Please add LibreSignal to f-droid

[kakedacich]

Dear maintainers, I'm reading here:

#28 (comment)

that the people behind f-droid are willing to have LibreSignal distributed there.
What they're waiting for is a pull request from you (last sentence of that comment).

I hope you are already aware of this and that you'll allow everybody to get this great fork from f-droid!

Thank you

[mimi89999]

What they're waiting for is a pull request from you

There are still several important issues:

1. The signing key for reproducible builds. If the signing key is changed, an update won't be possible. Also, who would "own" the signing key in such a case?
2. Our relations with OWS are really bad. I'm afraid, that one day, they will ban LibreSignal from their server...
3. Calling still doesn't work.

@LibreSignal what do you think? Should LibreSignal be moved to the main F-Droid repo?

[eighthave]

I don't think it makes sense to include LibreSignal in F-Droid until you have a server to run it. They have explicitly said that the only want their own builds of Signal using their server.

[eighthave]

even better, help them move to 100% free software and working without Google, so there isn't a need for the fork.

[mimi89999]

@eighthave

Until you have a server to run it.

Running a server costs money and I am not sure if OWS will want to federate with us.

even better, help them move to 100% free software and working without Google, so there isn't a need for the fork.

The problem is that Moxie and OWS don't want Signal to be 100% free/libre software (it is not important for them...)

[paride]

@eighthave They are not interested in removing the Google GCM dependencies, so unfortunately this is not possible. Moxie has been quite explicit on this point, several times.

@mimi89999:

1. Can't the package be signed with the f-droid key, like the other packages on f-droid, and then this binary becomes the reference for LibreSignal's reproducible builds? Maybe here I'm missing something...
2. Is is technically possible for them to ban unofficial clients? I'm not sure about this, and not even the big and evil players (Microsoft, Yahoo, Google...) ever did so. I remember Moxie asking for a client identification string to be modified on LibreSignal, and I get this as an indirect way to say "I'm OK with your client, but please let me recognize it on the server side". IMHO, if OWS bans LibreSignal at least it would be clear message to the community, and a lot of effort would be saved for better projects.
3. I think that disabling calling altogether would be fine for the moment. Then, as there is a lot of attention on fdroid, there is a better change for it to be fixed.

This said, I understand why the inclusion on fdroid needs to be well pondered.

[mimi89999]

https://cloud.githubusercontent.com/assets/1433926/9705240/83886c9c-54be-11e5-867a-458f24bf9b6a.png

[paride]

@mimi89999 but that is about calling the independent build Signal, and after that discussion (and legal threats) xmikos renamed it to LibreSignal (s/Signal/TextSecure). It's mostly about the trademark.

[mimi89999]

@legovini

1. F-Droid signing keys might get stolen or somebody from F-Droid might be forced to sign a malicious apk. If LibreSignal is added using reproducible builds, this won't be possible...

EDIT: Please read https://f-droid.org/wiki/page/Deterministic,_Reproducible_Builds#How_it_is_implemented_as_of_now

[mimi89999]

@legovini Let's ask @moxie0 if he is OK with LibreSignal using OWS servers.

[moxie0]

I'm not OK with LibreSignal using our servers, and I'm not OK with LibreSignal using the name "Signal." You're free to use our source code for whatever you would like under the terms of the license, but you're not entitled to use our name or the service that we run.

If you think running servers is difficult and expensive (you're right), ask yourself why you feel entitled for us to run them for your product.

[mimi89999]

@moxie0

I'm not OK with LibreSignal using the name "Signal."

LibreSignal is using the name "LibreSignal". The name "LibreSignal" contains "Signal". If you prefer, I can rename "LibreSignal", so that it doesn't contain "Signal" in the name... I can also change the icon if you want.

If you think running servers is difficult and expensive (you're right), ask yourself why you feel entitled for us to run them for your product.

You are receiving donations for developing Signal-Android and running the servers. I am not.

If I finance running a TextSecure server for LibreSignal, will you federate with us?
Also, I won't be able to run a RedPhone server because it is not open source.

What about other Signal forks like Signal Plus (https://play.google.com/store/apps/details?id=org.privatechats.securesms) (https://github.com/WizDom13/SignalPlus-Android) Their app name also contains "Signal" and they are also using OWS servers.

[mimi89999]

@xmikos @JavaJens @SecUpwN @mvdan @krt16s What do we do now?

[h-2]

@moxie0

You're free to use our source code for whatever you would like under the terms of the license, but you're not entitled to use our name or the service that we run.

If you think running servers is difficult and expensive (you're right), ask yourself why you feel entitled for us to run them for your product.

@mimi89999

If I finance running a TextSecure server for LibreSignal, will you federate with us?
Also, I won't be able to run a RedPhone server because it is not open source.

I think these are the crucial points. Nobody wants to annoy WhisperSystems or create extra expenses or support tickets, but we do need inter-operability and interaction of the users. @moxie0 if you release the red phone server components and would agree to federate, I am sure we could gather enough resources to maintain own servers and not bother you further 😄

[moxie0]

If you prefer, I can rename "LibreSignal", so that it doesn't contain "Signal" in the name... I can also change the icon if you want.

Thanks, that would be great!

You are receiving donations for developing Signal-Android and running the servers. I am not.

You're capable of doing that as well, though. We're barely able to support our own apps, and having to support products outside of our control would make our lives even more difficult. If you think that collecting donations to run and maintain servers for your own project is difficult, why would you expect us to do it for you?

If I finance running a TextSecure server for LibreSignal, will you federate with us?

It is unlikely that we will ever federate with any servers outside of our control again, it makes changes really difficult.

What about other Signal forks like Signal Plus (https://play.google.com/store/apps/details?id=org.privatechats.securesms) (https://github.com/WizDom13/SignalPlus-Android) Their app name also contains "Signal" and they are also using OWS servers.

Yep, we're working on it.