Question on permission and signing

[IzzySoft]

First thanks for making your app available using a FOSS license! It will become available in my repo in less than 2 hours.

However, my scanner reported a few minor discoveries I'd like to have clarified – and hope you don't mind me bringing up here:

Permissions:
------------
* android.permission.INTERNET
* android.permission.SYSTEM_ALERT_WINDOW
* android.permission.USE_BIOMETRIC
* android.permission.USE_FINGERPRINT
* com.ladsers.passtable.android.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

SigningBlock blobs:
-------------------
0x504b4453 (DEPENDENCY_INFO_BLOCK; GOOGLE)

From the permissions, it's SYSTEM_ALERT_WINDOW which triggered a warning (meaning: check if it's justified). Could you please tell me what that's needed here for? Does Passtable need to "draw over other windows", and what for?

As for the DEPENDENCY_INFO_BLOCK: Do you let Google sign your APKs or, what is more likely, use Android Studio for that? That block is an opaque BLOB supposed to hold a copy of your dependency tree in binary form. But as it's encrypted, it can hardly be verified (except for Google), which is why it's better not present. So if you're using Android Studio for signing, and agree to have that block removed, you could try adding this to your build.grade.kts:

android {
    dependenciesInfo {
        includeInApk = false
    }
}

To give you a clue about what to expect to see in my repo, here's a screenshot from staging:

[Ladsers]

From the permissions, it's SYSTEM_ALERT_WINDOW which triggered a warning (meaning: check if it's justified). Could you please tell me what that's needed here for? Does Passtable need to "draw over other windows", and what for?

Access to SYSTEM_ALERT_WINDOW is needed to display a panel with quick access to the selected item. Using this panel, the user can quickly access their data from Passtable in any other application.
This panel is displayed after the user selects the corresponding option in the menu, and is closed by pressing the "X" button on the panel.

So if you're using Android Studio for signing, and agree to have that block removed, you could try adding this to your build.grade.kts

Ok, I'll set includeInApk to false in the next update.

[IzzySoft]

Thanks! (And apologies for the late reply; somehow the notification got lost).