Cannot fetch card prices from F-Droid Build

[ntlaseca]

Whenever I attempt to check a card price, I get the following error message:

Error fetching price [API keys]

[AEFeinstein]

That's weird. The exception is thrown here if the asset with the API keys isn't found. It's definitely included in the production APK though. What phone and OS are you running? Have you tried uninstalling and reinstalling? You can save and restore your data using the "Save Data to SD" and "Load Data from SD" buttons in the menu.

try {
    TcgpKeys keys = new Gson().fromJson(new InputStreamReader(mActivity.getAssets().open("tcgp_keys.json")), TcgpKeys.class);
    token = api.getAccessToken(keys.PUBLIC_KEY, keys.PRIVATE_KEY, keys.ACCESS_TOKEN);
    /* Save the token and expiration date */
    PreferenceAdapter.setTcgpApiToken(mActivity, token.access_token);
    PreferenceAdapter.setTcgpApiTokenExpirationDate(mActivity, token.expires);
} catch (FileNotFoundException e) {
    return Single.error(new Exception(mActivity.getString(R.string.price_error_api_key)));
}

[ntlaseca]

I'm using a Samsung Galaxy S5 with Lineage OS 14.1. I started receiving this error once I upgraded to 3.5.0. I uninstalled, wiped data and cache, and did a fresh install but I still get the error message.

[AEFeinstein]

3.5.0 is the first version to use the new API for getting card prices, so that makes sense. Lineage 14.1 is equivalent to Android 7.1, which I have tested against. I wonder if Lineage is doing something weird with assets...

On Thu, May 3, 2018 at 4:02 PM ntlaseca notifications@github.com wrote:

I'm using a Samsung Galaxy S5 with Lineage OS 14.1. I started receiving this error once I upgraded to 3.5.0. I uninstalled, wiped data and cache, and did a fresh install but I still get the error message.

— You are receiving this because you commented.

Reply to this email directly, view it on GitHub https://github.com/AEFeinstein/mtg-familiar/issues/388#issuecomment-386418629, or mute the thread https://github.com/notifications/unsubscribe-auth/AAOHDNxq7BMHvhH_OPTFvkTDTt-9K6T3ks5tu2JFgaJpZM4TxnfQ .

[AEFeinstein]

What happens if you install the APK directly from here, rather than Google Play? https://github.com/AEFeinstein/mtg-familiar/releases/download/v3.5.1/v3.5.1.apk

[ntlaseca]

It works! I was actually using the F-Droid repository rather than Google Play, not sure if that makes a difference. Thanks for your help.

[AEFeinstein]

Ahh, that makes sense. F-Droid uses an automated build process directly from GitHub, but I don't check the API keys in for obvious reasons, so that key asset doesn't exist in the F-Droid build. I'll have to think about how to get those keys into the F-Droid build. In the meantime I'll see how many F-Droid users there actually are based on how many people report this issue!

[AEFeinstein]

I'm going to keep this open until the F-Droid build can actually fetch prices.

[ntlaseca]

Okay, sounds good!

[yringot]

I'm also affected by this. I'm in China and just bought a Xiaomi Phone, so without Google framework and I installed MtG familiar from fdroid.

[pimaster]

F-Droid user here too on TF101, Android 6.01 via KatKiss-034. 3.5.0 from F-Droid with the "Error fetching price [API keys]" error. 3.5.1 from git fixes the issue.

[ghost]

+1 with this issue, MTG Familliar 3.5.4 installed from F-Droid, Android 8.1, Redmi Note 3.

[LinOS4]

+1 with this issue, MTG Familliar 3.5.5 installed from F-Droid, Lineage OS 15.1 (Android 8.1), LG Nexus 4

[LivInTheLookingGlass]

Im affected by this

[AEFeinstein]

I don't think it's possible to put a private API key (TCGPlayer.com) in a public build (F-Droid) and still keep it secret. I'm no cryptography genius, but I haven't thought of a way yet at least.

The 'solution' is to use one of my FOSS builds, attached to the releases page. Updates aren't automatic, but you can get atom notifications here or watch the project for releases only using the button at the top of the page.

[LivInTheLookingGlass]

If the FDroid build system works like other CIs, you should be able to declare secret environment variables. Otherwise maybe give a field in settings for an API key? That probably wouldnt work if they arent free though.

On February 23, 2019 5:14:35 PM UTC, AEFeinstein notifications@github.com wrote:

I don't think it's possible to put a private API key (TCGPlayer.com) in a public build (F-Droid) and still keep it secret. I'm no cryptography genius, but I haven't thought of a way yet at least.

The 'solution' is to use one of my FOSS builds, attached to the releases page. Updates aren't atomatic, but you can get atom notifications here or watch the project for releases only using the button at the top of the page.

-- You are receiving this because you commented. Reply to this email directly or view it on GitHub: https://github.com/AEFeinstein/mtg-familiar/issues/388#issuecomment-466670142

[AEFeinstein]

Environment variables work on my machine, but I can't set them on fdroid's.

I could add a setting to add a key. They are free but require approval from tcgplayer on a per app basis, I think. How about you try to get a key, and if it's easy to do, I'll build in key entry.

[MailYouLater]

OK, there are other apps in the F-Droid repo that have notes about certain features not working because the public repository doesn't contain 'secrets' necessary for them to work, so I submitted a merge request to them to do the same for this: Card price lookups don't work due to a missing API key.

I was thinking it would be cool if F-Droid could get an API key, but after I searched around a bit, it looks like F-Droid doesn't like 'secrets', so even if you had a way to give them an API key without making it public, they'd probably either ignore it, or ... I suppose maybe put it in the public metadata for their build server (and anyone else who looked through the metadata) to use?

Anyway, there is another option: Host you're own F-Droid repository, like the ones on this list, similar to c:geo which apparently can't be in F-Droid's repository due to using deprecated Google Maps libraries or something. Then I'm thinking maybe a link to your F-Droid repository could be added to the MTG Familiar listing on the official F-Droid, but even if they won't do that, then it can at least be linked in the readme on this github repo, so people having this issue have an easy way to integrate your binaries with F-Droid in a similar way to how they were planning to use MTG Familiar.

[AEFeinstein]

Hosting a personal F-Droid repo seems antithetical to F-Droid. At least the part where it states:

It is built and signed by F-Droid, and guaranteed to correspond to this source tarball.

I don't particularly want to maintain a repo either, but I do keep the APK release up to date on this repo's releases page. Perhaps the F-Droid page should link to the repo's releases page with a note that the TCGPlayer API keys work there?

[MailYouLater]

The part about it being built and signed by F-Droid is fairly obviously only about the files in their default repositories that they host, and/or which are included by default with the F-Droid app. Anyone is free to make their own F-Droid repo, and it seems to be a fairly regular thing for maintainers of apps that F-Droid would include if it weren't for 'x', or apps where the version F-Droid supplies has reduced functionality (like this one) to make their own repo for people who use F-Droid to manage their apps, and want to use (the fully functional version of) their app.

Another option is to see if IzzyOnDroid will include the full-featured version of MTG Familiar in their repo.

[AEFeinstein]

IzzyOnDroid looks good, since it picks APKs right from github releases. The less maintenance work I have to do, the better. I'll send them an email later.

[relan]

Hey, F-Droid developer here.

The inclusion policy says:

F-Droid does not sign up for any API keys.

If some part of app's source code is kept in secret, users can't build an equivalent APK. This violates the 4th essential freedom, making such software non-free. Since F-Droid hosts only free/libre software, APKs totally correspond to the source code they were built from.

[AEFeinstein]

@relan I get that, and we're not trying to get any secret API keys into the F-Droid repository. I like essential freedom, even if it comes at the cost of a broken feature.

What @MailYouLater is proposing is having a version of Familiar with the API key hosted in a separate repository that can be accessed through an F-Droid client, IzzyOnDroid being a candidate. Is that reasonable to you?

[relan]

Authors are indeed free to distribute their apps in any ways. I'm just explaining why F-Droid does not provide any means of hiding “secrets.”

[MailYouLater]

@relan: Thanks for the explanation, and for accepting my merge request.

@AEFeinstein: You stated earlier that you were going to "send an email" regarding IzzyOnDroid inclusion; have you? It looks like IzzyOnDroid app suggestions generally go through the IzzyOnDroid repo's GitLab Issues, so perhaps it would be good to post there? If so, will you do it? or should I?

[AEFeinstein]

Issue submitted: https://gitlab.com/IzzyOnDroid/repo/issues/63

[MailYouLater]

For anyone not following the IzzyOnDroid repo app submission, Izzy has replied, and we've discussed reasons why MTG Familiar should or shouldn't be added to his repo.

Anyway, currently it sounds like Izzy is willing to accept MTG Familiar if we can write a new description for both the F-Droid repo & IzzyOnDroid repo which explains the situation well.

Here's my 'first draft' suggestion. Please let me know what you think. Are there any changes that need to be made? I feel like the wording on some parts could be improved.

Summary:

Utilities for the game Magic: The Gathering

Description:

MTG Familiar is a collection of utilities for the "Magic: The Gathering" trading card game, including a searchable offline database of magic cards, life, poison & mana counters, a set of virtual dice, card image downloads, deck, trade and wishlist management, comprehensive offline rules and judge documents, and a timer for competitive play.

Note: Card price lookups fail in the official F-Droid build due to a missing API key. The IzzyOnDroid repository contains the author's own builds of many open source apps, including a build of MTG Familiar with the necessary API key for card price lookups. IzzyOnDroid's releases are taken directly from the author's releases on GitHub. Switching between an F-Droid release and the author's release requires you to uninstall the app first because the author and F-Droid use different digital signatures. Uninstalling will remove your data.

[AEFeinstein]

It's not clear whether "the author" is me (author's release) or Izzy (author's own builds of many open source apps), so I removed that phrase. Also users can save their data by exporting and importing it! Do you like this wording?

edit: see the updated wording on the IzzyOnDroid ticket

[MailYouLater]

I like your changes. The only thing I would change now is removing "F-Droid" where I've crossed it out here: "Switching between an F-Droid APK and the IzzyOnDroid APK requires you to uninstall the F-Droid APK first because the APKs use different digital signatures."

My reasoning for this is that some people may want to switch in the other direction, in which case they'll need to uninstall the IzzyOnDroid(/Google Play/GitHub release) version to be able to install the F-Droid version.

Everything else you changed in the description you posted to the IzzyOnDroid ticket looks great. 👍

[AEFeinstein]

MTG Familiar with the API key is on IzzyOnDroid https://apt.izzysoft.de/fdroid/index/apk/com.gelakinetic.mtgfam

[MailYouLater]

@AEFeinstein: One last thing on this ticket.

Could you change the title of this ticket to say that it's specific to the F-Droid build? Thank you.

And thank you so much for making MTG Familiar too. ☺

[AEFeinstein]

Done, and you're welcome 😃