Malware inside apk after building with flavor - android

I'm currently trying to publish my app on huawei appgallery.
for in app purchases the package name of the app has to end with ".huawei".
so I added a flavor to the build.gradle as they suggested.
flavorDimensions "default"
productFlavors {
google {
dimension "default"
}
huawei {
dimension "default"
applicationIdSuffix ".huawei"
}
}
I was also able to publish my app. but updates are now getting rejected.
the message is that there is malware inside.
I first thought it is a problem on their side when creating the apk from the app bundle
but then the message also appeared when using apk files.
I then installed TotalAV and started scanning the apk files after the build.
no matter what I changed the ".huawei" build always had this message.
I also tried to remove as many dependencies as possible - no change.
the google release apk has no problem!
I also added another flavor with some different suffix - this also had the malware.
the only difference to the google build is the suffix to the applicationId.
I'm pretty sure this is only a false negative but it would be nice to get rid of this message.
any help is appreciated :)

The possible causes are as follows:
To support multiple channels, you need to add the agconnect-services.json file to the flavor folder of only the Huawei channel and ensure that the AppGallery Connect plug-in version in the project is 1.2.1.301 or later classpath'com.huawei.agconnect:agcp:1.2.1.301').
If the plug-in version is earlier than 1.2.1.301, upgrade it to 1.2.1.301 or later. To obtain the latest AppGallery Connect plug-in version, please refer to Configuring Address Information for the AppGallery Connect SDK.
Modify configuration files to adapt to multiple flavors.
Configure the gradle.properties file. Add the following configuration at the end of the file:
org.gradle.jvmargs=-Dfile.encoding=UTF-8
Supporting Multiple Channels
If your project needs to support different app packages for different channels, the package name needs to vary depending on the channel. Change the package name in productFlavor in the build.gradle file under the app directory. If the same agconnect-services.json file is used for the two channels, the package name verification fails.
For more details, see docs.
Similar question: Different module file by flavor

I have now found the source of this problem.
some years ago I tested a feature that used device admin functionality.
there was still a xml file present in the res folder.
it looked like this
<device-admin xmlns:android="http://schemas.android.com/apk/res/android">
<uses-policies>
<limit-password />
<watch-login />
<reset-password />
<force-lock />
<wipe-data />
</uses-policies>
I have now removed this file and the malware message is gone.
But still strange that it only happened with the huawei build.

Related

Firebase android distribution won't allow applicationIdSuffix

When running ./gradlew appDistributionUploadDevDebug I get an error saying it can't find the app.
The culprit is having applicationIdSuffix = ".dev" in my dev flavor. Removing it allows the apk to be uploaded, but then the artifact wouldn't be built properly. For the record I plan using only the dev flavor for internal distribution.
I get an error message saying I should enable app distribution, but since this is done on a "firebase project" level and it's done for the main flavor I can't do it again.
* What went wrong:
Execution failed for task ':app:appDistributionUploadDevDebug'.
> App Distribution could not find your app 1:xxxxxxxxx:android:0b3f<xxxxxxxxx>.
Make sure to onboard your app by pressing the "Get started" button on the App Distribution page in the Firebase console:
https://console.firebase.google.com/project/_/appdistribution
Documenting this as a bug, I'll add a reply since I found a workaround.
Edit: expanded name of gradlew task that was shortened. Though it works it may make for easier searching.
Workaround:
To fix open app/google-services.json and look for the mobilesdk_app_id key for the main package name.
For example in my case I noticed that 1:xxxxxxx:android:0b3f<xxxxxxx> was the value for the package with the .dev suffix, while the main package name (without .dev) shows under 1:xxxxxxx:android:7eb88<xxxxxxxx>
So heading to app/build.gradle, the firebaseAppDistribution block would look like this
firebaseAppDistribution {
appId = "1:xxxxxxxx:android:7eb88<xxxxxxxx>"
I still think this is a bug in firebase distribution. Sounds like the distribution gradle code is picking the right value, but the distribution server is not compatible.
BTW When the developer wants/needs to have 2 separate firebase projects you need to download 2 separate google-services.json files, and place them in the appropriate flavor folders. I also have a (2nd and 3rd) app that shares a project with that setup, but haven't added firebase distribution yet to check how it behaves.
For reference, my workaround worked while providing a serviceCredentialsFile. I also tried using the web token authentication but my results were inconclusive.
I thought that would be the case, but it turns out that you have to enable app distribution for each apk (buildType and/or flavor).
When selecting a project on the firebase console, the page automatically selects one of the apps and I was just enabling app distribution for that one.
There's a dropdown at the top where you can select another app (build/flavor), and you have to go to each one individually and enable app distribution.
I hope this helps someone else.

Differentiate crash reporting between debug and production builds

I'm setting up Firebase Crashlytics for my Android app, and I would like the crash reports for the debug version to be separate from all other versions.
There are several copies of the auto-generated values.xml file (that is generated when the google-services plugin processes toe google-services.json file) located in the different retrospective buildType folders. One of the strings contained in the files is:
<string name="google_crash_reporting_api_key" translatable="false">{API-KEY}</string>
The API key is the same for each buildType, so I'm thinking if I can just create a new API key for the debug version, it'll solve the problem but how to do this? Or is there another way (that doesn't involve changing the applicationId as I can't do this)?
I've searched the android docs, looked up other articles and looked through other SO answers but no luck.
Any help welcomed, thank you.
You cannot differentiate the crash as per the build type (debug version).
You have to create a new project in the firebase with same app details (package name).
Get the API key for the project and then replace that key in your manifest file and DONE.
You just have to replace the key when you change your build Type.

APK package name issue in Google Play application upload

Really stupid question I know. I am trying to upload my first application to Google Play and I am having issues uploading the APK. I get an error message saying:
Upload failed
You uploaded a debuggable APK.
For security reasons you need to disable debugging before it can be published in Google Play.
Learn more about debuggable APKs.
You need to use a different package name because "com.example" is restricted.
Does anybody know the package I need to use? And also will this be the case in all files in my Android Studio Project?
Sorry for my ignorance but it is my first time uploading and I am fairly new to this. I would really appreciate advice. Thanking you.
Debuggable APK - If you're using the default Android Studio/Gradle setup, you have both a "debug" and "release" variant of your app build. You need to upload the "release" variant. If you haven't set up and backed up your release signing keychain yet, do so first.
Package name - this refers to the <manifest> element in AndroidManifest.xml. It has a similar format to Java package naming, and a few things are a little more convenient if it matches the package your source code is in, but it doesn't need to. Just change
<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
package="com.example"
android:versionCode="1"
android:versionName="1.0">
(where it says com.example) to something unique, and if you have any relative references elsewhere in the manifest (e.g. <activity android:name=".MainActivity"> etc) you'll need to make them fully qualified or move the Java class. Every app must have a different package name.

Crashlytics - different package names for different gradle flavours

I am trying to setup an Android app, using Android Studio with 2 different flavours. Each flavour changes packageName and applicationId - since I want 2 separate APK's submitted as 2 different products to Google Play.
I also try to setup separate apps in Crashlytics, one for each flavour. Although the first one was created without any problem, when I switch flavour, Crashlytics plugin for Android Studio still thinks that my project is already setup. So currently I cannot setup my Crashlytics for second flavour properly.
Thanks in advance for any suggestions.
As suggested by m4ch3t3 this workaround worked perfectly:
I created an empty project with package name matching the other
flavour. Using this project I created new app in Crashlytics. Then I
compiled both flavours of my real project and caused fake crashes in
them. Crashes were reported into matching Crashlytics apps
You can define different package name by definining applicationId in your app build.gradle as follow:
productFlavors {
dev {
applicationId "dev.myapp.app"
}
prod {
applicationId "prod.myapp.app"
}
}
Using the Crashlytics plugin for Android Studio will be a PITA in your case.
What you really need is only the API key and secret - shared among the same organisation - so if you already have one app correctly deployed on Crashlytics you can access those data from your organisation profile.
Just log out from the android studio plugin (CTRL+L while the plugin popup is focused), and take a look at this answer that explain how to deal with multiple flavour and multiple keys.

Android Market - This application is available to over 0 devices?

I have published apk to the Android Market, activated and setup for free for all countries.
Android Market says, my application is not compatible with any of the devices. I can see an application when I access Android Market from the PC browser but I can not download it from any of the Android phone (the same device used to test application before release).
How is that possible if I have just few requirements? I have tested the application on a few quite old devices before upload and it worked.
Information from the Publishing options:
This application is only available to devices with these features, as defined in your application manifest.
Screen layouts: SMALL NORMAL LARGE XLARGE
Required device features
android.hardware.screen.portrait
android.hardware.touchscreen
*This application is available to over 0 devices.*
Information fron the APK tab:
VersionCode: 2
VersionName: 1.0.1
Size: 4.3M
Localized to: default
Permissions: android.permission.READ_PHONE_STATE, android.permission.INTERNET, android.permission.WRITE_EXTERNAL_STORAGE, android.permission.ACCESS_NETWORK_STATE
Features: android.hardware.screen.portrait, android.hardware.touchscreen
API level: 7-15+
Supported screens: small-xlarge
OpenGL textures: all
If it is not strange enough, I have another application at the same account with very similar requirements and it gives me: This application is available to over 746 devices.
What is going on?
UPDATE:
Because many answers suggests something like: "Just activate your APK..." I emphasize it again:
APK is ACTIVATED (as stated at the beginning of the question and presented on the screenshot above).
Probably your uploaded APK file is not active. You can check this in the APK tab and switch to "Advanced mode". Here you should have 2 categories, "Active" and "Inactive".
Your file is probably in the Inactive category and you can change it by clicking the Activate link that should be behind it.
Hope my translations are correct as my Market account is in Dutch :)
I had a similar problem, I explained before but a moderator deleted it.
My app after an update had was available for 0 devices.
Anyway I found the solution for my case, so you can check if it works for you as well.
my mistake was that I included .jar files in order to add some external libraries and not the respective external class folders. When I removed the .jar files and I just added the class folder then devices became over 700 again.
for example I had the facebook API (an old one, not the current) and I had created a jar file out of it in order to include it like this in my app.
So when I removed the jar files and added the Facebook API projecy (Project Properties -> Java Build Path -> Projects -> Add..., the app was OK for the android market.
Hope I helped you!
For the records, I've found that one significant change that solved my case. Full explanation is at this post on Android Market Product Group.
Quick answer is remove the following uses-feature nodes from your manifest if present:
<uses-feature
android:name="android.hardware.touchscreen"
android:required="false" />
<uses-feature
android:name="android.hardware.faketouch" />
Just activate the app on the APK files tab and you'll be ok.
i had similar issue, and resolved it just following the advice from http://androidforums.com/threads/0-devices-support-my-app-no-compatible-devices-on-play-store.947943/ , which was to change in build.gradle line compile 'org.apache.directory.studio:org.apache.commons.codec:1.8' to compile 'commons-codec:commons-codec:1.8' (so more or less general rule can be drawn, that you need to delete org.apache.(...) up to the package name and then just double it before semicolon).
I would be glad though, if someone would point me out why it was like that. Looking for the second term in Maven Central through Android Studio returned no results actually, so I doubted at first if it is going to work at all.

Categories

Resources