Signal calls closed-source GMS libs for utility functions

[tw-hx]

• [x] I have searched open and closed issues for duplicates
• [ ] I am submitting a bug report for existing functionality that does not work as intended
• [x] I have read https://github.com/signalapp/Signal-Android/wiki/Submitting-useful-bug-reports
• [x] This isn't a feature request or a discussion topic

---

Bug description

Searching through Signal's source for GMS references: https://github.com/signalapp/Signal-Android/search?p=2&q=gms.&unscoped_q=gms. shows multiple instances where Play Services code is used as intended for push messaging and map features, but also calls to generic GMS utility functions. This is holding back eventual inclusion of Signal-signed reproducible builds in F-Droid #9044.

Steps to reproduce

• Click above link to view GMS dependencies in Signal source

Actual result: Signal calls presumably closed source code for utility functions, relative to "app/src/main/java/org/thoughtcrime/securesms/" they are:

• stickers/StickerUrl.java calls com.google.android.gms.common.util.Hex
• stickers/StickerPackPreviewRepository.java calls com.google.android.gms.common.util.Hex
• profiles/edit/EditProfileFragment.java calls com.google.android.gms.common.util.IOUtils
• database/RecipientDatabase.java calls com.google.android.gms.common.util.ArrayUtils

Expected result: These should be replaced by standard Java equivalents, so Signal is as open-source as possible. Ideally the website release should be able to build without any Google libs at all but this is a good first step :). Thanks!

[johanw666]

That is not a bug but a feature request.

I suggest telling F-Droid people to be less fundamentalistic about what libraries are called by software in repositories, but I'm affraid that will probably have about the same chance on success as this request because it results in more battery consumption for people with Play Services on their device.

[greyson-signal]

Hi there, thanks for the suggestions, but we try to only use Github as a bug tracker. But feel free to discuss this on the forums. Thanks!

[tw-hx]

An easy fix for another proprietary GMS import (that was newly committed to Signal shortly after this issue was closed above) is in util/concurrent/SignalExecutors.java which now imports com.google.android.gms.common.util.concurrent.NumberedThreadFactory

NumberedThreadFactory is both imported at the top from GMS and declared as a class at the bottom of the file. Removing:

import com.google.android.gms.common.util.concurrent.NumberedThreadFactory;

and compiling Signal 4.60.3 works and the APK runs fine, so that line appears a superfluous import.

Here are links to other usage of GMS code not required for GCM/Maps or similar as of today:

• Sticker packs: https://github.com/signalapp/Signal-Android/blob/0ef01cc620cc907da6078c93cc97d31e6612b3f3/app/src/main/java/org/thoughtcrime/securesms/stickers/StickerRemoteUriFetcher.java#L35 https://github.com/signalapp/Signal-Android/blob/0ef01cc620cc907da6078c93cc97d31e6612b3f3/app/src/main/java/org/thoughtcrime/securesms/stickers/StickerUrl.java#L73 https://github.com/signalapp/Signal-Android/blob/2a644437fbb2121e3ad2b767331c3096eb97095b/src/org/thoughtcrime/securesms/stickers/StickerPackPreviewRepository.java#L84

• Profile editing: https://github.com/signalapp/Signal-Android/blob/b917cccbeeb7b0e84644b10d2c70a39a7ea0963c/app/src/main/java/org/thoughtcrime/securesms/profiles/edit/EditProfileFragment.java#L176

• Recipient database management: https://github.com/signalapp/Signal-Android/blob/b917cccbeeb7b0e84644b10d2c70a39a7ea0963c/app/src/main/java/org/thoughtcrime/securesms/database/RecipientDatabase.java#L127

Thanks, Greyson, if you have time to look into replacing these in the future!