Problems with checks in Release Mode about free-rasp-flutter

[talsec-app]

Hello!

We are sorry to hear that you have some issues.

To clarify some issues:

Android

Root check

We are unable to further investigate the issue without additional data (see Further investigation down below).

Tamper check

Tamper check can be a bit tedious to set. But in general:

• packageName is package name of your android application (in build.gradle under defaultConfig value of applicationId)

• signingCertificateHash is SHA-256 hash of your signing key in base64 form
  For example, by default, your Flutter app is signed using debug key. You can show SHA-256 hash of this key using Android Studio tool (singingReport gradle task). This value should be then converted to Base64 (programmatically or using [some online base64 encoder](https://base64.guru/converter/encode/hex)) and provided as String to signingCertificateHash.
  More about signing certificate hash here.

Unstrusted installation

Untrusted installation is triggered when application is installed from untrusted source.

What is untrusted source?

It is source which is not:

• Google Play Store

• Huawei AppGalery

• one of your whitelisted stores (using supportedAlternativeStores parameter)

You can whitelist installation from IDE using 'adb' value:

supportedAlternativeStores: ['adb']

iOS

Signature check

Signature check is equivalent to tamper check on Android. Right now, we don't know enough to investigate the problem.

Passcode features

Passcode featues reffers to passcode lock protect on your device. This directly does not imply the presence of FaceID or TouchID (you can have only passcode lock - without FaceID or TouchID)

Further investigation

To be able to investigate these issues further

• tamper check (Android)

• root check (Android)

• signature check (iOs)

please provide more information about

• your watcher mail

• package name (Android)

• bundle id (iOs)

If you don't want to expose those information publicly, you can send us email to [email protected] . Thanks for cooperation.

Hope we've resolved some of your issues for now.

Talsec Team.

[ITASerus]

Hi!
For the signature check on iOS, seems like that this particular check works only with apps that are on app store or testflight.

The other problems were my fault.

[talsec-app]

Hello ITASerus,

yes, in the current version of the SDK, the signature check is triggered on applications built from Xcode due to some of the subchecks. In the next release, the subchecks will be separated into a new category (unofficialStore).