Develop Reference

Can I safely replace usesCleartextTraffic in my Manifest?

I am trying to use hCaptcha library on my project. However, it seems that hCaptcha library comes with a usesCleartextTraffic tag defined on the Manifest which is already defined by another library. When I add hCaptcha and try to run the project I get the following error:
Attribute application#usesCleartextTraffic value=(true) from [com.theoremreach:theoremreach:3.5.1] AndroidManifest.xml:15:9-44
is also present at [com.github.hcaptcha:hcaptcha-android-sdk:3.3.6] AndroidManifest.xml:11:9-45 value=(false).
Suggestion: add 'tools:replace="android:usesCleartextTraffic"' to <application> element at AndroidManifest.xml:17:5-132:19 to override.
Great, there is a suggestion. Now by adding the following to my application tag on the Manifest, I can avoid any errors and run my application:
tools:replace="android:usesCleartextTraffic"
android:usesCleartextTraffic="true"
My question is, replacing this value with true will not influenciate the hCaptcha Manifest false value for usesCleartextTraffic?
What would be the correct way to solve this error, without affecting each library security?

Facebook Unity SDK issues when building for Android

I am not being able to solve this build-time issue when building for Android.
Here's the error message:
AndroidManifest.xml:39: Tag <provider> attribute authorities has invalid character '$'.
I found, indeed, in the AndroidManifest.xml produced in the Temp/StagingArea folder the following lines:
<!--
The initialization ContentProvider will call FacebookSdk.sdkInitialize automatically
with the application context. This config is merged in with the host app's manifest,
but there can only be one provider with the same authority activated at any given
point; so if the end user has two or more different apps that use Facebook SDK, only the
first one will be able to use the provider. To work around this problem, we use the
following placeholder in the authority to identify each host application as if it was
a completely different provider.
-->
<provider android:authorities="${applicationId}.FacebookInitProvider" android:exported="false" android:name="com.facebook.internal.FacebookInitProvider" />
It looks like the applicationId substitution is not working, but I correctly place it in the Facebook Settings, as stated in the docs.
Tried it with Facebook SDK 7.10, 7.11 and 7.12 on Unity 2017.2 and 2018.1 in an empty project with just the Facebook SDK plugin installed.
Anyone out there have any idea on what is happening here?

Try replacing this with your app id, $ returns package name not appID.
<provider android:authorities="FacebookInitProvider{APP ID HERE}" android:exported="true" android:name="com.facebook.internal.FacebookInitProvider" />

"attribute missing android namespace prefix" in official code snippet from Google doc. (about optimizing Android apps for ChromeOS)

I added this line to the manifest xml file of my app, according to documentation for optimizing for ChromeOS Android app publishing
<uses-feature android:name="android.hardware.touchscreen" required="false" />
but I get "Attribute is missing the Android namespace prefix..." for the "required" attribute.
If I add the Android: namespace prefix it works but I do not know if it is the right thing to do because I copied that line from the official web-page:
https://developer.android.com/topic/arc/index.html
and it has not the prefix.
It is right to add the prefix?

Myo android first connection

I am very new to android. I am trying to follow this Myo android tutorial
But I am facing a lot of problems since I don't know a lot about android.
My first problem is with placing the sdk , I downloaded it, and it is written that I have to add the SDK as a dependency in my build.gradle file.
When I explored my project, I found 2 build.gradle files as in the image:
So should I add it in which one ?
And how should I add it as an absolute path so I can use the SDK on all devices without changing the path ?
And then they asked me to add these permissions, but where should I add them?
// Required for communicating with the Myo device
<uses-permission android:name="android.permission.BLUETOOTH" />
<uses-permission android:name="android.permission.BLUETOOTH_ADMIN" />
// Required for sending usage data to Thalmic Labs
<uses-permission android:name="android.permission.INTERNET" />

Q1:So should I add it in which one ?
A:You should add it in the "Module:app" one.
Q2:how should I add it as an absolute path so I can use the SDK on all devices without changing the path ?
A:The path of the SDK doesn't relate to the result,the SDK will be wrapped up in the apk,so don't worry about it.
Q3:Where should I add them (permissions)
A:Add them in AndroidManifest.xml.

Why is my app asking for phone id permission?

In my manifest I only ask for these two permissions:
<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
<uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" />
But when I install the app on my phone I also get this notice:
Low-risk permissions
Phone ID
Get your phone ID, including IMEI, IMSI, etc.
From what I gather from this SO answer, I should need to use TelephonyManager and call
<uses-permission android:name="android.permission.READ_PHONE_STATE" />
to require this permission. But I'm not using TelephonyManager or calling that permission. I don't want to ask users to give this permission. I've looked through my manifest and gradle files. Could it be that some code I used triggered this permission being called without me specifically asking for it? I know I'm not giving you a lot to go on, by I don't know where else to look.
Update 1
I created a completely new project in Android Studio and generated a signed APK from it. I installed it but no permissions were asked. (That at least confirmed for me that it wasn't some "new feature" in Android Studio that automatically asked for this permission.)
Update 2
As of #antonio's answer I found app/build/outputs/logs/manifest-merger-release-report.txt However, I didn't find any implied permissions being requested.
Update 3
Here are the dependencies my app is using (from gradle.build):
dependencies {
compile 'com.android.support:support-v4:21.0.3'
compile 'com.readystatesoftware.sqliteasset:sqliteassethelper:+'
}
I tested a new application with both of these dependencies and no permissions were requested.
My next step is to add every activity again from scratch and see if I can find where this permission starts getting called. To be continued...
Update 4
I played around with copying everything to a new project and refactoring the project name and removing pieces, but it turned out to be quite complex. I wasn't able to isolate a reason.
Update 5
I set the targetSdkVersion to 1. This gives a new message when announcing permissions before installing the app:
read phone status and identity
Allows the app to access the phone features of the device. This
permission allows the app to determine the phone number and device
IDs, whether the call is active, and the remote number connected by a
call.
The old Phone ID permission notice that I wrote about at the beginning is still there (showing up after the app is installed). This makes me wonder if it is related to the OS (I'm using MIUI Android on a Xiaomi phone). There is still something about the app that causes this to display in this app but not in other apps. I need to test this out on other devices next.

This happens because you are importing a library with a targetSdkVersion lower than your application's targetSdkVersion
From the Manifest Merger documentation:
When importing a library with a targetSdkVersion lower than the
importing application targetSdkVersion, some permissions maybe
automatically added to the resulting merged manifest file.
This is necessary since such libraries targeted runtimes where such permissions were implicitly granted. Therefore declaring such permission was not necessary. However in more recent Android releases, these permissions are not automatically granted. Therefore, a library targeting such old runtime without the permissions would not work properly once merged in the application targeting a more recent runtime.
The permissions that can be added are:
WRITE_EXTERNAL_STORAGE Added when importing a library with a targetSdkVersion < 4
READ_EXTERNAL_STORAGE Added when importing a library that declared WRITE_EXTERNAL_STORAGE
READ_PHONE_STATE Added when importing a library with a targetSdkVersion < 4
READ_CALL_LOG Added when importing a library with a targetSdkVersion < 16 and using READ_CONTACTS permission
WRITE_CALL_LOG Added when importing a library with a targetSdkVersion < 16 and using WRITE_CONTACTS permission
You can inspect the report generated by Manifest Merger (In \app\build\outputs\logs\manifest-merger-XXX-report) to see what library caused the adding of the READ_PHONE_STATE permission. You will see something like:
android:uses-permission#android.permission.READ_PHONE_STATE
IMPLIED from AndroidManifest.xml:2:1 reason: the.library has a targetSdkVersion < 4
In a multi-module gradle-project, one has to apply an matching configuration, like defaultConfig{ ... }, where the targetSdkVersion should be specified to resolve these IMPLIED permissions.

Add the following code to your AndroidManifest.xml to remove the unnecesary permission(s):
<uses-permission android:name="android.permission.READ_PHONE_STATE" tools:node="remove" />
Source:
https://stackoverflow.com/a/27542669/406295