Non-FOSS in F-Droid build - io.objectbox:objectbox-gradle-plugin

[licaon-kter]

ref: https://github.com/kiwix/kiwix-android/blob/754252d1422a141d1d1f1a24bbdd15bb6acfa9d8/buildSrc/src/main/kotlin/Libs.kt#L216 (since https://github.com/kiwix/kiwix-android/pull/1541 or even older?)

Ref: https://github.com/objectbox/objectbox-java/issues/560

Ref: https://gitlab.com/fdroid/fdroidserver/-/merge_requests/1150

/LE: At least since 2.5.0

[licaon-kter]

ref: https://gitlab.com/fdroid/fdroiddata/-/commit/a9113ab0e71dbe0740f00cd37b7463967c2b52f4

[MohitMaliFtechiz]

hi @kelson42 ,

If we are about to remove objectbox as database then we might need to switch core database like SQLite or room database. There is also new database exits called RealM. this will require lots of refracting of code.

[LeoColman]

@MohitMaliFtechiz

If you're looking for an alternative, I've considered

• Realm
• Room
• LitePal
• SQLDroid + KTorm

And ended up with SQLDelight. I found it easy to use, it's very well maintained and seemed to me the closes solution with the "easier" migration. I decided to bump it to a new major version instead of trying anything to migrate the previous database. My app already had an Export/Import option.

All commits related to this can be found in https://github.com/LeoColman/Petals/compare/b00f1e4b2c085613de0e2e6adce79b707d466191...3.0.2

I tried to keep the history as clean and clear as possible to facilitate migration for others.

[kelson42]

@licaon-kter is that the reason why F-Droid has basically removed all the recent versions of kiwix from F-Droid? I see now that version 2.4 in place of 3.6;is delivered. If yes, i can only say that suchmove without temporising and informing is really problematic and hardly acceptable as fair.

[kelson42]

@MohitMaliFtechiz Îm not in favour of removing objectbox. Not as long as Indon’t fully understand the problem. I don’t understand the rational why part of the compilation script is closed source.

[licaon-kter]

@kelson42 not sure what's unclear, I've informed you and removed tainted versions so users don't install non-FOSS apps.

[kelson42]

@licaon-kter I have not been informed that you will removed all kiwix versions since years, back to a super old version. This move is anyway unfear, after these has been accepted during years. You basically come back on your own decision without giving time to us to find a situation, so we are basically in a hard and urgent situation because of your lack of ability to enforce your own rules. Finaly, this is wrong to say that the app is not FOSS because kiwix compilation relies on non FOSS software to compile; if you follow this logic, any software compiled on windows with microsoft cl.exe won't be free, which is non-sense. So, I really wonder if I'm missing one our two important points and I'm OK to revise my assessment of the situation if necessary... but for the moment I can only re-iterate my strong disagreement and disappointment of what is currently going one at F-Droid, even the Play store is more correct: at least when thy change the rules, this is not retroactive on already published apps!

[licaon-kter]

You did read https://github.com/objectbox/objectbox-java/issues/560 , yes?

It's not a compile thing, it's a "your app depends on a non-FOSS lib and includes non-FOSS code in its APK"

Also, at the moment, what's the issue with the current version available?

F-Droid does not retroactively uninstall the app from users devices, those still work.

/LE: see my post below

[licaon-kter]

The F-Droid policy is clear: only FOSS

Devs choose what libs they use, right?

Devs check libs licenses, yes?

Devs check licenses of dependencies of said libs, we hope.

Oh, this did not happen? This does not happen regularly? Yes, and we deal with the flack from both sides, users and devs, just scroll https://gitlab.com/fdroid/fdroidserver/-/issues/1004

[kelson42]

It's not a compile thing, it's a "your app depends on a non-FOSS lib and includes non-FOSS code in its APK"

Who says that? Sorry I can not see the source of your citation. To the contrary I read https://github.com/objectbox/objectbox-java/issues/560#issuecomment-1186811918 which stated exactly the contrary.

[LeoColman]

We did have this discussion over on https://github.com/Nonononoki/Hendroid/issues/70

The plugin is proprietary, and if you skip it you'll need to download a proprietary library.

I've opened both https://github.com/objectbox/objectbox-java/issues/1102 and https://github.com/objectbox/objectbox-java/issues/1100, which was outright closed.

Quoting https://github.com/objectbox/objectbox-java/issues/1100#issuecomment-1262185362

E.g. if for fdroid, all the libs - including native binaries - have to be open source, than ObjectBox does not qualify for those specific terms. There's no secret and no surprise here.

[licaon-kter]

@kelson42

Who says that?

Me, but I'm wrong, mixed issues in my head. Sorry.

Anyway, the issue still stands. It's like google play services is needed at compile time, same idea, not acceptable.

[kelson42]

I have no problem to admit there is an issue and F-Droid is legitimate to regulate things like they/you want. We are all FOSS supporters and doers and we know why this is important that as much as possible software pieces are FOSS.

Regarding the F-Droid regulation to forbid non-FOSS in the toolchain, I'm not sure to fully understand the rationals behind them. But I would be really glad to hear them, just out of curiosity.

My critic is how to handle the situation.

Now that we agree that F-Droid does not distribute non-FOSS softwares because of this problem, can we agree to continue to distribute version 3.6.0 of Kiwix? On our side, we would work to fix the problem in 3.7.0. Like you can see, if Objectbox does not free their plugin, this is going to be serious work for us.

[licaon-kter]

I don't see a reason to distribute it if not-FOSS.

If you want to avoid F-Droid distributing the older version in the mean time, I guess we can disable all versions until 3.7.0 is out.

[licaon-kter]

We've discussed an upgrade path too, but that is done under specific rules and timing: https://gitlab.com/fdroid/fdroiddata/-/issues/2776

[kelson42]

I don't see a reason to distribute it if not-FOSS.

This is exactly where you mix things IMO, beetween build dependences and runtime dependences. You only distribute the runtime, and this is perfectly FOSS. What is none FOSS here are the build dependences which you run once in compilation farm, but that does not impact end users because none of this is included in the APK.

You don't have answered about then constraints F-Droid has on the build toolchain. I have read the doc and I don't have seen something telling that build toolchain should be FOSS as well. It's only written that the software itself should be free software. I strongly recommend to clarify that point

[kelson42]

@LeoColman Thank you very much for your inputs. It seems we share the same lot. For the moment, I just try to understand fully the problem and see how to make damage control. I was angry after the play store and now after F-Droid, which is far more painful for me. Nice start in the WE!

[licaon-kter]

https://f-droid.org/en/docs/Inclusion_Policy/

We cannot build apps requiring Non-Free build tools, including Oracle’s JDK or some pre-release toolchains. The software should not download additional executable binary files (e.g. Non-Free addons, auto-updates, etc)

etc.

Also note that everything mentioned there is FOSS, either if F-Droid builds it, or Debian, or it's a maven repo or it's pulled from upstream.

[kelson42]

@MohitMaliFtechiz @gouri-panda if we should consider an alternative to objectbox. Which of the alternatives proposed by @LeoColman would fit the best for us? And why?

[gouri-panda]

@kelson42 We should consider Room for our database. Google officially recommends this.

And why?

According to the official documentation

The Room persistence library provides an abstraction layer over SQLite to allow fluent database access while harnessing the full power of SQLite. In particular, Room provides the following benefits:

• Compile-time verification of SQL queries.
• Convenience annotations that minimize repetitive and error-prone boilerplate code.
• Streamlined database migration paths.

[kelson42]

@LeoColman @licaon-kter @gouri-panda Is Room FOSS?! Pretty unclear to me.

[gouri-panda]

@kelson42 I don't think we should worry about license here. It comes with Android SDK package. I think we are good to go.

[kelson42]

@gouri-panda Firebase is part of the SDK as well right?

[gouri-panda]

@kelson42 Yes, but it's hosting service for database, content and authentication etc.

[kelson42]

Firebase is forbidden by F-Droid... so we should always be careful about licenses.

[gouri-panda]

@kelson42 I think this file is a good way to look at it.

[gouri-panda]

Honestly, I don't know much about licenses.

[licaon-kter]

https://mvnrepository.com/artifact/androidx.room/room-runtime/2.4.3 looks fine

Firebase (except like 1 lib) is not FOSS licensed afaik. And if it is then it depends on other Google proprietary lib like GMS

[MohitMaliFtechiz]

hi @kelson42 ,

I also vote for ROOM db since its google official now.

[eighthave]

F-Droid's policies on free software come from Free Software Foundation, Open Source Initiative, Debian, etc. They have clearly defined what free software is, so we don't need to. (In fact, F-Droid is a bit looser than all of those, we currently allow non-free assets, though that might change). An easy way to think about what free software is: can the user customize it using only free software? If the user needs to use non-free software to build the source code, then the user does not have the freedom to modify the software in any way they want to. They cannot change the proprietary build tool.

Firebase is forbidden by F-Droid... so we should always be careful about licenses.

Firebase is not forbidden by F-Droid, non-free software is. If Firefbase is free software, then it is allowed.

Regarding the F-Droid regulation to forbid non-FOSS in the toolchain, I'm not sure to fully understand the rationals behind them. But I would be really glad to hear them, just out of curiosity.

F-Droid did not make this policy, this is the definition of free software followed by RedHat, Ubuntu, FSF, FSFE, OSI, Debian, etc. etc. Here's a good post on that topic: https://opensource.com/article/17/3/using-proprietary-services-develop-open-source-software

[kelson42]

Superseeded by #3101