FlowDroid icon indicating copy to clipboard operation
FlowDroid copied to clipboard

soot-infoflow-android uses has a non-existent version of axml

Open jpstotz opened this issue 3 months ago • 2 comments

soot-infoflow-android has axml version 2.1.4 as dependency:

https://github.com/secure-software-engineering/FlowDroid/blob/2a6649a176046925648c6cf0747c631f7748aafe/soot-infoflow-android/pom.xml#L157-L161

Problem is that this version is not available in any of the common Maven repos. https://mvnrepository.com/artifact/de.upb.cs.swt/axml

My guess is that this version was released on JCenter which has been shut down.

Latest available version is now 2.1.3.

jpstotz avatar Sep 09 '25 07:09 jpstotz

This is an annoying problem. The person who maintained this component at UPB has left and Maven Central keeps asking that he confirms granting access to whoever wants to continue maintenance. That's somewhat understandable because they have his email address as maintainer, but it also means that we cannot say "listen, this guy is no longer with us, someone else will take over". I have discussed this with the UPB team, I have been in CC in their discussions with Maven Central Support, and it's simply a dead end.

If I find the time, I'll publish this component in the Fraunhofer scope on Maven Central. Once that is done, we can have a proper new release.

By the way, this stupid issue also blocks a proper FlowDroid release. As I said, we'll simply taken over axml at somne point.

StevenArzt avatar Sep 09 '25 09:09 StevenArzt

Workaround in the meantime:

git clone https://github.com/Sable/axml.git
cd axml
mvn install

MarcMil avatar Oct 16 '25 09:10 MarcMil