Question on permissions

[IzzySoft]

I was just informed that you've picked up with releases, great! Since you last did in 2022, my scanner got some additional checks – and reports on the latest release:

! repo/app.lawnchair_15.apk declares intent-filter(s): android.accessibilityservice.AccessibilityService
! repo/app.lawnchair_15.apk declares sensitive permission(s): android.permission.READ_CONTACTS
  android.permission.MANAGE_EXTERNAL_STORAGE android.permission.QUERY_ALL_PACKAGES
  android.permission.READ_EXTERNAL_STORAGE android.permission.REQUEST_DELETE_PACKAGES

While QUERY_ALL_PACKAGES is most likely for the app drawer, all else is a bit unclear and thus stand there as "warning". May I kindly ask for some clarification here (i.e. a discription what is needed/used for what)? Thanks in advance!

[IzzySoft]

PS: The latest release has versionCode: 15, while the ones before had much higher values. That means no updates are possible – and my updater rejects the newer releases accordingly. Was that move intended? Remember, you can never decrease versionCode without forcing everyone already using the app to uninstall and reinstall, as Android does not accept downgrades.

[validcube]

While QUERY_ALL_PACKAGES is most likely for the app drawer, all else is a bit unclear and thus stand there as "warning". May I kindly ask for some clarification here (i.e. a discription what is needed/used for what)? Thanks in advance!

android.permission.READ_CONTACTS and android.permission.MANAGE_EXTERNAL_STORAGE are for Lawnchair Advanced Search

• Introduce Lawnchair Advance Search #3785

As for others I can't comment on it as I'm not experienced with Lawnchair Launcher yet, but I git blamed it and found out it was added in Launcher3 which is what the Lawnchair Launcher is based on.

PS: The latest release has versionCode: 15, ...

I believe this is not intentional, it's supposed to be versionCode: 14.

[IzzySoft]

Thanks for the insight! Will add that to the description (putting it to the app's "green list" so it no longer shows in warning colors) once the versionCode issue is solved. Currently, no updates work as versionCode has been decreased, marking them as old/obsolete versions compared to the previous ones. So in order for updates to start working again, either versionCode must be increased again beyond that any previous release had (the currently latest here has 12010005) – or we'd need to move to a "fresh start", forcing all using the app to uninstall/reinstall in order to get updates. Which they'll only get to know if they check manually, as there won't be any notification for this.

[validcube]

Thanks for the insight! Will add that to the description (putting it to the app's "green list" so it no longer shows in warning colors) once the versionCode issue is solved. Currently, no updates work as versionCode has been decreased, marking them as old/obsolete versions compared to the previous ones. So in order for updates to start working again, either versionCode must be increased again beyond that any previous release had (the currently latest here has 12010005) – or we'd need to move to a "fresh start", forcing all using the app to uninstall/reinstall in order to get updates. Which they'll only get to know if they check manually, as there won't be any notification for this.

👋 This is fixed in #4361, we currently have to wait for another release of Lawnchair now

• Correct versionCode semantic #4361

[IzzySoft]

PS, still open: android.permission.REQUEST_DELETE_PACKAGES and android.accessibilityservice.AccessibilityService. Could these be explained as well, please?

we currently have to wait for another release of Lawnchair now

Thanks! So update check for now will remain on monthly here (to avoid re-downloading VC-15 over and again). Feel free too give me a ping when the new release becomes available, so I can toggle back to daily checks.

[SuperDragonXD]

android.permission.REQUEST_DELETE_PACKAGES

Performs the "uninstall" function when long-pressing an app icon.

android.accessibilityservice.AccessibilityService

Allows the sleep accessibility action to be performed when a gesture is performed (a list of available gesture operations can be found at Home Settings > Gestures). This is most commonly used when double tapping to sleep the phone.

[IzzySoft]

Thanks! Updated those details here. Now we're just waiting for the next release with versionCode fixed again 😃

[SuperDragonXD]

Hello @IzzySoft, we just recently released a new Lawnchair release which has an updated versionCode as well.

[IzzySoft]

Thanks! Looks good so far. Only thing the scanner reported was

! repo/app.lawnchair_14000203.apk declares sensitive permission(s): android.permission.READ_MEDIA_IMAGES

Guess that's for selecting background images? And shall I enable daily update checks again then (currently they're set for monthly)?

[SuperDragonXD]

Yeah, that is for the wallpaper preview (example: home screen grid, backups, etc).

Regarding update checks, is it possible to ignore releases with "Nightly" in them? Since we would want users to use the Beta builds only for now.

[IzzySoft]

Yeah, that is for the wallpaper preview (example: home screen grid, backups, etc).

Thanks! Added to the green list then.

Regarding update checks, is it possible to ignore releases with "Nightly" in them?

Let's see what we have now:

AutoUpdateMode: Version v%v
UpdateCheckMode: Static

It just checks tags starting with v followed by the versionName. nightly starts with a n and has no version name, so those are already skipped. So I've now set it to daily again; pre-releases are still considered, but only tags with the pattern v<versionName> will be picked up. Once you reach "stable/full releases", we update the config here to ignore pre-releases (which would be the default behavior).

[IzzySoft]

Thanks @Morzjfw30 – but 1) the definition is already there, and 2) the "likely" and "could be" suggest you're guessing there – yes, I'd guess along those lines. But that's not how transparency works. Transparency works by making facts transparent, not guesses 😉 Just to pick one example:

MANAGE_EXTERNAL_STORAGE & READ_EXTERNAL_STORAGE: Likely required for managing or accessing media files (e.g., wallpapers, custom icons).

Nope. It's needed for the advanced search functionality, scroll up 😉 Somewhere around Android 13+ Android started to ignore the legacy READ/WRITE permissions and now requires MANAGE. Same for READ_CONTACTS: used for advanced search. Was outlined here about a year ago 😉