[FEATURE]: F-Droid and IzzyOnDroid Publication

[fast4x]

🚀 Feature Description

Started publication on F-Droid

💭 Problem/Motivation

Started publication on F-Droid

💡 Proposed Solution

Started publication on F-Droid

🔄 Alternatives Considered

Started publication on F-Droid

📋 Additional Context

Started publication on F-Droid

[fast4x]

If you want look here https://gitlab.com/fdroid/fdroiddata/-/merge_requests/32150

[fast4x]

@IzzySoft can add also RiPlay on your repo?

[IzzySoft]

Oh, it's back with a new name 🤩 Let's check…

• android.permission.QUERY_ALL_PACKAGES is needed for what?
• hm, Bush Translator. Will mean NonFreeNet
• update checker? Is that opt-in? And does it inform about the implications of getting updates from… err, where does it check?
• vcsInfo.include = false: why? We'd suggest to include that. Helps fixing failed RBs when they happen – and sometimes even helps preventing them.

I've tried to build, which succeeded – but the resulting APK differs. As you disabled vcsInfo, I cannot tell if your APK was maybe built from a different commit (and more specifically, from which); but differences suggest as much:

diff.zip

I've excluded the diff of resources.arsc here for reasons you might guess; let's see if putting those details into environment variables does the trick there. If that works out, we'd "encode" that step in our recipe. Err… What?!? Ooof, I've just looked up your MR you linked above. Guess you need new API keys now? 🤦‍♂️ OK, guess I could have included the resources.arsc diff here then, if someone else already leaked that – oh my…

OK, it did not do the trick. If you'd tell me how to inject those (i.e. where to declare them properly: environment variable, local.properties, whatever), I could give it another try. And no, we don't put such things into the clear; they are easy enough to extract, but that doesn't mean they should be "advertised". We'd at least "camouflage" them (using base64).

Your turn to say now – which ever way you prefer. I see in that MR you plan to drop the keys altogether; that would work as well, of course. Just let me know what it will be, when it's ready 😉

[fast4x]

Hi @IzzySoft, you are top!!!

• android.permission.QUERY_ALL_PACKAGES is required by FastShare function, to list all installed application when you want to share in direct mode. Works like this: list all app, select one, save it in external application db table. Now this app can be called with direct share bypassing share to...
• Bush translator, same in abandoned RiMusic project
• update checker, is disabled for fdroid build
• vcsInfo.include = false, i remeber that in old RiMusic was disabled. I'll enable.
• related to all api keys or strings as resources, i want to crypt and obfuscate, so fdroid can mantain all featured excluded check update.

What you think?

Thanks al lot! 🥇

[IzzySoft]

you are top!!!

😊 Thanks!

What you think?

Sounds excellent to me, thanks @fast4x!

• permission: makes totally sense, thanks!
• Bush: thought so, just wanted to make sure
• update checker: thanks!
• vcsInfo: ah, that's why. Yes, safe to enable it then – back then, the F-Droid docs had the phrasing weird. I know they prefer it off and why – but that's something for the fdroidserver team to fix. If you make sure to "always build release APKs from a clean tree at the commit the release tag points to" (quoted from the "first basic rule" in our RB Hints for Developers), they won't have any issue with this, as the underlying problem won't come up.
• keys: sure, if you get that working, and it wouldn't require "special treatment" in the build recipe, even better! As pointed out: our policy at IzzyOnDroid slightly differs in that regard. We'd also never "dox" your keys by publicly quoting them in the clear – but well, 💩 can happen to the best of us… 🙈

[fast4x]

Confirmed, new version released and changed merge request to fdroid on gitlab repo.

What's changed:

• Disabled update checker
• Enabled vcsInfo
• All api keys required now are crypted, so fdroid version and full version have same features without update checker. Keys are decrypted in memory using masterKey.

[IzzySoft]

All api keys required now are crypted

well, that didn't work out:

       ENTRY [id=0x7f120000, key='AudioTagInfo_API_KEY']
-        VALUE: 'Tr.....Z'
+        VALUE: ''
       ENTRY [id=0x7f120001, key='RiPlay_DISCORD_APPLICATION_ID']

(output sanitized to not dox your keys) our build does not have them. Not a problem for us, as long as the keys don't change (as by now we have them, and apply a sed to your build.gradle.kts accordingly) – but F-Droid will refuse.

Well, but turns out, for what reason ever, our sed (sed -r 's/"\$\{props\["AudioTagInfo_API_KEY"\]\}"/"Tr…/' -i composeApp/build.gradle.kts) didn't do the trick either – the diff remains the very same. So we'd need at least to know where to put the keys, so they're recognized properly.

Oh, and btw, the logging of your build process is quite very verbose. As for RB, we'd need to keep the logs as proof in our Git repo, it would be good to have that … well, a bit less verbose, for release builds. Maybe via some command line switch?

[fast4x]

On my development environment, the apikey is valued. However, this API is not mandatory because it can be replaced with a personal one by registering on the provider's website and add it in the app settings.

Log verbose changed to only warn and error.

One question, the fdroid merge metadata is up to date and the pipeline is ok. Even though everything is ok, the merge is not done and I have no news.
Is this normal?

Ah I set up the FDroid build without comparison with the original apk, this way FDroid can build it independently.

Thank you

[IzzySoft]

I cannot speak for F-Droid here. But for RB in general, resulting APKs need to be byte identical – so if your build includes API keys, so must ours. F-Droid won't accept that, we do. So if you wish to include them, you cannot have RB with F-Droid – but you can with us.

(apologies for the delayed response, still in "FOSDEM lag mode" 🙈)

[fast4x]

Sorry, you are right, i must include key, sorry.

[IzzySoft]

No prob for us, as pointed out. Just F-Droid won't like it.

[fast4x]

Added required keys in the gradle.properties, next push to repo