Availability in F-Droid

[henrykrumb]

Dear ladies and gentlemen,

since the app is going to be OpenSource software, are there any plans to make it available on alternative platforms, for instance on F-Droid (https://f-droid.org)? That would enable users of alternative or modified Android images to use and regularly update the app.

Best regards
Henry

[codedust]

Many Android users, e.g. those using LineageOS or Replicant, do not use Google Play Services for privacy reasons. In order to achieve broad adoption of the app and enable anyone to use the app it is inevitable to have the possibility to use the app without proprietary Play Services installed.

Please make sure it is possible to compile the app without any non-free dependencies. This would allow the app to be included in F-Droid. See F-Droid's inclusion policy for details:

We cannot build apps using Google’s proprietary “play-services”. [...]
We cannot build apps using proprietary tracking/analytic dependencies like Crashlytics and Firebase. [...]
We cannot build apps using proprietary ad libraries. [...]
We cannot build apps requiring Non-Free buildtools, including Oracle’s JDK or some pre-release toolchains. [...]

Thanks in advance!

[MalteJ]

We are not planning to deploy to any App Stores except Google's and Apple's. However the community is free to contribute.
All libraries used by the iOS or Android apps will be under an open source license - maybe you will have to implement your own BLE beacon implementation as this is part of the iOS operating system or the Google Play Store Services.

[zoobab]

You can't audit the code of the entire iOS operating system, so it is pointless to rely on it for your privacy.

The same remark is valid for Android, many parts are not open source, including the firmware of the baseband processors, where governments, law enforcement agencies and telcos might have access to the end terminals.

So they are both non-starter platforms if you want to audit the entire code base from a privacy perspective.

[MalteJ]

@zoobab if you don't trust your smart phone you are free to build an implementation on the hardware device of your choice (e.g. ESP32). The BLE specs will be released by Google/Apple and also the API to our backend.

[zoobab]

@MalteJ the ESP32 is a bad example, the wifi stack is also a binary blob. In the earlier versions of the wifi stack, I found hardcoded addresses of an IOT server in China.

[mritzmann]

Sure, a Google Play loose app would be cool, but that's just not technically possible. Because the API that does everything in the background comes directly from Google and Apple.

https://blog.google/documents/70/Exposure_Notification_-_Bluetooth_Specification_v1.2.2.pdf

Also, the app has to work for 99.9% of the population and not for 0.01% Lineage-OS users. 🤷‍♂️ Therefore, this issue is at the moment completely pointless... Maybe this possibility will be available in the future, once the API has been implemented by LineageOS and others.

[henrykrumb]

Also, the app has to work for 99.9% of the population and not for 0.01% Lineage-OS users. Therefore, this issue is completely pointless...

I was just wondering whether I (one of the 0.01%) will be able to use the app. Not being able to install the app might have an impact on my life, as I might be excluded from certain social activities in the future if I continue refusing to use Google services.

If this issue is not pressing at the moment, that's fine. But calling my question "completely pointless" is disrespectful.

[mritzmann]

But calling my question "completely pointless" is disrespectful.

Sorry, that was rude. My bad.

[IzzySoft]

@MalteJ quoting, emphasis mine:

All libraries used by the iOS or Android apps will be under an open source license - maybe you will have to implement your own BLE beacon implementation as this is part of the iOS operating system or the Google Play Store Services.

Now taking a look at Wikipedia: Google Play Services we see: "License Proprietary". Somehow doesn't match. Just for info: this is a blocker for F-Droid inclusion.

Note: I'm not arguing here, just pointing out to keep any "hopes" for F-Droid inclusion on a realistic level. Some of you might have wondered about the wontfix label – so this comment hopefully gives some background.

[MalteJ]

Sorry, we use the APIs that Google and Apple provide. Further we use libraries that are under open source licenses ;)

To make it clear: SAP and Telekom are not going to work on F-Droid support. The apps developed will use the Apple and Google Contact Tracing APIs.
Still, the community is welcome to fork the apps and replace the Google/Apple APIs by an open implementation and distribute this app via open app stores.

[codedust]

To make it clear: SAP and Telekom are not going to work on F-Droid support.

F-Droid support follows naturally by not including any proprietary libraries. This is not about replacing the Apple and Google Contact Tracing APIs, which should be a completely different issue. I'd be happy to see a corona warn app that does not include any proprietary library (which would indeed require the Contact Tracing APIs to be accessible without any proprietary library).