APKs whenever a new cert was added to the "badlist". Ideally of course, a scan is initiated right after adding new "candidates" 😉
⇧