SimpMusic
SimpMusic copied to clipboard
maxrave-dev
Proprietary libraries added?
Looks like v0.1.5 added several proprietary libraries: Google Cast, GMS, Firebase… They will be show-stoppers for F-Droid, and thus this update never reach the repo there. Maybe you'd consider a libre build flavor without those?
fyi https://gitlab.com/fdroid/fdroiddata/-/commit/096b2f6f08ceebeb028c0995c397f54fa53734dd
I dont know why firebase is added but may be if I want to make sure this app always at Fdroid, I mustn't implement Cast function?
I dont know why firebase is added
Just take a look at the dependencies of Cast, which I guess is the main culprit here. Cast drags in GMS, which brings Firebase along AFAIK. But even without Firebase, the other two are show-stoppers for F-Droid as both are proprietary by themselves.
I'm not sure if a pure FOSS replacement for Cast exists – I cannot find anything in my library definitions. But a quick search here on Github brings up e.g. Live-TV-Cast-App-MVP which states to support Google Cast enabled devices and shows no dependency on Google's SDK in its build.gradle (it's Kotlin as your project). Similar with airplay_dlna_googlecast, though that's not Kotlin but might still give some pointers.
https://github.com/maxrave-dev/SimpMusic/blob/v0.1.5/app/build.gradle.kts#L77 -> https://github.com/androidx/media/blob/1.1.1/libraries/cast/build.gradle#L17 -> https://mvnrepository.com/artifact/com.google.android.gms/play-services-cast-framework/21.3.0 aka non-FOSS :(
Please let this great music app a "vanilla" music app...no one needs Cast or any Google crap in this project
I dont know why firebase is added
Just take a look at the dependencies of Cast, which I guess is the main culprit here. Cast drags in GMS, which brings Firebase along AFAIK. But even without Firebase, the other two are show-stoppers for F-Droid as both are proprietary by themselves.
I'm not sure if a pure FOSS replacement for Cast exists – I cannot find anything in my library definitions. But a quick search here on Github brings up e.g. Live-TV-Cast-App-MVP which states to support Google Cast enabled devices and shows no dependency on Google's SDK in its
build.gradle(it's Kotlin as your project). Similar with airplay_dlna_googlecast, though that's not Kotlin but might still give some pointers.
This project has gsm here https://github.com/KAPLANDROID/Live-TV-Cast-App-MVP/blob/4b9df0c914d1f7128aa668f88b789256cf4c69ef/app/build.gradle#L61. Sorry for this problem, so I will remove "cast" in the next build
@DeadSecTr give @maxrave-dev a little time, this is some effort. Taking a look at the releases page for the usual intervals, I'd say something between 2 weeks and a month is realistic, before sending them another "heads-up" – the statement was already made that the next release will take care for it.
@maxrave-dev when you've removed Cast, be welcome to have a pre-release APK checked by me (or use my checker yourself, see e.g. my article Identify modules in apps for details on that). Android Auto (which was added with the last release as well) might be dragging in things as well, I'm not sure what.
Sorry for late, I will push new version without cast library in about one week
Confirming: my library scanner says the offenders are gone. As @licaon-kter only disabled the affected build (the last version), this one will be picked up fine then at F-Droid as well. Thanks!
@licaon-kter @IzzySoft Hi bro, I need to implement Spotify API to my app, by the way, Spotify needs to use some private key of my account. So I need to hide this key from others, I try to find some way to hide and found "Hiding API keys in local.properties file", so if Fdroid builds my apps, how does Fdroid find these hidden keys? Hope you help me
F-Droid does not support secrets, everything needs to be in the open, be it in your source code here or in the fdroid metadata.
Or, you can popup a dialogue asking the user to input their own API key