Apply patches to released apks

[haveyaseen]

#143 disabled Snyk patches when building apks (as this takes around 7 minutes).
We should add an if condition to those steps in the android workflow so that patches will be applied if the build job is running on a tag, i.e. if the generated apk is to be released.

[tweetz0r]

weak

[haveyaseen]

@tweetz0r What is your point exactly? This issue is not about patching Java code. Also, our entire codebase is open source.

[tweetz0r]

The encryption is weak, still don't understand why you hold on to magic tables and why do you need the camera/face-id/internet for a simple "contact tracing". And why do you use a 20.0 ft for BLE does it has to do with strength? Or...Big Data..

[haveyaseen]

@tweetz0r If you have serious concerns please open single issues (or even better, pull requests) in the relevant repository. In this case you are referring to code that's in our react-native-ito library.

The database is not encrypted, yet. We do plan on encrypting it but this is a work in progress. It also has nothing to do with big data.

Bluetooth tracing requires the "fine location" permission, this is impossible to avoid if you're not using the library that Google does not grant us access to. The Internet permission can probably be removed from the main app repository. Camera permissions are required for scanning QR codes / bar codes / whatever lets you confirm your own infection status.