proprietary dependencies

[IzzySoft]

According to my library scanner, the APK provided at releases comes with several proprietary dependencies:

• Android Vision (/com/google/android/gms/vision)
• Google Mobile Services (/com/google/android/gms)
• Firebase (/com/google/firebase)

What are those needed for? Could they maybe be replaced by FOSS pendants? My guesses are:

• Vision is used for some barcode/QR-Code tasks (and thus could possibly be replaced by one of the many FOSS libs for barcode/QR-Code handling)
• GMS is just dragged in by Vision, and would thus "magically disappear" as side-effect of replacing Vision
• Firebase: as I see no C2DM permission, this is either dragged in by Vision as well, or the app uses the Firebase database, which then might need a replacement as well

Any chances of making the app "really FOSS"? Thanks in advance!

[Mas7erMind]

Hello, thanks for your feedback, you mention very interesting points. We'll definitely work on making our app FOSS-compliant.

[IzzySoft]

Superb, thanks! Wishing good and easy progress then. If you wish a rescan, just let me know. OTOH, I can also make my scanner available to you, it's FOSS as well.

[Mas7erMind]

Ah now I remember where I saw you... at F-Droid! :)

We use the following lib in the app for QR Code features: com.github.KingsMentor:MobileVisionBarcodeScanner:2.0.0 From what I can see, it's under MIT licence... isn't that FOSS compliant?

Also, I think the F-droid bot would still not allow our application, since we need the xlarig mining binaries and they are being flagged...

[IzzySoft]

Ah now I remember where I saw you... at F-Droid! :)

Yes, I'm one of the maintainers there 😄

isn't that FOSS compliant?

No, as it uses non-free dependencies. Android Vision itself (used by that library) is proprietary, and drags in even more proprietary things (like GMS – see my initial comment; note its package name: com.google.android.gms.vision). Google often plays such tricks; e.g. their play-services-oss-licenses ships as Apache-2.0 to lure you in, but then requires GMS which again is proprietary. You don't imagine how many devs fall for that and never even notice.

Also, I think the F-droid bot would still not allow our application, since we need the xlarig mining binaries and they are being flagged...

Certainly. Does that stop you from improving, just because you cannot get "high enough"? 😉 If you need some encouragement to try still: do you remember I'm also running my own repo, where inclusion criteria are a little less strict? With the 3 above mentioned things fixed, I could let it in – though we should clarify what license those xlarig binaries come under (I cannot remember all the details, and you didn't give a link).

[Mas7erMind]

Ok, thanks for the clarification. No, it's important for us to use open-source libs when possible. But I would have liked to get listed on F-Droid though, since Play Store won't allow crypto mining application, that's why I was a bit disappointed to see our mining libs being flagged... :( But Xlalib is open-source as well and licensed as GNU GPL: https://github.com/scala-network/XLArig. Let me know what you think? Is F-Droid possible, or maybe your own repo, that'd be nice :)

[IzzySoft]

My repo should certainly be easier to reach. The only rule "broken" in its current state is "monetary stuff must not have any trackers". With XLArig being GPL, and my scanner not complaining on components it might "drag in", that would be acceptable there. That way your app would at least be available using the F-Droid client – and thus a first step done. From there on we can still see tackling the issue with that "blob" and how to get it solved, so finally the app can reach the F-Droid.org repo itself.