F-Droid

[testman42]

Would this app be suitable to be put in F-Droid's repos?

[laurent22]

If it can be automated that might be an option. I've also been thinking of simply linking to the APK in GitHub.

[BenjaminHCCarr]

I second @testman42 's F-Droid inclusion, if you are using github release, there are webhooks for F-droid updates.

[BenjaminHCCarr]

https://f-droid.org/en/contribute/ https://f-droid.org/en/docs/Inclusion_Policy/ https://gitlab.com/fdroid/fdroiddata/blob/master/CONTRIBUTING.md https://f-droid.org/docs/Submitting_to_F-Droid_Quick_Start_Guide/

It's mostly looking for metadata to include, like the project info and license, etc.

[daniel-daga]

If you can, please provide an apk. I would love to try the app, but without Google Play I am not able to install it

[laurent22]

@daniel-daga, for now you can download the latest APK from there:

ARM (probably what you need): https://github.com/laurent22/joplin/releases/download/v0.10.35/app-armeabi-v7a-release.apk

i386: https://github.com/laurent22/joplin/releases/download/v0.10.35/app-x86-release.apk

[daniel-daga]

That's great, thanks a lot!

[laurent22]

No problem. On a side note, I'm curious what are the incentive of using F-Droid? I'm all for using non-Google products, but in practice many apps aren't in F-Droid so it means one would also have to use Google Play anyway, so in that case why not use Google Play only?

[alexanderadam]

On a side note, I'm curious what are the incentive of using F-Droid? I'm all for using non-Google products, but in practice many apps aren't in F-Droid so it means one would also have to use Google Play anyway, so in that case why not use Google Play only?

Well…

1. Some apps aren't on Google Play as well because Google is still a company that may enforce censorship to ensure it's profits are secured. See NewPipe for example. It allows to to play YouTube videos in the background and download them in different formats as well. So it's basically a free competitor of Spotify / Youtube Red on top of YouTube. Similar things happened on the Apple AppStore but but as iOS devices can't use F-Droid natively this might be another issue.
2. Some countries block Google services including Google Play. F-Droid is usually not blocked and even if it would be blocked you could run your own mirror to provide packages for your friends or even share these packages within the F-Droid application.
3. Your comment in practice many apps aren't in F-Droid itself is a reason why it is more or less lucrative for other application maintainers to publish on F-Droid. See, if every maintainer would think like this there wouldn't be any applications on F-Droid at all. Luckily more and more people put their apps on F-Droid. So if Joplin appears on F-Droid it might be another small part to convince other maintainers and therefore help step by step increasing the amount of available apps on F-Droid.
4. Some applications use analytics provider that aren't trustworthy and even considered spyware. Often the maintainers don't even know about it, as the analytics logic in proprietary components can change their behaviour. A service could be trustworthy today but starts spying on your users tomorrow. It isn't possible to generally avoid spyware or software flaws that may lead to spyware behaviour, but you can at least ensure that there aren't any proprietary components that would make it difficult to detect bad behaviour. F-Droid ensures that no proprietary components are included. For end users this means F-Droid applications are usually more trustworthy. It's no guarantee but at least a useful hint.
5. Finally, I know indeed people who absolutely simply avoid the Google Play Store by choice.

So it like comparing the apple app store and homebrew.

[laurent22]

Thanks for clarifying @alexanderadam, that makes sense.

For now I have opened a request here: https://gitlab.com/fdroid/rfp/issues/434 If any of you has an account there, please upvote it so that there's more chance it gets picked up.

[laurent22]

For information, an APK file will now be automatically released with each new version (in fact it will be available before the Google Play version). It can be downloaded from the home page and from the Releases section on GitHub.

[Hillside502]

Please use HTTPS links throughout when referring to Joplin website https://joplin.cozic.net/

[brenthuisman]

+1. I get most of my apps from f-droid, since it's a lot simpler than managing apks (and updating them!) by hand. Thanks for the good work!

[ComputingFroggy]

+1 I have a new phone, and so far I have managed to not use Google Play and still to get the apps I need/want from F-Droid. I will use the APK download for now, but using F-Droid with an automatic update would be nice.

[Outi-s]

Have you ever thought of uploading to apkmirror.com?

Edit: ah, f-droid let's you update and not updating manually is the key here. Apologies.

[laurent22]

Joplin is going to use Firebase to enable reliable notifications on Android, so since this is a Google package, F-Droid unfortunately will no longer accept the application.

To avoid using the Play Store, you can download the APK directly from https://github.com/laurent22/joplin-android/releases

[Hillside502]

@laurent22 Firebase is closed-source Google (spy)ware:- https://firebase.google.com/

According to Yalp Store, Joplin uses Google Play Services.

F-Droid unfortunately will no longer accept the application

https://gitlab.com/fdroid/rfp/issues/434 is still open, so you're making an assumption.

So, my question --- is Joplin trustworthy, privacy-conscious open-source software?

[laurent22]

To clarify, Firebase provides a ton of functionalities, but Joplin only needs scheduled (local) notifications for alarms. So when I've added it I've only enabled this particular functionality and I disabled all the features to "help Google improve Firebase" (there were several checkboxes for it). This is complex technology and I can't claim I understand everything of it but as far as I know this doesn't introduce any tracking. If I'm wrong, I'm happy to work with anybody who knows about it and provide an option that disables that functionality.

The reason I've used Firebase is because there's currently no good local notification package for React Native on Android (on iOS this is covered by the built-in iOS lib). The only independent Android one is discontinued and there's no alternative. Basically it's not like search engines - either Google or Duckduckgo - it's Google or nothing at the moment. When a good open source module is released it's always possible to switch to it (like many things in Joplin, the Alarm driver for android is tiny so can be switched easily).

[alexanderadam]

Would it be a possibility to have a build without notification functionality on F-Droid for now? Like another build recipe that just skips that functionality until there is a FOSS solution that suits the notification case.

[lachlan-00]

I understand your reasoning Laurent. I forgot which project it was but i know others that have had the same problem by using firebase.

[laurent22]

Would it be a possibility to have a build without notification functionality on F-Droid for now?

The app never actually got added to F-Droid because there were other issues (their build system couldn't build it). Maybe a special build could be created if they wanted to add it, but I doubt it as it's been nearly a year now.

[trymeouteh]

This would be great! Automatic updates for Joplin on phones that don't have Google Play Services!

If this cannot be done please add a notification in the app that can notify the user that there is a new version of Joplin.

[trymeouteh]

Try doing what Bromite did and create a unofficial repo for Joplin.

https://github.com/bromite/bromite#user-content-is-bromite-on-f-droid

[laurent22]

Dependency to Firebase has been removed as of v233. Please give it another try.

Actually I don't really understand the situation with F-Droid, is the app already available on it via some repo? If so maybe I could add the info to the download page.

[Hillside502]

v233?

Your current version is v1.0.120
https://github.com/laurent22/joplin/releases

[laurent22]

233 for Android - https://github.com/laurent22/joplin-android/releases/download/android-v1.0.233/joplin-v1.0.233.apk

[4ut0-M-4t]

Actually I don't really understand the situation with F-Droid, is the app already available on it via some repo? If so maybe I could add the info to the download page.

Joplin is currently available via IzzyOnDroid F-Droid Repo that serves

official binaries built by the original application developers, taken from their resp. repositories.

@laurent22 you probably ought to get in touch with @IzzySoft first, as his repo is still not part of the official F-Droid repo list.

[IzzySoft]

as his repo is still not part of the official F-Droid repo list.

And won't ever be (at least it's very unlikely). As for Joplin: GMS, Firebase and Firebase Analytics are show-stoppers for the official repo (and in this amount, being 3 proprietary libraries which at the same time count as "trackers", already very border-line for mine).

So I'd strongly recommend getting rid of those 3. That's a requirement for getting the app into the official repo – and for mine I'd very much appreciate if at least Firebase Analytics would be gone.

[laurent22]

@IzzySoft, Firebase was removed in last release, and GMS I think is still needed for notifications. I'll try to remove it though and see if they still work.

[IzzySoft]

Firebase was removed in last release

You sure? Then what APK did my updater pick from here? For Version 1.0.235 (2019-01-19), my library scanner (see results at my repo) still reports Firebase as well as Firebase Analytics.

GMS I think is still needed for notifications

Yes, thought so. Alternatives to that take a bit more work maybe (though e.g. Tutanota found a way).

I'll try to remove it though and see if they still work.

Great, thanks! If really all can be removed, that would make your app eligible for the official repo even. Looking forward to that! 🤞

[laurent22]

You sure?

Hmm, well everything related to Firebase was removed in this commit and I can't find anything that might be referencing it directly. Maybe it's still pulled by another package. I'll check as I don't like having Analytics packages in the app.

[IzzySoft]

Might be relevant that the APK I've scanned comes from the joplin-android repository?

[laurent22]

The versions on joplin-android are the most recent ones, so they shouldn't have the Firebase package normally.

[IzzySoft]

Just let me know when I should check again. As soon as you add a new tag with an APK attached to it, my updater fetches that within 24h, so you can even check it at my repo then.

Thanks for caring! :+1:

[IzzySoft]

Just reporting back: Yes, the latest version (from today) got rid of Firebase! Thanks! :heart:

For the "official repository" now only GMS is the show-stopper. If you got that tackled (or have a build flavor without it), please let me know and I'll check how I can help you bringing it over (if you wish).

Thanks again!!!

[servingworlds]

Much thanks for Joplin! I use it on all my devices save one for work due to closed source gms

Not a dev but I am amazed by what you do, and apologies for asking for something I don't truly understand in depth however: Would you be able to spoof to use unifiednlp in a parallel all-libre release?

Again, asking only to learn more and in hopes I can put Joplin on my work device as well.

Thanks again for Joplin

[laurent22]

@servingworlds, I'm not familiar with UnifiedNlp, what does it do?

[IzzySoft]

@laurent22 It's part of microG, an open source replacement for most of Google Services, mapping their API calls to alternatives (e.g. a call to Google Maps would return an OSM tile) – and some other calls (Analytics etc) to /dev/null. You can install it on devices/ROMs that do not have GApps installed.

UnifiedNlp itself also has a variant you can install along with GApps. It's a modularized location service, several backends exist to provide location based on OpenCellID, Mozilla or other data.

No idea what this got to do with Joplin, though…

[servingworlds]

I only have a layman's understanding, but thought it might help Laurent remove reliance on gms in Joplin.

[IzzySoft]

@servingworlds unfortunately not I'm afraid. AFAIK it only maps calls from apps using GMS to work on devices without GApps (i.e. it exposes the same interface those apps would expect from GMS). I'm not aware of "client libraries" specifically tailored to use microG instead of GMS. I might have missed that – but I'd wonder.

[Andrewskiz]

Which features are dependent on GMS? Could the app be compiled without it?

[IzzySoft]

Going by the permissions (see here in my repo), it uses GCM (Google Cloud Messaging) – and it wants to check its license with Google (no idea why a non-paid version would need that – and no idea why a text editor needs cloud messages – but a good guess for the latter would be the sync stuff, to trigger it when new data is available "upstream").

[trymeouteh]

If F-Droid is not gonna work out I would like to suggest making the APK notify the user with a notification when a new version of the app is available by having the app check github for any new releases. The NewPipe app does this and it works well as a method to notify users of a new version.

[IzzySoft]

@trymeouteh cannot hurt. Though as pointed out, users can include my repo and then would get notified about updates – which hit my repo within 24h of your publishing them here. So the easiest "fix" would be mentioning this in the readme here :wink:

As long as Joplin includes proprietary components (like GCM/FCM), it won't be accepted for the main repo. So if it depends on those, it won't ever. If it's just for a feature the app can do without, a build variant coming without them would make it acceptable for F-Droid again.

[lord-aerion]

I'm constantly looking for replacements for services currently hosted with corporate providers, and Joplin is yet another successful milestone in this quest.

Having zero reliance on Google, and being able to download Joplin from F-Droid would be ideal. Sadly the reliance on Google's services for notifications hinders the adoption of alternative platforms such as Sailfish OS, even when many Android apps can run on it.

I'm not a developer, so please excuse my ignorance, but could Parser Server replace FCM/GMS? If yes, would that make it possible to include Joplin in the F-Droid repos?

@laurent22 referred to a discontinued alternative to Firebase in an earlier comment, which I assume is Parse, but Parse Server is a fully open source project under active development, with many supported SDKs.

[IzzySoft]

@lord-aerion I agree that FCM/GCM is a hinderance and needs to be replaced/removed. As for having Joplin available via F-Droid, see my previous comment and its first link: if you add my repo to the F-Droid clients configuration, you'll find Joplin there.

[lord-aerion]

@IzzySoft Yes, I did that yesterday, and it's working perfectly, so thanks for maintaining that repo.

What I meant to say was that it would be ideal to have Joplin in the official F-Droid repos, unencumbered by Google services.

The reliance on Firebase by many apps is a major obstacle in trying to go Google free, whether that's through custom Android ROMs with MicroG, or through Sailfish OS. So close, yet so far…

[IzzySoft]

it's working perfectly, so thanks for maintaining that repo.

Glad to read – and glad to do! Now also screenshots should show up in the client :smiley:

What I meant to say was that it would be ideal to have Joplin in the official F-Droid repos, unencumbered by Google services.

Amen to that! And to the paragraph following it…

[FreddieOliveira]

Why isn't Joplin in F-droid already?

[IzzySoft]

Let me guess, @FreddieOliveira: because it depends on GMS, and proprietary elements are not allowed in F-Droid? So it is in my repo.

[laurent22]

If someone really wants an F-Droid version, I think the only way would be for them to maintain a GMS-free version in a separate fork, which would basically have the notifications disabled. I've looked a bit into it and it's not impossible to remove this part, but it is significant extra maintenance.