proprietary components in "floss" APKs

[IzzySoft]

Is your feature request related to a problem? Please describe. I've just noticed that APKs became available again meanwhile, and picked the latest app-bayernfloss-release.apk from the releases tab. Unfortunately, despite the term "floss" in the name, it contains proprietary components:

Offending libs:
---------------
* Firebase Data Transport (/com/google/android/datatransport): NonFreeNet
* Google Mobile Services (/com/google/android/gms): NonFreeComp
* ML Kit (/com/google/mlkit): NonFreeComp,Tracking
* Mapbox Android SDK (/com/mapbox): NonFreeComp
* Sentry SDK for Java (/io/sentry): Tracking

(Sentry of course is not proprietary but shows up in that list because of "tracking"). My guess is that Firebase & GMS are just results of including MLKit (which has them as dependency), which just leaves MLKit and Mapbox as "culprits".

Is your feature request related to a problem? Please describe. Proprietary libraries are not FLOSS :wink:

Describe the solution you'd like Would you consider having a real FLOSS build skipping the two? There are certainly alternatives to them (depending on what you use MLKit for). Thanks in advance!

Describe alternatives you've considered I'm not an Android developer and do not know what exactly those libraries are used for, so I cannot really say what alternatives exist. But as to Mapbox, there's MapLibre which might have a fitting replacement. For MLKit it depends on what features you need.

Additional context As you already know me, you most likely also associate some background with me. Yes, I still look forward adding your app to my repo one day – unless you want to give F-Droid another try :wink:

[f1sh1918]

Hi @IzzySoft ,

thx for your issue. We know that we are currently not FLOSS and therefore probably not providing any "FLOSS" apk in the next versions. The Mapbox dependency should be gone by updating to the next major version of maplibre and sentry also shouldn't be the big problem but i don't think we can easily get rid of the MLKit since its using mobile_scanner library. We didn't find any good replacement for this library yet and its a crucial app feature. Maybe we find some other stable library in the future but this is not planned yet. Feel free to provide any suggestions. We don't see any value by providing a FLOSS version without identification & verification tbh

Since we pushed for other apps a lot of effort into F-Droid without much success, there won't be any release on this platform in the near future.

[IzzySoft]

Hi @f1sh1918 and thanks for your response!

• Mapbox: That's good news!
• Sentry: definitely less invasive than closed-source analytics (Crashlytics, Firebase, MS AppCenter & Co). Good pointers to show it's not a problem would be "self-hosted" and "opt-in" here.
• MLKit: I hear that often, but see other apps with barcode/QR scanners not having that dependency even more often. Not being an Android dev I never understood the details here (what MLKit offers and other libraries cannot cover). Maybe it's worth raising a question at StackExchange, e.g. asking for a library providing (what-do-you-need) at SoftwareRecs? I've checked there, but the only one on MLKit alternatives I could find was this and I'm not sure if asking for "what library to use" would be on-topic at StackOverflow (as expected, a search there has the entire first result page with "how to use" questions).

Since we pushed for other apps a lot of effort into F-Droid without much success

Oof, did I miss something there? Well, I'm currently not active at F-Droid, but there's always my repo (or I could help you setting up your own). If there are any apps I should check if they would fit into my repo, just let me know.