obfusk

#!/usr/bin/python3
# encoding: utf-8
# SPDX-FileCopyrightText: 2023 FC Stegerman <[email protected]>
# SPDX-License-Identifier: GPL-3.0-or-later

import zipfile
import zlib

from fnmatch import fnmatch
from typing import Any, Dict

obfusk

#!/usr/bin/python3
# SPDX-FileCopyrightText: 2023 FC Stegerman <[email protected]>
# SPDX-License-Identifier: AGPL-3.0-or-later

import argparse
import os
import subprocess
import tempfile
import zipfile

obfusk

JavaScript detection

$ cd /usr/share/nodejs
$ find -name '*.js' | wc -l
16761
$ find -name '*.js' -print0 | sort -z | xargs -0 file \
  | grep -Ev ': *(symbolic link|(empty|directory)$)' \
  | sed -r 's/.*: *//; s/(with very long lines).*/\1/' \
  | sort | uniq -c

obfusk

#!/bin/bash
# dexdump -a -d -f -h classes.dex > classes.dex.dump
sed -i -r 's/^[0-9a-f]{6}: [ .0-9a-f]*\|(\[[0-9a-f]{6}\]|[0-9a-f]{4})?/|/' "$@"
sed -i -r 's! // [a-z0-9_]+@[0-9a-f]+$!!' "$@"
sed -i -r '/(interfaces_off|source_file_idx|annotations_off|class_data_off|superclass_idx|class_idx|method_idx|^Class #|^Annotations on|^ *0x[0-9a-f]{4} line=[0-9]+$)/d' "$@"

obfusk

Bug: baseline.profm not deterministic

See https://issuetracker.google.com/issues/231837768

Should be fixed by this commit, which is not yet part of an Android Gradle plugin release.

Analysis by @obfusk

obfusk

# Android APK file (Zip archive)
0	string		PK\003\004
!:strength +1
# Starts with AndroidManifest.xml (file name length = 19)
>26	uleshort	19
>>30	string	AndroidManifest.xml	Android package (APK), with AndroidManifest.xml
>>>-22	string	PK\005\006
>>>>(-6.l-16)	string	APK\x20Sig\x20Block\x2042	\b, with APK Signing Block
!:mime	application/vnd.android.package-archive
!:ext	apk

obfusk

#!/usr/bin/python3
from calendar import monthrange
from datetime import datetime, timedelta
now = datetime.now()
print(now - timedelta(days=monthrange(now.year - (now.month == 1), (now.month - 2) % 12 + 1)[1]))

obfusk

#!/usr/bin/python3
# SPDX-FileCopyrightText: 2022 FC Stegerman <[email protected]>
# SPDX-License-Identifier: GPL-3.0-or-later

import argparse
import json
import re
import shlex
import sys

obfusk

Reproducible Builds

According to the reproducible builds definition:

A build is reproducible if given the same source code, build environment and build instructions, any party can recreate bit-by-bit identical copies of all specified artifacts.

In the case of android apps, that means bit-by-bit identical APK files.

obfusk

#!/bin/bash
set -e
jq -r '.apps[].packageName' < index-v1.json | sort > index-apps
( cd fdroiddata/metadata; ls *.yml ) | sed 's!\.yml$!!' | sort > metadata-apps
( cd fdroiddata/metadata; grep -l 'ArchivePolicy: 0' *.yml ) | sed 's!\.yml$!!' | sort > metadata-apps-archived
diff -Naur metadata-apps metadata-apps-archived | grep ^- | cut -c2- | tail -n +2 > metadata-apps-not-archived
diff -Naur index-apps metadata-apps-not-archived | grep ^- | cut -c2- | tail -n +2 > index-apps-not-in-metadata
diff -Naur index-apps metadata-apps-not-archived | grep ^+ | cut -c2- | tail -n +2 > metadata-apps-not-in-index