Collecting a big set of DeviceIDs to download APKs about opengapps

[oRAirwolf]

I would be happy to do this with my Nexus 9, Galaxy S6, and Nexus 6.

[rapperskull]

I don't think that my Nexus 5 is rare at all, but I'm trying to set up an Android emulator with the Play Store and all.

[mfonville]

To help to get a bit overview which packages we have, for which architectures, which SDKs and which versions exactly: https://github.com/opengapps/opengapps/blob/master/report_sources.sh

Usage is quite straightforward, and gives a simple report overview for 'everything' we have, or you can 'ask' it to which packages would be eligable when building for a certain max sdk level and/or given architectures.

[DJAlik]

I can help with Samsung Galaxy S3 T-Mobile US but I think you said that you have the same / similar device yourself

[mfonville]

I myself have the International S3 version: GT-i9300, so we have some overlap, yes

[bgiesing]

Well if you guys decide to build an "Android TV Leanback" package, I have a Nexus Player that could be used!

EDIT: And a Moto G, Nexus 7 (2012), and Nexus 7 (2013)

[mfonville]

I think all of those 4 device(ID)s are welcome. Is there a private way I can contact you @bgiesing to supply you with a token? Can I use [email protected] ?

[bgiesing]

Yep, that would be perfect! @mfonville

[mfonville]

Ok, we discovered a problem: Lollipop enforces the usage of the actual two-factor authentication when adding a device. So we can't use app-specific passwords when adding 5.0+ devices :-/
Let me think this through, trying to find the best and safest solution.

[rapperskull]

So you're forced to enable two factors authentication? We can create a new account, enable two factor authentication and distribute backup codes to all the device owners.

[bgiesing]

@mfonville I think I got a solution... Not sure though... You could share it with LastPass?

[mfonville]

@rapperskull
I use two-factor, so that I am sure that I will always stay the 'owner' of the account (nothing serious about the account can be changed with only an app-specific password). The app-specific password can then be used for the non-destructive operations by the volunteers.

@bgiesing Good idea for the sharing of the password indeed, but we need also something to be able to retain ownership of the account, to prevent possible abuse (you never know). Because I am willing to give a lot of good-willing people access to the account, but want to limit possible impact if one would want to do anything bad, to protect everybody involved.

[bgiesing]

@mfonville Maybe both combined? Share the password itself with LP and use a one-time 2FA code to ensure security?

[bgiesing]

@mfonville This is the only other thing I could think of... One Time Secret allows you to share a encrypted one use only link... Nothing can stop people from writing it down but it may be the only option...

[rapperskull]

@mfonville Giving away the password and a backup code will only allow the addition of a new device, since for changing password or email address a new code will be required. If a user needs more codes to add multiple devices, he must add first a device to request a new code. We have to check if a signed in device can do something harmful with just one more code or an access from the web is required (and therefore two more codes).

[mfonville]

@rapperskull the problem is, that having the backup code + the password enables one to add a computer as 'trusted' and then do potential malicious things with it, using only the password.

I have give it some thought last night, and I have come up with a solution, but it will take some time to manual set up some things, but the idea is as follows:

• We will use a Google Account (not a Gmail account) per device
• Being able to keep control of the mailbox associated with the account, the deviceID supplier cannot hijack it
• A user with a new device to be added willl be given the details to log in and associate the device with the Google Account
• After logging in the user will send the GSF ID
• The Google Account will be changed to two-factor authentication, an app-password will be supplied to all Packagers.

For all @opengapps/packagers could send me their gmail address (XDA, or my mail if you have it) then I can add you to a Google Sheet where the details will be posted.

[mfonville]

@bgiesing your mail address is failing:
[email protected]

Technical details of permanent failure:
DNS Error: Address resolution of giesing.cf. failed: DNS server returned answer with no data

[bgiesing]

@mfonville I know, I am in the processing of transferring servers... I will send you a email.

[NicholasBuse]

Should we have plans to pull APKs from Playstore in a automated fashion (nightly)? We could leverage logic from the Chrome extension we are planing to use and all of the new credentials in the spreadsheet.

I know I do not have skills to do this in shell scripting, but I would be capable in python. Do we have the ability to run python cron jobs on Github?

Would this draw attention from Google? (think back in the day when CM got C&D from Google for bundling Gapps...)

[mfonville]

I am not sure if a full automated download system is necessary at this moment.
But what would be very useful if one could leverage the current Chrome extension into a version that would allow for multiple logins to be active at the same time (so multiple 'download apk'-buttons) that will allow for easy downloading of all variants of the package, without having to logout+login in all the time.

If we keep doing it manually (and keeping the logins to ourselves) I think Google won't be having any issues with that.

[mfonville]

We have now some various logins & IDs, before we go and gather even more IDs, could somebody test if the current logins and IDs work correctly?

[DJAlik]

Out of town now, will be back on the 7th and then can assist

On Thu, Jul 2, 2015, 7:52 AM mfonville [email protected] wrote:

We have now some various logins & IDs, before we go and gather even more
IDs, could somebody test if the current logins and IDs work correctly?

—
Reply to this email directly or view it on GitHub
#30 (comment).

[mfonville]

Btw, for the packagers, this is also a useful tool to collect apps from aptoide.com: https://github.com/StefanescuCristian/Aptoide-Downloader

[mfonville]

I wrote to codekiem.com to provide the source code of his tool (since it nowhere to be found, even though he refers to it in his blogpost and he based it on other open source projects).
If we get that sourcecode, is somebody acquinted with writing code for chrome extensions? Because I am not, and will lack the time and resources to hack it.

[NicholasBuse]

I could take a crack at it chrome extension if we get source, but usually you can just unpack the extension (zip) and have full access to the js/css. I'll investigate and report back

From the GSheet, I did try both the arm.320 and the arm.480 (which I setup) and neither were capable of downloading APKs (auth failed). Upon reverting to my login in the extension, all was fine. This makes me wonder if we need to keep the account (arm.xxx) active on the phone? If you want to share the arm.480 password with me I can login again an verify, but I'm not sure how much of a solution that is either...

[mfonville]

The account doesn't have to be kept active on the phone, AFAIK and could test, but it might be that the changing of the password did 'disconnect' it from the phone. In that case I should not change the password after adding the device... But it could make us vulnerable to an account take-over.

I hate it that Google does not have the free GApps for own domain anymore, then we could really keep control those accounts remotely via an admin account :-/

[NicholasBuse]

Maybe you could become accredited for educating me in git, then qualify for and education account 😉

I ran report_sources.sh and tried to identify old versions. I have updated Google Keyboard (arm64, x86 and (old)x86_64) to the best of my ability and here are some other apps editions that have potential updates (last column is new and manually added):

                    Application Name|  Arch.|SDK|             DPI|           Version Name|    Version|         Possible ?
-------------------------------------------------------------------------------------------------------------------------
        com.google.android.apps.docs|  arm64| 14|             320|          2.2.083.23.44|   50832344|      2.2.223 (arm)
        com.google.android.apps.maps|  arm64| 18|         213-240|                 9.10.1|  910100222|       9.11.0 (arm)
        com.google.android.apps.maps|  arm64| 18|             320|                 9.10.1|  910100223|       9.11.0 (arm)
        com.google.android.apps.maps|    x86| 18|         213-240|                 9.10.1|  910100322|       9.11.0 (arm)
        com.google.android.apps.maps|    x86| 18|           nodpi|                 9.10.1|  910100020|       9.11.0 (arm)
        com.google.android.apps.maps| x86_64| 18|           nodpi|                 9.10.1|  910100020|       9.11.0 (arm)
com.google.android.apps.walletnfcrel|  arm64| 15|           nodpi|           8.0-R190-v25|  819025441| 9.0-R206-v12 (arm)
              com.google.android.tts|  arm64| 15|           nodpi|   3.3.12.1849464.arm64|  210303122|        3.4.6 (arm)
          com.google.android.youtube|    arm| 15|             480|               10.25.55|  102555134|     10.25.57 (arm)
          com.google.android.youtube|    arm| 15|           nodpi|               10.24.57|  102457130|     10.25.57 (arm)
          com.google.android.youtube|    x86| 15|             320|               10.25.55|  102555173|     10.25.57 (arm)

[mfonville]

Good overview of inded some missin gapps. It would be good to gather those. Maybe some task division could also be done between packagers who keeps an overview of each architecture?

About the accounts, I will then just re-generate the passwords I think, and everybody can reattach their accounts, and the password will stay the same. The accounts can afterwards safely be removed from the device.

I got answer from the apk-downloader guy; he did write:

The source code is available in the folder where it's installed (something likes C:\Users[username]\AppData\Local\Google\Chrome\User Data\Default\Extensions)
You can modify it for personal use, but please don't re-publish it.

So if somebody could hack those files to have multiple logins available, that would be great. Developing in a git repository seperate from opengapps would probably be the best.

[mfonville]

As a little entertainment for all those busy @opengapps/packagers minions and for everybody who likes stats: the big APK score list ;-) to be found @ http://mallorea.student.utwente.nl/~maarten/opengapps/source_competition.txt
It is updated once a day, after the nightly builds are finished.

[DJAlik]

I am way behind! I wish I had access to my box from work :) by the time I
get home most of the APKs are already imported :)

On Wed, Jul 22, 2015 at 4:46 PM, mfonville [email protected] wrote:

As a little entertainment for all those busy @opengapps/packagers
https://github.com/orgs/opengapps/teams/packagers minions and for
everybody who likes stats: the big APK score list ;-) to be found @
http://mallorea.student.utwente.nl/~maarten/opengapps/source_competition.txt
It is updated once a day, after the nightly builds are finished.

—
Reply to this email directly or view it on GitHub
#30 (comment).

http://www.facebook.com/djalik http://twitter.com/#!/DJAlik
http://www.linkedin.com/in/alexrusinov
http://plus.google.com/114580313768137070684
http://www.mixcloud.com/djalik/
http://psnprofiles.com/DJAlik

[bgiesing]

I am in last! How dare you! 😡
/sarcasm

[mfonville]

The list is also not completely fair at the moment, because when we switched to multidpi, all packages had to be re-added to a new location, which skewed my number way too high, but in time I think I will be surpassed (again?)

[NicholasBuse]

Come on @opengapps/packagers...we are only 2 behind @mfonville!

Guess I'll move to 1 apk/commit!

[mfonville]

It counts the apks, not the commits. So just providing the most (dpi+arch) variations the fastest is the 'key' to winning ( and good for the project. See what I did there? :-) )
Winner will get ice cream and postcard at the end of the year ;-)

[mfonville]

By lack of a better 'topic', for those interesting in more stats and some feedback to know how many people profit from you work as @opengapps/packagers some stats from today:
3.8k views on opengapps.org
ARM downloads in 14 hours from GitHub: 3.6k+
ARM64 downloads in 13 hours from GitHub: 100+
x86 downloads in 11 hours from GitHub: 50+

[NicholasBuse]

Happy to help! I've done my share of leaching in my >6 years of custom ROMs on Android

[mfonville]

Congrats to @NicholasBuse, the first to surpass me in the competition today :)

[NicholasBuse]

Thank you! (I would like to also thank my parents, my grade school computer teacher, my family and my dog)

[mfonville]

Follow-up to @bgiesing's LastPass idea: it seems that they now allow sharing the password without "giving" the password itself away. So it might become a feasible option again. http://www.androidpolice.com/2016/01/05/lastpass-4-0-is-the-first-major-release-since-logmein-adds-emergency-access-and-a-new-sharing-center/

[bgiesing]

@mfonville They have always allowed that. What they added was the opposite (allowing it to be shared with revealing the password.)

[mfonville]

@oRAirwolf if we could privately contact me about the Nexus9 login, that would be cool.
Can you drop me a line at XDA or e-mail? http://forum.xda-developers.com/member.php?u=6404745

[mfonville]

@oRAirwolf would you still be able to get in touch?

@DJAlik my i9300 did die, and the GSF ID I was using for that is now being refused by Google :-(
Do you still have your S3?

[oRAirwolf]

@mfonville sending message on XDA

[DJAlik]

I have my S3. it's T999 (d2tmo). During one of the flashes I lost IMEI and
therefore got stuck on EDGE. IMEI was fixed using some tools I found online
but I am still not able to connect to T-Mobile above edge... :(

On Sun, May 8, 2016 at 5:40 AM, oRAirwolf [email protected] wrote:

@mfonville https://github.com/mfonville sending message on XDA

—
You are receiving this because you were mentioned.
Reply to this email directly or view it on GitHub
#30 (comment)

http://www.facebook.com/djalik http://twitter.com/#!/DJAlik
http://www.linkedin.com/in/alexrusinov
http://plus.google.com/114580313768137070684
http://www.mixcloud.com/djalik/
http://psnprofiles.com/DJAlik

[mfonville]

@DJAlik ok cool, can I contact you via XDA about adding the opengapps.org account to your device?

[DJAlik]

go for it

On Mon, May 9, 2016 at 12:04 PM, Maarten Fonville [email protected]
wrote:

@DJAlik https://github.com/DJAlik ok cool, can I contact you via XDA
about adding the opengapps.org account to your device?

—
You are receiving this because you were mentioned.
Reply to this email directly or view it on GitHub
#30 (comment)

http://www.facebook.com/djalik http://twitter.com/#!/DJAlik
http://www.linkedin.com/in/alexrusinov
http://plus.google.com/114580313768137070684
http://www.mixcloud.com/djalik/
http://psnprofiles.com/DJAlik

[DJAlik]

My GS3 is toast. It flew off a table and now the screen is unresponsive to
touch. Time for a new phone I guess :(

On Mon, May 9, 2016 at 12:14 PM, Alex Rusinov [email protected] wrote:

go for it

On Mon, May 9, 2016 at 12:04 PM, Maarten Fonville <
[email protected]> wrote:

@DJAlik https://github.com/DJAlik ok cool, can I contact you via XDA
about adding the opengapps.org account to your device?

—
You are receiving this because you were mentioned.
Reply to this email directly or view it on GitHub
#30 (comment)

http://www.facebook.com/djalik http://twitter.com/#!/DJAlik
http://www.linkedin.com/in/alexrusinov
http://plus.google.com/114580313768137070684
http://www.mixcloud.com/djalik/
http://psnprofiles.com/DJAlik

http://www.facebook.com/djalik http://twitter.com/#!/DJAlik
http://www.linkedin.com/in/alexrusinov
http://plus.google.com/114580313768137070684
http://www.mixcloud.com/djalik/
http://psnprofiles.com/DJAlik

[mfonville]

@DJAlik luckily we were able to mimic any device now using the latest playstorecrawle code :)

So we can safely say this bug is 'resolved' now :-D