Proprietary compontents: Google VR SDK

[IzzySoft]

My library scanner just detected com.google.vr in the APK provided at releases here, which is a proprietary compontent: Google VR SDK. Relevant lines in the code should be these:

sdk-videowidget = { module = "com.google.vr:sdk-videowidget", version.ref = "sdkVideowidget" }
sdk-panowidget = { module = "com.google.vr:sdk-panowidget", version.ref = "sdkPanowidget" }

I had hence to apply the NonFreeComp (non-free/proprietary compontents) to your app in my repo. Can there anything be done to avoid that? Thanks in advance!

[naveensingh]

@IzzySoft thanks for pointing this out.

Unfortunately, I haven't found any simple alternatives to those libraries. We probably have to remove them anyway because of GPL.

[Aga-C]

@naveensingh Maybe we could use this for panoramic photos: https://github.com/hannesa2/panoramaGL.

[IzzySoft]

Until you found a replacement, maybe an iterim work-around would be having two different build flavors (e.g. foss and full), removing the two from the foss flavor?

[inson1]

@naveensingh Why it was added? And why tibbi version didnt have it?

[Aga-C]

@inson1 Tibor's version also had it: https://github.com/SimpleMobileTools/Simple-Gallery/blob/3cb12cc41bb579dabb676f2fe83b53a63089fe1b/app/build.gradle.kts#L110C35-L110C35.

[inson1]

@Aga-C so it was even in foss flavor? It seems like it. F-droid didnt mind it? I cant see any anti-feature.

[Aga-C]

@inson1 Yes, looks like they missed it.

[inson1]

@Aga-C thanks

[naveensingh]

@Aga-C so it was even in foss flavor? It seems like it. F-droid didnt mind it? I cant see any anti-feature.

Yes. We haven't added any libraries or features to the apps since they were forked. These libraries were deprecated by Google but never open-sourced (AFAIK). They are used to display panoramic photos/videos. They are harmless on their own and most people don't care about it but we probably have to remove them because of GPL (@12people what do you think?)

@naveensingh Maybe we could use this for panoramic photos: https://github.com/hannesa2/panoramaGL.

@Aga-C I'll check that, thanks. For now, I think I'll remove these libraries completely and later we'll add support for panoramic stuff using some other FOSS lib.

[IzzySoft]

@inson1

so it was even in foss flavor? It seems like it. F-droid didnt mind it? I cant see any anti-feature.

I guess F-Droid missed it on its scans as the build servers don't use my library scanner (which brought this up as it has its library definitions constantly updated). If you want to, you can report it there; guess the best place would be the issue tracker of fdroidserver.

[12people]

@naveensingh It does seem like the libraries used are proprietary and therefore have to be replaced.

However, it also seems that Google's Cardboard SDK, the successor to this library that Google itself recommends, is licensed under the Apache 2.0 license (aside from a Unity SDK plug-in that we'd have no use for), so we could just use that.

[licaon-kter]

😞

[inson1]

@licaon-kter You are from F-droid, right? May you solve it? Add the anti-feature and add it to your scanner?
Or should I create the issue anyway?

[licaon-kter]

May you solve it?

No, this needs to be solved here..

Add the anti-feature and add it to your scanner?

NO and YES, there's no antifeature to add, but a new thing to scan for

Or should I create the issue anyway?

It's a known issue :)

[inson1]

@licaon-kter I meant the problem with F-droid. Okay, so you are that strict. (in good way ofc)
I hope it will be fixed in near future. And what what about SMT apps? They should be taken down from F-droid, right?

[licaon-kter]

And what what about SMT apps? They should be taken down from F-droid, right?

Gallery? I guess

[naveensingh]

😞

@licaon-kter Sorry I didn't know :)

I removed the libraries and created a new release: https://github.com/FossifyOrg/Gallery/releases/tag/1.1.0

I wanted to reduce the app size anyway ;)

[inson1]

@licaon-kter yea gallery, sorry

[naveensingh]

@IzzySoft ping

[licaon-kter]

@naveensingh https://gitlab.com/fdroid/fdroiddata/-/commit/86c7da6ad7329d36950b4974ab002c448245d6c1

[IzzySoft]

@naveensingh pong

manually triggered an update as this was missing the regular one by ~92 minutes … through now. Aaand: Looks good 🥳 anti-feature removed, effective with the next sync.

@licaon-kter you might wish to simply replace the build in the YAML before the next cycle picks it up then. Ah, you did already – perfect, thanks!

[inson1]

@Aga-C what about closing this? everything seems done

[goyalyashpal]

Gallery? I guess

shouldnt there be some mechanism to inform those who had it installed? like it just disappeared from all f-droid listings, i had to hunt it down from metadata, then its history of commits/MRs and what not to reach here and know what happened.

similar to how froid informs about "vulnerability found" (in the screenshots of official fdroid app)

I wanted to reduce the app size anyway ;)

thanks a lot for that 😇: 40.5 MB (v6.28.1) -> 20.9 MB (v1.1.1) is quite a lot; significant enough for me to consider installing it on my Android One device (& finally replacing proprietary QuickPic app on that).

[licaon-kter]

@goyalyashpal

shouldnt there be some mechanism to inform those who had it installed?

would be nice, but there's none yet

F-Droid does some announcements in the weekly posts: https://f-droid.org/news/ (RSS feed available 😉)

Eg. this was announced back then here: https://f-droid.org/2024/01/04/twif.html

[goyalyashpal]

F-Droid does some announcements in the weekly posts: https://f-droid.org/news/ (RSS feed available 😉)

thanks for sharing that, but those things likely wont work for foss-non-interested relatives on whom i (pretty much) forced using f-droid and apps from it.

[licaon-kter]

And the solution would be to show what, announce what, offer to do what?

[inson1]

@licaon-kter window with info about it and two options - uninstall and ok

that is my idea

[licaon-kter]

Not sure "non-foss lib to show panorama" really has the same impact as "known vulnerability"

[goyalyashpal]

the solution would be to show what, announce what, offer to do what?

@licaon-kter glad u asked. step-by-step:

• if all builds are disabled for an app, and user has that app installed
  then do not invisibl-ate that app's listing (for that device);
  but in "versions" section, show only the installed version (i.e. no new one - of course)

• show a maintainer note in place of app description, saying what happened, link to read more, any continuation. so,for here t'd become smth like: "app disabled on fdroid, read here for more. a continuation of it via fdroid is this"
  (there were some issue discussion regarding it on gitlab in context of some discontinued app - i guess barinsta or smth)

• as for the links, the metadata link should certainly stay (if it were to exist); i dont have any opinion yet fer the "upstream links"

Not sure "non-foss lib ..." really has the same impact as "known vulnerability"

• fair, but the app suddenly disappearing from the users store listing leaving its origins unclear aint a good thing either.

---

lol, just found out that yetCalc's listing was obliterated too
https://f-droid.org/en/2023/12/07/twif.html

samo for the build of insular: 6.0.5-17...
https://gitlab.com/fdroid/fdroiddata/-/blob/355a783e3e189effc6b42d6786129a621dc3a8bf/metadata/com.oasisfeng.island.fdroid.yml#L574

[licaon-kter]

if all builds are disabled for an app, and user has that app installed
then do not invisibl-ate that app's listing (for that device);

the app is gone from the index, F-Droid Client knows only about what's in the index, also by this logic we should keep an ever expanding list of long gone apps? for how long? etc

show a maintainer note in place of app description, saying what happened, link to read more, any continuation.

more maintainers needed then, to code this in the UI and to add this data, where do you add it, for how long, see above?

as for the links, the metadata link should certainly stay (if it were to exist)

it stays, but we do some periodic cleanups, and apps with "all versions disabled" and no activity will have to go

fair, but the app suddenly disappearing from the users store listing leaving its origins unclear aint a good thing either.

it does not change anything about the app

but yes, I do understand that something might be needed

Feel free to join gitlab and try to mockup something 👍

[IzzySoft]

F-Droid Client knows only about what's in the index

how to get the installer source of an android app 😉

more maintainers needed then

🙊

mockup something

installer=(org.fdroid.fdroid|org.fdroid.fdroid.privileged) but app not in index
=> look if there's an entry at <base_url>/<package_name>[.json]
=> parse and show details.

[licaon-kter]

Ah, right, how could I forget that?! :)

But... the UX needs a mockup, you have that info, but do you have context? What do you do with that info? A lot of new state to keep track of. Etc

[goyalyashpal]

also by this logic we should keep an ever expanding list of long gone apps? for how long? etc

there were a detailed discussion on this - both on fdroid forums and on issue tracker somewhere in 2021-22, i posted my detailed suggestion at both places. no one paid attention.

[licaon-kter]

I like ideas, but you know what I like more? Merge Requests 😜

[goyalyashpal]

like more? Merge Requests 😜

as that required showcasing a repo, i tried for that too. but was lost on gitlab's poor git interface & my lackluster git knowledge back then

so, couldnt proceed to completion

(i still aint much comfy with git-remote though... but atleast git-local is well known to me now)