Re: [GNU-linux-libre] [Replicant] Criteria for Android applications

[Denis 'GNUtoo' Carikli]

On Fri, 20 Aug 2021 17:02:22 -0400
Greg Farough via Replicant <replicant@osuosl.org> wrote:

> On Fri, Aug 20 2021, Denis 'GNUtoo' Carikli
> <GNUtoo@cyberdimension.org> wrote:
> 
> > The problematic applications were meant to enable users to download
> > Android applications from Google play. So while they were fully free
> > software, not all the applications from Google play are.
> >
> > And as I understand, we need to not have any of such applications
> > because the guidelines state that "Nor should the distribution
> > refer to third-party repositories that are not committed to only
> > including free software".
> 
> This makes F-Droid's default repository selection a problem, but
> unless I'm missing something it doesn't make the program "F-Droid" a
> problem, provided it can be compiled to include acceptable
> repositories and exclude the problematic ones. Is there a reason
> Replicant doesn't want to just offer their own, better choice of a
> repository? Doing anything else seems like an enormous duplication of
> effort when there's an easier and equally free solution. (Apologies if
> there's an obvious answer to this question.)
Since f-droid and Replicant don't have the exact same criteria for
applications I think that we will need to somehow review applications on
our side too.

So since fixing f-droid is not going to happen right now, I thought it
was a good idea to at least find a way to review applications in order
to point users to known reviewed applications in the mean time.

To fix it our current plan is to modify the f-droid client to filter
out applications that are problematic as per the FSDG. Once this is
been, we'll then have to upstream that feature in a way where it can
be enabled or disabled at compilation time.

This way if that works we would have 0 maintenance on the f-droid
client side as we could then upstream a package definition for that
version with a different build configuration (and branding) so that it
would be automatically built by the f-droid upstream project.

So practically speaking we'd share the upstream repository data and the
f-droid client code but the modified f-droid would not show any
problematic applications, and users could even install both f-droid and
the version with our modification at the same time if they wish to, so
upstream will probably not have any issue with our modifications as it
doesn't affect the stock f-droid.

At the end we'd still have to contribute to the upstream packages
definitions, but it would be a lot less maintenance than if we did our
own repository.

But all that still needs to be implemented. That means that not
only we need to find a way to build f-droid without any nonfree
dependency on an FSDG compliant distribution, but we will also need to
find someone to implement the feature. While we know someone who is
interested in doing that, we still need to setup all the structure to
fund that person and/or someone else to do it.

> > The same question about which criteria to use also applies seems to
> > the FSF free software directory, especially on the page that lists
> > Android applications[1].
> >
> > If we assume that:
> > - All the dependencies of a given applications are free software and
> >   that all the dependencies of the dependencies are also free
> > software.
> > - There is a free Android SDK that can build the application. We
> > still need to look at the SDKs from the android-rebuilds project to
> > see if it works and if it is fully free. Otherwise Replicant 4.2
> > had an SDK that can probably still be used to build some of the
> > applications.
> > - All that runs on a self-hosted FSDG distribution (like Trisquel or
> >   Parabola).
> 
> That all sounds reasonable to me. 
> 
> > If we manage to manually build the application, would it be ok to
> > point to the apk of the application if it was not built in the same
> > way?
> >
> > If we use fdroidserver[6] from Guix, along with a free software
> > Android SDK to build the application, would it be ok to point to the
> > f-droid apk?
> 
> Reproducibility isn't in the scope of the FSDG, so if I'm
> understanding everything correctly, I think that would be fine.
Thanks.

Denis.

pgpSzdxfldmAO.pgp
Description: OpenPGP digital signature