Develop Reference

How to emulate outdated SSL Provider on Android?

I'm implementing 'Update security provider' feature for an Android application.
I implemented as it said in 'Patch asynchronously' and need to test/emulate all outcomes: user prompt demonstration and the error is unrecoverable.
I tried to delete Play Store updates, use previous com.google.gms:google-services version or android 6.0 — it always silently goes to onProviderInstalled(), never shows prompt or goes to onProviderInstallFailed().
I did exactly as said at https://developer.android.com/training/articles/security-gms-provider#example_async
Also in android\build.gradle:
buildscript {
...
dependencies {
...
classpath("com.google.gms:google-services:4.3.3")
}
}

install_referrer intent deprecation

I have received email from google:
We recently announced that we’ll be deprecating the install_referrer intent broadcast mechanism. Because one or more of your apps uses this intent to track referrals, we wanted to ensure you make the switch before March 1, 2020. After this date, new versions of the Play Store app will no longer broadcast the install_referrer intent after app installs.
I am not using install_referrer directly, but while browsing merged manifest i discovered that some firebase service named with package name com.google.firebase.measurement use it.
My firebase dependencies updated to latest version.
Should I care about it?

From Firebase support:
This is a great catch. Thanks for bringing this to our attention.
There's no need [to take] action from your end as of now, I've created an
internal request so we could provide an alternative for the
install_referrer intent broadcast before its deprecation. As of now,
we are yet to find out any details or timelines as to when it will be
implemented. You can check our release notes from time to time for any
updates about Firebase features and its services.
Strange that Google's products are not synchronized.
However if you are not using Firebase and your app contains third party libraries that use install_referrer kindly check directly with them.
To find in which library install_referrer included, open merged manifest and search for install_referrer, check the package name of the service in which the install_referrer included.

com.google.firebase:firebase-core:17.2.1 and com.google.firebase:firebase-analytics:17.2.1 add INSTALL_REFERRER to AndroidManifest. Probably need to wait till Firebase team updates these packages to use the new API.

Various SDKs can register a receiver for the install referrer.
For developers who are unsure about which SDK added a receiver to your manifest it's useful to look at the manifest merge blame file.
Typically, in build/ there's a file intermediates/manifest_merge_blame_file/release/manifest-merger-blame-release-report.txt
In that file you'll need to find receivers that have
<action android:name="com.android.vending.INSTALL_REFERRER" />
in it's intent-filter, and the line before it will indicate what the source of that line is in your manifest.
For instance, the relevant lines for one of my apps looks like this:
44 <receiver
44-->[com.appbrain:appbrain-sdk:15.10] .../jetified-appbrain-sdk-15.10/AndroidManifest.xml:29:9-35:20
45 android:name="com.appbrain.ReferrerReceiver"
45-->[com.appbrain:appbrain-sdk:15.10] .../jetified-appbrain-sdk-15.10/AndroidManifest.xml:30:13-57
46 android:exported="true" >
46-->[com.appbrain:appbrain-sdk:15.10] .../jetified-appbrain-sdk-15.10/AndroidManifest.xml:31:13-36
47 <intent-filter>
47-->[com.appbrain:appbrain-sdk:15.10] .../jetified-appbrain-sdk-15.10/AndroidManifest.xml:32:13-34:29
48 <action android:name="com.android.vending.INSTALL_REFERRER" />
48-->[com.appbrain:appbrain-sdk:15.10] .../jetified-appbrain-sdk-15.10/AndroidManifest.xml:33:17-79
48-->[com.appbrain:appbrain-sdk:15.10] .../jetified-appbrain-sdk-15.10/AndroidManifest.xml:33:25-76
49 </intent-filter>
50 </receiver>
This shows that the AppBrain SDK (of which I'm one of the developers) adds a receiver for the install referrer. The following image from our blogpost explaining what exactly changes (https://medium.com/appbrain/the-google-play-referrer-api-and-the-appbrain-sdk-38cfbaa350dc) is clarifying what Google is changing:

After checking the manifest file on my builded apk, i found the install refeer broadcast used by the firebase-measurement-connector module on Firebase Core Analytics so i exclude them :
implementation ('com.google.firebase:firebase-ads:17.2.0')
{
exclude group: 'com.google.firebase', module: 'firebase-core'
exclude group: 'com.google.firebase', module: 'firebase-analytics'
exclude group: 'com.google.firebase', module: 'firebase-measurement-connector'
}
And then recheck again my manifest mereged file by Analyzing APk and the Install refeer broadcast is disappeared.
On other side, if you use track analytics, Google ask to switch to the Install Referrer API https://developer.android.com/google/play/installreferrer/library.html before March 2020

I checked Firebase support agent for this issue. Firebase libraries are using install_referrer, and I got below response from Firebase support agent:
This is a great catch. Thanks for bringing this to our attention. I'm
currently in discussion with our Analytics experts and will get back
within 48 hours, or as soon as I have more information. For now, no
need for any action from your end, wait for the next update from the
Firebase team.
I believe we need to wait Firebase's next release. And Firebase team updates these packages to use the new API.
If you have used this API in your code by yourself, then you need to change it immediately as you are not depending on firebase or any other third party library provider.

There is one article on Android developer blog about this
https://android-developers.googleblog.com/2019/11/still-using-installbroadcast-switch-to.html
Also in this article they mention old implementation of install_referrer intent broadcast mechanism and provide complete information. So we can find this in our existing code.
https://developers.google.com/analytics/devguides/collection/android/v4/campaigns#google-play-campaigns

INSTALL_REFERRER comes not only with Firebase but also withADMOB. I can confirm that Admob v3.18.3 has this permission but it is no longer coming in Admob v4.2.1. I have not tested other versions but i have heard that some previous versions like 4.2.0 & 4.1.0 also not carrying this permission.
But the question here is whether we need to remove the permission or we need to make sure that if our app is using Play Install Referrer Library then the INSTALL_REFERRER must be included. Because action required is not to remove it but migrate to it.

How to run an Apache-Mina SSHD-Server (2.2.0) on Android Pie?

I'm trying to run an Apache MINA SSHD Server (v. 2.2.0) on an Android Pie (API 28.0) device. I found various post about it running on Android 4 devices, but none of them seems to work on my Android 9 device. So I tried to implement it myself but got stuck at the initialization of the Server with a ReflectionException/NoClassDefFoundError.
When I try to set up the server with SshServer.setUpDefaultServer(); I get this exception:
java.lang.NoClassDefFoundError: Failed resolution of: Ljavax/management/ReflectionException;
at org.apache.sshd.common.util.GenericUtils.peelException(GenericUtils.java:730)
at org.apache.sshd.common.util.GenericUtils.peelException(GenericUtils.java:728)
at org.apache.sshd.common.util.security.SecurityEntityFactory$2.getInstance(SecurityEntityFactory.java:134)
at org.apache.sshd.common.util.security.SecurityUtils.getMessageDigest(SecurityUtils.java:726)
at org.apache.sshd.common.digest.DigestUtils.checkSupported(DigestUtils.java:53)
at org.apache.sshd.common.digest.BuiltinDigests.<init>(BuiltinDigests.java:61)
at org.apache.sshd.common.digest.BuiltinDigests.<clinit>(BuiltinDigests.java:36)
at org.apache.sshd.common.cipher.ECCurves.<clinit>(ECCurves.java:61)
at org.apache.sshd.common.keyprovider.KeyPairProvider.<clinit>(KeyPairProvider.java:63)
at org.apache.sshd.common.signature.BuiltinSignatures.<clinit>(BuiltinSignatures.java:62)
at org.apache.sshd.common.BaseBuilder.<clinit>(BaseBuilder.java:133)
at org.apache.sshd.server.ServerBuilder.builder(ServerBuilder.java:165)
at org.apache.sshd.server.SshServer.setUpDefaultServer(SshServer.java:429)
at ch.zhaw.init.sshshell.SshShellService.<init>(SshShellService.java:20)
From some older posts for Android 4 it seems that this is was a known problem and the solution there was to add $useLibrary 'org.apache.http.legacy' to gradle and add to the manifest.xml. I did that but the exception still occurs.
build.gradle file:
android {
compileSdkVersion 28
useLibrary 'org.apache.http.legacy'
...
}
dependencies {
...
implementation 'org.apache.sshd:sshd-core:2.2.0'
implementation 'org.slf4j:slf4j-simple:1.6.2'
implementation 'org.apache.mina:mina-core:2.1.2'
implementation "org.bouncycastle:bcprov-jdk16:1.46"
}
manifest.xml
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
package="ch.zhaw.init.sshshell">
<application
android:networkSecurityConfig="#xml/network_security_config">
<uses-library android:name="org.apache.http.legacy"
android:required="false" />
<service android:name=".SshShellService">
<intent-filter>
<action android:name="StartSshServer"/>
</intent-filter>
</service>
</application>
</manifest>
My Java-Code:
import org.apache.sshd.server.SshServer;
import org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider;
private static final int PORT = 8022;
private final SshServer sshd = SshServer.setUpDefaultServer(); // Here I get the error
private final SimplePasswordAuthenticator passwordAuth = new SimplePasswordAuthenticator();
private final SimplePublicKeyAuthenticator publicKeyAuth = new SimplePublicKeyAuthenticator();
private final SimpleForwardingFilter forwardingFilter = new SimpleForwardingFilter();
It seems that older versions worked, but I search for days and did not find any working example for the newest version. Does anyone has a working example which runs the latest version of Apache Mina SSHD (2.2.0) on Android 9 (without rooting the device)?
or if not is there an alternative SSH-Server (not client - there are many of them) for Android Pie?
Thank you for any help.

For this specific failure, it suffices to create a dummy ReflectionException class (example). Given that the class doesn't even exist, nothing outside of your own code would ever instantiate it, so SSHD's instanceof ReflectionException check would never match, and you don't need to program any of its members.
You'll also want to create a dummy MBeanException (example).

the error because of BouncyCastle lib has been deprecated as android9(api level 28).
you can get detail tips from aosp: http://androidxref.com/9.0.0_r3/xref/libcore/ojluni/src/main/java/sun/security/jca/Providers.java#548
https://android-developers.googleblog.com/2018/03/cryptography-changes-in-android-p.html
to solve this problem ,you can follow steps:
uninstall BouncyCastleProvider from system default
Security.removeProvider("BC");
install new "BC" custom provider
Security.addProvider(new BouncyCastleProvider());
init your mina sshd Service
SshServer sshd = SshServer.setUpDefaultServer();
sshd.setPort(ssdServerPort);
....
aosp just compare object to decide if bc provider object is system default provider,so just replace with new bc provider object
:http://androidxref.com/9.0.0_r3/xref/libcore/ojluni/src/main/java/sun/security/jca/Providers.java#341
notes: you must uninstall provider with :Security.removeProvider("BC"),before install provider

Can i disable Firebase plugin for specific flavor?

I'm currently trying out the Firebase analytics suit, but, i have faced one small issue, my app is distributed on both google play and amazon store (which doesn't support google play services), so for the amazon flavor i want to remove the dependency to Firebase (which i already know how to do), but, i also need to remove the Firebase plugin, so that it doesn't throw an exception while building.
This is what i have as far now:
productFlavors {
google {
applicationId 'google app id'
}
amazon {
applicationId 'amazon app id'
}
}
dependencies {
googleCompile 'com.google.firebase:firebase-analytics:9.0.0'
amazonCompile 'com.amazonaws:aws-android-sdk-mobileanalytics:2.2.12'
amazonCompile('com.crashlytics.sdk.android:crashlytics:2.5.1#aar') {
transitive = true;
}
}
apply plugin: 'com.google.gms.google-services'
But, i need to remove the plugin only if is the amazon flavor.
Is this even possible? Or at least is there something close that i can try ?
UPDATE:
As per Steve request, i went and try the version with Firebase on my Amazon Kindle tablets and it does work even thou there's no Google Play Services installed on them.

As per Steve's answer Firebase analytics works even without Google
play services. But we still can disable google services plugin for
flavors.
Try add code like this:
apply plugin: 'com.google.gms.google-services'
android.applicationVariants.all { variant ->
if (!variant.name.contains("flavorName")) {
project.tasks.each { t ->
if (t.name.contains("GoogleServices")) {
// Remove google services plugin
variant.getVariantData().resourceGenTask.getTaskDependencies().values.remove(t);
// For latest gradle plugin use this instead
// variant.getVariantData().taskContainer.sourceGenTask.getTaskDependencies().getDependencies().remove(t)
}
}
}
}
Here I disable google services for all flavors which their name
doesn't contains "flavorName". You should modify the conditions to fit
your requirement. And notice that this should be added after
apply plugin: 'com.google.gms.google-services'. Hope it helps.

I finally got a version to work with new gradle. Tested with gradle 4.6, build tools 3.0.1, google-services plugin 3.1.1
apply plugin: 'com.google.gms.google-services'
android.applicationVariants.all { variant ->
if (variant.name == 'someVariantNameYouDontwantFirebase') {
project.tasks.getByName('process' + variant.name.capitalize() + 'GoogleServices').enabled = false
}
}

Although Firebase does not officially support devices without Google Play services, Analytics should in fact work on such devices and so you may not actually need to disable Firebase (or remove the plugin) in your Amazon build. Have you tried it yet?

It's possible that, because some Google Play Services libraries still need to be included in your firebase-free flavor, that some firebase related entries end up in the final merged AndroidManifest.xml.
So, if, in addition to removing the gradle tasks which were added by the Google Services plugin (as described in Junyue Cao's answer), you want to remove Firebase related receiver, service, provider, uses-permission or other tags from the final merged AndroidManifest, you can add node markers to the AndroidManifest.xml located in the app's flavor, build config, or build variant subdirectory.
If the node markers are set to "remove", then the corresponding receiver, service, provider, uses-permission tags will not be present in the final merged AndroidManifest.xml.
For example, here's what you might add to the AndroidManifest.xml in a project's hypothetical 'nofirebase' flavor source dir (app/src/nofirebase/):
<receiver
android:name="com.google.firebase.iid.FirebaseInstanceIdInternalReceiver"
tools:node="remove" />
<receiver
android:name="com.google.android.gms.measurement.AppMeasurementReceiver"
tools:node="remove" />
<receiver
android:name="com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver"
tools:node="remove" />
<receiver
android:name="com.google.firebase.iid.FirebaseInstanceIdReceiver"
tools:node="remove" >
</receiver>
<service
android:name="com.google.android.gms.measurement.AppMeasurementService"
tools:node="remove" />
<service
android:name="com.google.firebase.iid.FirebaseInstanceIdService"
tools:node="remove"/>
<provider
android:name="com.google.firebase.provider.FirebaseInitProvider"
android:authorities="com.you.yourapp.firebaseinitprovider"
tools:node="remove"/>

With answers above I was receiving an error that task doesn't exist (?it was generated during build?). What worked for me was to simply ask tasks to correct themselves. In my case I was disabling Fabric on UAT builds.
tasks.all {
if (it.name.contains("Uat") && (
it.name.contains("GoogleServices") ||
it.name.contains("fabric"))
){
it.enabled = false
}
}

Issue running more than one NativeScript application on the same android device with tns run

NativeScript 2.0.0, Windows 10
When trying to run more than one NativeScript application on the same android device the tns run android command stops with message:
Successfully deployed on device with identifier '192.168.99.100:5555'.
The application is not installed.
After some investigation, I tried to install the app on the android device using adb directly:
adb "-s" "192.168.99.100:5555" "install" "-r" "<path to apk>.apk"
The command responds with the following:
961 KB/s (15394490 bytes in 15.642s)
WARNING: linker: /system/lib/libhoudini.so has text relocations. This is wasting memory and prevents security hardening. Please fix.
pkg: /data/local/tmp/<app name>-debug.apk
Failure [INSTALL_FAILED_CONFLICTING_PROVIDER]
After some investigation on INSTALL_FAILED_CONFLICTING_PROVIDER and found the following links:
https://issues.apache.org/jira/browse/CB-10014
https://code.google.com/p/analytics-issues/issues/detail?id=784
Install shows error in console: INSTALL FAILED CONFLICTING PROVIDER
I can say it's an ugly problem.
Researching some more, in the NativeScript project, in the directory \platforms\android\build\intermediates\exploded-aar\com.google.android.gms\play-services-measurement\8.4.0 directory there is a manifest template that contains:
<provider
android:authorities="${applicationId}.google_measurement_service"
android:name="com.google.android.gms.measurement.AppMeasurementContentProvider"
android:exported="false"/>
But applicationId is never defined, so when more than one app with this provider is added, the second one fails to install.

I have multiple NS apps installed on my phone and emulators; however when you create a new app; check to see if somehow you have ended up with the same internal name. (This can easily happen if you duplicate your prior project)
Open up your main/primary package.json file that resides in the outermost root of your project folder.
Inside this package.json file you should have a key:
"nativescript": {
"id": "org.nativescript.test3",
"tns-android": {
"version": "2.0.0"
}
},
The "id" is the underlying name of the app that will be installed on the phone. In this case; this is the awesome "org.nativescript.test3" project.
If you get duplicate id's then the the app will overwrite the each other when deployed.
There is a second reason this can happen, and the actual cause of this issue was figured out by the author of the question also. But I will stick here for any future people who might run into this so that we have a valid answer.
The author was using Google Play Services plugin, it has a AppMeasurementContentProvider that if you don't have a applicationId set in your configuration it will default to a blank id; which then means it will conflict with any other app that is using GPS that also doesn't have a applicationId set.
The real nastyness of this bug is that it will conflict with ANY app from ANY other developer who also left their applicationId blank. And so then only ONE of the apps would be installable; any other app that has a blank applicationId would not be installable on that device.
The solution is to open up your /app/App_Resources/Android/app.gradle file and we will add a new value to it.
The current version as of NativeScript v2.00 looks something like this:
android {
defaultConfig {
generatedDensities = []
}
aaptOptions {
additionalParameters "--no-version-vectors"
}
}
If you recall the first part of this answer and about duplicate ids; the package.json we referenced gives you the name you want to use. So in my case I would add to the
defaultConfig {
applicationId = "org.nativescript.test3"
}
So the final file should look something like this:
android {
defaultConfig {
generatedDensities = []
applicationId = "org.nativescript.test3"
}
aaptOptions {
additionalParameters "--no-version-vectors"
}
}
This is related to:
Install shows error in console: INSTALL FAILED CONFLICTING PROVIDER
https://code.google.com/p/analytics-issues/issues/detail?id=784

This workaround worked for me:
in the app/App_Resources/Android/AndroidManifest.xml file add:
<provider
tools:replace="android:authorities"
android:name="com.google.android.gms.measurement.AppMeasurementContentProvider"
android:authorities="MY_APPLICATION_ID.gms.measurement.google_measurement_service"
android:exported="false" />
Where MY_APPLICATION_ID is the application's package (put it manually because __PACKAGE__ didn't work)
Don't forget to declare de tools namespace:
<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
xmlns:tools="http://schemas.android.com/tools"
package="__PACKAGE__" ...>