YAPF, VirusTotal false positive? #46 - alt-app-installer follow-up

[Adhjie]

mjishnu/alt-app-installer#46
;
I forgot the app name but there is an app that signed their app signature locally, to bypass the expensive signing cert.
msys2 repo could be add as trusted cert to avoid wget error.
Obtainium uses AppVerifier, though the main method is to verify it with apksigner tool or app. but thats mobile i think.
AppVerifier itself is verified using 'apksigner'. The hash is posted at different place from the internet as to distrust or make it more objective.
Oh yeah, I've just remembered it. It's also used by Accrescent.
not sure, is there an equivalent to apksigner in desktop environment?
Breezy Weather wins the false positive case somehow, surprisingly, great, not so lucky for the rest of devs that I mentioned here:
reference:
#10
edit:
forgot to mention NVCleanstall method to bypass patched part ( nvidia-patch ) of the app into nvidia driver. this is hacky but it works to bypass NVIDIA consumer GPU card limitation.
;

[Adhjie]

I might be useless, because IDK the apksigner and reproducible build guide equivalent in python.
But these are my drafts of suggestions:

Use a signed Sha cert or something like apksigner like from this AppVerifier Readme.md (IK this from Obtainium readme.md)

Reproducible build is indeed hard in python, I just found out there's even a subreddit for RP, it is possible by F-Droid and accrescent with varied mix of RP vs app store signed cert only, which is not ideal yet.
Feel free to search more verifier app like AppVerifier or Android apksigner CLI. And RP.
Here are the quotes and searches about either cert signing, Sha hash verification, and/or reproducible build.

(Sorry for the rough draft, I'm currently on mobile and is not at home)

#4 (my exposition on hypatia, virustotal, or other aspect)

Forgot to mention VirusTotal integration, check the link, Autoruns by sysinternals dev and AppManager by MuntashirAkon has built-in VirusTotal.
Final boss would be VirusTotal in UniGetUI, if it ever gets implemented.

https://news.ycombinator.com/item?id=36349478

https://www.google.com/search?q=how%20to%20make%20a%20python%20app%20in%20windows%20reproducible%3F&ie=utf-8&client=firefox-b-m

https://gitlab.com/obfusk/fdroid-misc-scripts/-/blob/master/reproducible/2023-10-01-all.md

https://discuss.grapheneos.org/d/14452-how-to-explain-why-accrescent-over-f-droid/31

https://www.google.com/search?q=accrescent%20reproducible%20build&ie=utf-8&client=firefox-b-m

https://accrescent.app/faq#verifying1.

It can also be found on a Bluesky post to distrust the website. It is encouraged to verify it's the same with other people as well for assurance.
------diff quote starts
The package name and SHA-256 hash of the signing certificate is below, so you can verify AppVerifier with apksigner using apksigner verify --print-certs AppVerifier-X.Y.Z.apk if you are downloading the APK. If you are downloading from Accrescent then you should verify Accrescent itself here.

DO NOT use AppVerifier to verify itself!
Also DO NOT use AppVerifier to verify Accrescent if you downloaded AppVerifier from it.

https://github.com/soupslurpr/AppVerifier

AppVerifier - App verification tool (recommended, integrates with Obtainium)

https://www.google.com/search?q=reproducible%20build%20for%20python%20based%20desktop%20app&ie=utf-8&client=firefox-b-m

https://developer.android.com/tools/apksigner

Alternative.to is for alternative but by specifying the OS selection, I think equivalent or counterpart between programming languages app could be searched.
There's also sourceforge, honestly, I'm not sure after reading hackernews, stack exchange and others about the difficulties in making python app reproducible.

Oh yeah, msys2 pacman also needs the msys2 cert by exporting it to msys2 from browser security page with the lock in Firefox, it's along with tracking protection icon. (No auto currently last time I use it , not sure if this is just import export or count as self signed)