tangobeee / weathernaut Goto Github PK

Thank you 🎉🎉🎉

My scanner got some new checks in January and on today's update reported:

! repo/me.tangobee.weathernaut_8.apk declares flag(s): usesCleartextTraffic
! repo/me.tangobee.weathernaut_8.apk declares sensitive permission(s):
  android.permission.ACCESS_COARSE_LOCATION
! repo/me.tangobee.weathernaut_8.apk contains signature block blobs: 0x504b4453 (DEPENDENCY_INFO_BLOCK; GOOGLE)

Can you please clarify what cleartext connections are used? The location permission is most likely to make it easier fetching local weather I guess. As for DEPENDENCY_INFO_BLOCK, that's easy to avoid:

android {
    dependenciesInfo {
        // Disables dependency metadata when building APKs.
        includeInApk = false
        // Disables dependency metadata when building Android App Bundles.
        includeInBundle = false
    }
}

For some background: that BLOB is supposed to be just a binary representation of your app's dependency tree. But as it's encrypted with a public key belonging to Google, only Google can read it – and nobody else can even verify what it really contains.

Thanks in advance! Oh, and in case you wonder, please take a look here 😉

When I open the app, it crashes immediately.
Android 13.