F-Droid Release? - Githubissues

mlaga97 commented 1 year ago

Would it be possible to distribute this app via F-Droid as well in order to allow access with devices not containing Google Play Services?

I was able to build the app using Android Studio and run it on a device that did not have the Play Store (Lineage OS), so it should be possible to distributed via F-Droid without much issue for further reach.

xdsopl commented 1 year ago

It already has the needed fastlane structures and F-Droid has been notified via Twitter. Now all we can do is wait.

xdsopl commented 1 year ago

Maybe we should also ping @fossdd, @mondlicht-und-sterne and @IzzySoft

IzzySoft commented 1 year ago

F-Droid has been notified via Twitter.

Haha, good joke :speak_no_evil: So you've notified the "social media team", so to say? And then on Twitter even. Sorry, no offense meant and no bitter feelings, but that's the double-wrong place for an inclusion request. You'd need to open an RFP (Request For Packaging; if you received an answer to your tweet it would probably just say the very same). The details needed won't fit into 280 Twitter- or 500 Mastodon-chars, and couldn't be processed there :wink:

That said, taking a quick glance it looks like your app is meeting the inclusion criteria fine, so feel encouraged to go ahead! If you'd add releases to your tags and attach the APK there (starting with the newest one is totally fine), I could even see if I could add the app to my repo right away for a little "head-start".

xdsopl commented 1 year ago

Have absolutely no idea how F-Droid works and got contacted for inclusion of my Robot36 app via PR and it all worked fine .. so can we do that again? I am busy with other things.

mlaga97 commented 1 year ago

@xdsopl Busy is fine, that's what FOSS community is for. Can this be taken as a go-ahead for the community to figure out what needs to be done and contribute that up to get everything set up on F-Droid (i.e. version tagging, etc.). If so I can start to go through everything and see what changes need to be made by PR and submit the packaging request officially once I get back home from travel on Wednesday.

xdsopl commented 1 year ago

thank you @mlaga97, that would be very nice

IzzySoft commented 1 year ago

My offer also stands: should you get stuck or want your app listed in my repo for any other reason, I just need the APK (as described above, ideally at the tagged releases) and then could get it set up the same day. As a side-effect, I then could even provide half of the YAML needed for the F-Droid merge request, as I'd have that set up for my repo by then :wink:

xdsopl commented 1 year ago

@IzzySoft, the new way of do things on the Google Play Store is to use bundles. So instead of signing the APK, we only use a signature for uploading. So how could we satisfy both? Create an unsigned APK?

IzzySoft commented 1 year ago

So you left creating your (private!) key to Google? OK, then we are a bit lost here (@xdsopl please mention that in your RFP then to indicate "reproducible builds" don't need to be even attempted as upstream has no access to its signing keys – Google doesn't provide them once they created them). And no, unsigned APKs won't be much help. Three options in this case:

you leave it entirely to F-Droid (as you left it to Google) so a key generated by F-Droid is being used.
you download the APK once it's signed by Google and attach it here (in this case, reproducible builds can be tried again at F-Droid – though there's no way to control the way Google builds the APK. Would be interesting to see, though, whether RB succeed then – or what the differences would be otherwise, e.g. if Google added something you didn't provide, apart from the signature)
you create yourself a separate key to sign Github builds. RB could then be tried against that.

In case you wonder what "reproducible builds" (RB) mean: basically, the two APKs (yours and the F-Droid build) would be checked whether they are "binary identical twins" (except for the signature, of course). If so, the APK signed by you would be put into the catalog – which usually means people can cross-update between F-Droid, Google and your Github releases. It also independently confirms the APK signed by you corresponds to the code from your repo, thus adding a level of confidence. More details e.g. here – also see this article by reproducible-builds.org and this article from the F-Droid blog.

xdsopl commented 1 year ago

you leave it entirely to F-Droid (as you left it to Google) so a key generated by F-Droid is being used.

Let's do that. I don't need and don't care about the extra paranoia. I only care about the source code while others care about having the app available freely on the Google Play Store or on the F-Droid catalog. Thank you.

IzzySoft commented 1 year ago

Well, my question was not exactly about paranoia. Reproducible builds would make it possible to cross-update between Play, Github & F-Droid – which some folks (e.g. those currently having it installed from Play but willing to switch) would appreciate. But yes, that might be an extra burden to maintain (though I think the second option would mean no more than 5 minutes extra per release), so your decision is of course respected.

So @mlaga97 please mention in the RFP that the author has no access to the signing keys as Google does the signing, and thus reproducible builds probably cannot be achieved. Thanks!

xdsopl commented 1 year ago

The APKs for Rattlegram can be found here: https://www.aicodix.de/cofdmtv/rattlegram/apks/

IzzySoft commented 1 year ago

@xdsopl if you intended them for my repo: my updater cannot fetch them from there. It expects them to be attached to their corresponding release here.

xdsopl commented 1 year ago

@IzzySoft Do you need them to be committed into the same branch and repository or is a link in the tag to the website enough? Committing them to a different branch would be still okay for me as I would like to avoid committing the binaries to the source branches.

xdsopl commented 1 year ago

I've just created a GitHub release from a Git tag and attached the binary. This works for me. @IzzySoft does this work for you as well? https://github.com/aicodix/rattlegram/releases/tag/v1.11

mondlicht-und-sterne commented 1 year ago

I tested the 1.11 version and it works.

IzzySoft commented 1 year ago

Thanks, that works – setting it up now. Great to see you also have Fastlane established. Could you please fix the formatting of full_description.txt so it can be properly parsed as Markdown? Just lacks some line breaks basically. And maybe a minor addition. Suggestion:

*Rattlegram* lets you transmit short text messages over COFDMTV encoded audio signals. COFDMTV is based on COFDM (coded orthogonal frequency-division multiplexing) technology:

- 160 ms long OFDM symbols
- 6.25 Hz per sub-carrier
- 1/8 guard interval
- differentially encoded PSK (phase-shift keying) modulation
- systematic polar codes for forward error correction

Remaining part can stay as-is if it's OK for you that it becomes a single paragraph. Otherwise, separate paragraphs by an empty line. If you want the German variant of short- and full desc, just let me know, I've set them up here as well. Oh, and be aware that VT reports TrendMicro thinks it detected a trojan (false positive IMHO as it's only TrendMico, none of the other engines confirms this).

Your app should become available here with the next sync in about 24h (just missed the current run). Be welcome to pick a badge then to link there from e.g. your Readme :smiley:

aicodix / rattlegram

F-Droid Release? #2