androidqf ignoring trusted apk list

[r-tx]

Testing with v1.8.3 it appears that androidqf is ignoring the trusted apks list when selected and extracting all non-system apks.

Options selected at run time:

Would you like to download copies of all apps or only non-system ones?
✔ Only non-system packages
Would you like to remove copies of apps signed with a trusted certificate to limit the size of the output folder?
✔ Yes

post extraction, applications with trusted signing certs are seen in the apk folder.

[besendorf]

I believe this is fixed. can you check please? you have to build yourself from main

[r-tx]

Bit of oddness. Mostly an improvement, anything extracted now just does not have a corresponding entry in apks.go.

The one that still seems to be downloaded even though it matches the entry is org.thoughtcrime.securesms

[besendorf]

Confirmed that the remaining Signal case is caused by a signing-key rotation. Current Signal APKs use the rotated certificate for Android 13/API 33 and later:

• legacy SHA-1: 45989dc9ad8728c2aa9a82fa55503e34a8879374
• rotated SHA-1: 5c6740091301285db5409fdcd1b90f1ac3ba2dcf

The trusted certificate list contained only the legacy fingerprint, so the rotated certificate verified successfully but was not classified as trusted. PR #117 adds the rotated fingerprint while retaining the legacy one.

[besendorf]

are there more outstanding issues?

[r-tx]

I don't believe so in relation to this. Unless you see it as beneficial checking extraction with mac or windows?