search

austrianredcross / stopp-corona-android

Android Source Code
https://play.google.com/store/apps/details?id=at.roteskreuz.stopcorona
GNU Affero General Public License v3.0
272 stars 55 forks source link

F-Droid #3

Open mplx opened 4 years ago

mplx commented 4 years ago

Submit the app to F-Droid, a community-maintained software repository for Android; see https://f-droid.org/de/contribute/

michaelpuermayr commented 4 years ago

this would surely boost trust

evilscientress commented 4 years ago

Especially in the light of #6 and that they explicitly said the last update would not have that code anymore.

nosurveillance commented 4 years ago

Also support reproducible builds

gsantner commented 4 years ago

If there is interest on this from developer side, and so interest to integrate potential code changes: I can help on this. Have most of my own apps there too.

marandaneto commented 4 years ago

I generally agree with the idea, but F-Droid is only known by developers I'd say or a very small portion of the population, with Covid-19, not sure if this would work, we need to target as much people as possible.

votacom commented 4 years ago

I generally agree with the idea, but F-Droid is only known by developers I'd say or a very small portion of the population, with Covid-19, not sure if this would work, we need to target as much people as possible.

Not really developers; F-Droid's user base is also highly Google-free. It's virtually the app store for Android users that want to be independent of Google services.

evilscientress commented 4 years ago

This is about releasing the app also on F-Droid. So if your goal is to make the app available to as many users as possible this would help with that.

marandaneto commented 4 years ago

This is about releasing the app also on F-Droid. So if your goal is to make the app available to as many users as possible this would help with that.

as I said, I agree and I'm not against it. so also on F-Droid would be perfect, I was thinking about a replacement

marandaneto commented 4 years ago

one addition to this is that the current version of the App. uses closed-source libs eg firebase, p2pkit so it can't be FLOSS and it violates F-Droid's policy.

https://f-droid.org/en/docs/Inclusion_Policy/

votacom commented 4 years ago

one addition to this is that the current version of the App. uses closed-source libs eg firebase, p2pkit so it can't be FLOSS and it violates F-Droid's policy.

https://f-droid.org/en/docs/Inclusion_Policy/

Which libraries exactly would need replacement? p2pkit will eventually anyway be replaced by Android's exposure notification. But we can already fork and prepare replacement of all other libraries so that we're ready on day one after the exposure notification release. Let's analyze how big of an architectural change this requires and organize the fork then.

marandaneto commented 4 years ago

@votacom I believe these:

google-services, firebase-messaging, play-services-nearby, p2pkit-android

I'd be down to help as well, but we still don't have a contribution guideline, so not sure how this would work, since only Health Authorities are allowed to publish a Contact-Tracing-App., we depend on them.

marandaneto commented 4 years ago

btw I believe Android's exposure notification (which is inspired by DP-3T) will come thru google services, so a clean DP-3T protocol implementation makes more sense IMO

votacom commented 4 years ago

Google announced that they be curating the accessibility to the exposure notification API to select apps, but to my knowledge they have not yet announced how they will do that technically. There will be more to it than just curating their app store; they will IMHO also seek to make it impossible for side-loaded apps to act as a client for the respective public heath authorities' clouds. Will Google open-source the client part of its implementation into AOSP? Will the architecture at all make it possible to run government-issued apps on non-Google Android?

Aside from these questions of running this app on non-Google Android, it should still be possible to open-source the app even if it relies on google services.

ghost commented 4 years ago

One more reason for F-Droid from my side: To my knowledge the StoppCorona app (still) is only available to users who have set their Android Play Store to Austria and from what I was told this is not planned to be changed. If the app was available in the F-Droid store, I would be able to install it from there (yes, it would make sense, I live in Austria ;) ).

A bit of background: Even though I live in Austria my Android Play Store is set to Germany and (for reasons only Google might or might not know...) it seems you can only change the country settings of the Play Store if you provide Google with Credit Card information. And even then you are only allowed to switch it back after one year. So, I am locked to my German Play Store.

Of course just releasing the App in Play Store globally would be an easier fix for my problem, but as far as I understood the Red Cross org they don't want to go down that road.

mitsuhiko commented 4 years ago

@aufziehvogel might be worth adding some feedback about the geo-lock to #19.

marandaneto commented 4 years ago

Google announced that they be curating the accessibility to the exposure notification API to select apps, but to my knowledge they have not yet announced how they will do that technically. There will be more to it than just curating their app store; they will IMHO also seek to make it impossible for side-loaded apps to act as a client for the respective public heath authorities' clouds. Will Google open-source the client part of its implementation into AOSP? Will the architecture at all make it possible to run government-issued apps on non-Google Android?

Aside from these questions of running this app on non-Google Android, it should still be possible to open-source the app even if it relies on google services.

they've not announced it yet, but there are some rumors that it is thru google services eg https://mobilesyrup.com/2020/04/24/apple-google-exposure-notification-api-update/ soon we'll know anyway, I'm down for helping it to become FLOSS :)

jondo commented 4 years ago

@nosurveillance, I have filed a separate issue (#31) about the orthogonal topic of reproducible builds.

marandaneto commented 4 years ago

https://github.com/google/exposure-notifications-android

included in an upcoming build of Google Play services

I guess the Red Cross needs to fill this in to get access and be able to use the exposure notifications. https://support.google.com/googleplay/android-developer/contact/expo_notif_api

DJCrashdummy commented 4 years ago

surprisingly no one mentioned it before... there is a rfp: https://gitlab.com/fdroid/rfp/-/issues/1319

codeling commented 3 years ago

Any news here? I heard that microG now also provides an implementation of the exposure notification API, could this maybe help to get Stopp Corona into F-Droid?

benjaminaigner commented 3 years ago

I'm really sorry, but this is a real show-stopper. If it is not possible to develop a FOSS app for public services, I won't install that app on my device.

Most of my friends / colleagues use Google free Android phones, so an app in the F-Droid store would really help many people.

jondo commented 3 years ago

FYI, the German corona warning app seems to make some progress here, see https://github.com/corona-warn-app/cwa-app-android/issues/1483 .

mplx commented 3 years ago

This had been also in the the news the last days (i.e. Heise, Caschys) - basically the google libraries have been replaced by the microG framework which also features in the exposure API since ~2 months. Until now this is a community fork and not endorsed by the Koch institute.

clavinet commented 3 years ago

Why is it still not on F-Droid?

Can't even download an APK from the official website.

What an absolute joke. You (the Austrian Red Cross) want me to trust you, but do very little to earn that trust. Publishing the code was a good first step, but I have no way to know the code I download from Google Play is the same you published here.

My tip: instead of paying third-rate influencers to advertise it, pay a dev to put this on F-Droid and/or enable reproducible builds.

codeling commented 3 years ago

A fork of the german app without dependency on the google implementation of the exposure notification API (using the microg implementation instead) will soon be in the f-droid repositories:

Since supposedly you can use the apps across country borders, is it feasible to use this one permanently in Austria?

votacom commented 3 years ago

Since supposedly you can use the apps across country borders, is it feasible to use this one permanently in Austria?

Contact tracing is more than the app. The processes for exposure notification are different in the German health administration landscape. You can passively use the German app in Austria alright, but you'll have a hard time upon a positive test finding a doctor in Austria who will issue a QR code the Germans will accept.