Is this repo open source?

[mnalis]

Hi, I've seen several issues opened in various repositories saying "I'm running a open source repo for Android apps at https://www.openapk.net/ and I am very proud to have [...]"

However, I'm unable to find source for this "open source repo"? Where can I find programs / scripts used to build and maintain the repository at https://www.openapk.net/ ?

Your about page at https://www.openapk.net/about says "We are firm believers in the open-source movement where innovation and transparency form the foundation of developing quality software", however looking at https://github.com/mobilenetworkltd/openapk (at the moment) I seem unable to find any source code (only few images and markdown files).

Could you publish all the open source for this repo please?

[mnalis]

There have been several discussions which seem to be related to this missing source:

• https://github.com/yairm210/Unciv/issues/11938#issuecomment-2219735199
• https://github.com/termux/termux-app/discussions/3972#discussioncomment-9601414
• https://github.com/gokadzev/Musify/issues/386#issuecomment-2139579551
• https://github.com/JellyBookOrg/JellyBook/issues/186#issuecomment-2123858037
• https://github.com/streetcomplete/StreetComplete/issues/5732#issuecomment-2220566064

[mobilenetworkltd]

Hey @mnalis, thanks for your feedback ! Currently OpenAPK is in super early beta to proof a concept, an experiment that we've been thinking about lately. Open sourcing the actual app that runs OpenAPK is the next step in our timeline.

While we work on the "repo", we try to contact some developers and build that relationship and get feedback for future updates.

Calling it a "repo" is still something imaginary, since its not an actual repository yet ! But in the next few month we plan to make it so.

Some of our future goals:

• build a F-Droid compatible repo, usable in actual F-Droid Clients
• build a GitHub managed repo with apps (similar to https://github.com/Botspot/pi-apps/tree/master/apps)
• share some more insights about the actual APK files listed (in terms of certificates, hashes, activities, services, receivers, libs used etc.)

If you can suggest something you would like to see in a future repo like this, its more that welcome !

Cheers, George

[westnordost]

I figured I should rather post this feedback I original wrote in https://github.com/gokadzev/Musify/issues/386 here:

Just linking to GitHub (or other forges, depending on where it is hosted) sounds like an excellent idea, because

• more secure from a user-perspective: users don't need to trust that the apk has not been tampered with. That would be a unique selling point over APKMirror, but even F-Droid (i.e. you must trust F-Droid people to not tamper with it)
• more secure from an architecture perspective: by not hosting these yourself, you pretty much remove yourself from being a juicy target of being hacked by malicious actors that want to inject (all hosted) distribution with their own code.
• more control by app authors: sometimes app authors want/need to pull certain versions of their app from distribution because of critical bugs or security issues. They can remove releases in GitHub. If you don't host the releases yourself, it would automatically also work for OpenAPK
• no issues with licenses. E.g. GPL-licensed apps require the source code to be distributed with each binary distribution. I you just link to the author's original distribution channel, you take yourself out of this equation.
• as far as I can tell, not less stable: Redundancy in hosting the APK is not really necessary, as if for some reason the repository (or Github as a whole) vanishes, there is probably a good reason for it and/or the scripts that pull the releases from GitHub would fail on your side anyway

[mnalis]

Currently OpenAPK is in super early beta to proof a concept, an experiment that we've been thinking about lately. Open sourcing the actual app that runs OpenAPK is the next step in our timeline.

I'd still recommend publishing the source (even if it is not polished, requires better/any documentation, is hardly usable etc.) as an absolutely first thing. Before even opening the website. It is a initial gesture of openness that is crucial. The open source community has been burned too many times by other people/entities promising "they will open source soon", and then have it never happen in the end.

I'm not saying that to imply you're trying to do pull such shenanigans, but just to try to explain why the FOSS community is extremely sensitive to the subject, and why prolonging publishing the source code for any reason is a very bad idea, any why you should publish your source immediately in order to build your reputation.

I'd recommend publishing all source that you have right now, slapping a good copyleft[^1] license on it and adding a README.md noting that it's still rough around the edges and that you're working on polishing it. It's half an hour job at most for such basic release. Trust me, FOSS community will appreciate it much more than "source will come later, we are working on it, trust us" in all cases, no matter what reasons you might think you have for delaying it.

You're already late, but you can still fix it (with little harm done) if you're very quick about open-sourcing it.

[^1]: like AGPL or at least GPL3+. Non-copyleft licenses like MIT / BSD have been abused too many times in the past, by entities publishing something as "open source", and then, when they acquired big enough userbase with that bait, reneging on the deal and re-licensing under proprietary closed source. Which makes FOSS community rage for hopefully obvious reasons.

[mobilenetworkltd]

I'm happy to see we have such a passioned followers ! Really appreciate your suggestions.

@westnordost All the APK download link are directly forwarded to Github, we DO NOT mirror any files ! The repo stars count is updated each time the app has new version. Regarding the old versions, we keep track of previous releases and sync them with your Github repo releases. I will also make sure that we link to the source code zip file (if available) in the release to satisfy the GPL license.

@mnalis thanks for the recommendations, we will setup our website source code repo as soon as possible, in the mean time, feel free to explore the OpenAPK web site source code from your browser. There is nothing to be hidden.

[mnalis]

@mobilenetworkltd I'd recommend reopening the issue and leaving it open until such time when the issue is actually resolved (i.e. source code is published on GitHub -- which, unless I missed it, has not actually happened yet).

That way interested parties can follow the progress, and you avoid new issues with same subject being opened by other users noticing the problem. You'd also come out as more transparent, which is always positive when trying to gain user's trusts.

feel free to explore the OpenAPK web site source code from your browser

Sure, but raw HTML blob is not an actual source code (at least not as Free Software Foundation defines "source code" , i.e. "preferred form of the work for making modifications to it")[^1].

[^1]: Much like e.g. disassembly of ELF executable is not the source code, even if it is readable by programmer, as it is not preferred form. Otherwise, all code would always be "source code"

[mnalis]

@mobilenetworkltd could you share a approximate timeframe where you expect your source code might be released? Are we talking days, weeks, months, years, decades?

Also, could you please reopen this issue now (and close it with a comment when it is "fixed", i.e. when source code is actually released)?