Reliable information on permissions required

Question

Whenever I look for an app in Play Store, the description states the list of required permissions.

1. Is that list (taken from the Manifest?) up to what the developer declares, or is it automatically generated in some way?
   In other words, can that list be not representative of what actually happens?

2. If so, is there an alternative way to get a reliable such list?

Answer 1

The permission list shown to the user on installation time bases on the data in AndroidManifest.xml. Apps like App Inspector can display what apps request what permission.

Permissions in AndroidManifest.xml have to be added by the developer. But Android development systems also all libraries to define permissions and if the app includes the library the permissions are automatically added to AndroidManifest.xml when the developer builds the app.

But from user perspective it is irrelevant how the permissions are added to AndroidManifest.xml as Android enforces the permissions. This means if the developer forgot to add a permission to AndroidManifest.xml the app will fail to use methods that require this permission.

Answer 2

Is that list up to what the developer declares? Yes. That list is in AndroidManifest.xml, and it is edited by hand by the developer.

Is it automatically generated in some way? No. Part of it is not, which implies that, overall, no.

Can that list be not representative of what actually happens? Yes, but only for "false positives". I.e., a permission listed in AndroidManifest.xml, but not actually used by the code, will be granted by the OS to the app (with no use). "False negatives" would not happen. I.e., a permission not listed in AndroidManifest.xml, but required by the code, will not be granted by the OS to the app. So it will probably not perform as intended.

TL;DR

The permission list shown to the user, e.g. under View details

bases on the data in file AndroidManifest.xml included in each apk installer.

That file contains a list of required permissions, which is composed of:

1. A hand-edited part by the developer.
2. An automatically added part from the list of permissions required by each linked libraries. (Each of these lists follow "recursively" the same criteria here).

The OS will give the App the permissions in this list, and nothing else.