Ajout d'Olvid sur F-Droid

[ghost]

Bonjour,

Je suis très content de voir qu'Olvid est enfin devenu open-source :)

Pourriez-vous svp l'ajouter sur F-Droid ?

C'est un magasin d'applications alternatif qui regroupe des applications open-source.

Voici un lien pour le faire : https://f-droid.org/en/contribute/

Cela permettrait notamment de pouvoir obtenir Olvid sans passer par le Google Play Store.

[finiasz]

Oui, nous comptons le faire, mais il y a encore un peu de travail pour cela ! Si on regarde la page https://f-droid.org/en/docs/Inclusion_Policy/ il y a pas mal de choses en plus de simplement publier le code de l'application :

• faire une version/variante de l'app qui ne référence aucun service Google (en particulier la librairie de billing ou la librairie firebase)
• publier les sources des dépendances compilées : la librairie sqlite-jdbc que nous utilisons est un fork de https://github.com/xerial/sqlite-jdbc pour ajouter le support de quelques pragma et ne pas inclure les .so sqlite dans le .jar

Bref, nous allons voir quand nous aurons le temps d'avancer sur cela, et après, bien sûr, nous ferons la demande pour être inclus sur F-Droid.

[ghost]

D'accord, merci
J'espère que cela pourra se faire assez rapidement !

[kumy]

While still working on having it officially included in F-droid, maybe you could check with @IzzySoft to have builds hosted there or create your own f-droid repository?

Also if you could attach OSS builds on Github releases, that would be awesome! (And a requirement to get included in IzzySoft)

• https://android.izzysoft.de/
• https://gitlab.com/IzzyOnDroid/repo/#what-are-the-requirements-an-app-must-meet-to-be-included-with-the-repo

I've also created an issue here: https://gitlab.com/IzzyOnDroid/repo/-/issues/221

[IzzySoft]

If you do, please first take care for these:

Offending libs:
---------------
* BillingClient (/com/android/billingclient): NonFreeDep,NonFreeNet
* Firebase Data Transport (/com/google/android/datatransport): NonFreeNet
* Google Mobile Services (/com/google/android/gms): NonFreeDep
* Google API Client Libraries (/com/google/api/client): NonFreeNet
* Firebase (/com/google/firebase): NonFreeNet,NonFreeDep
* Google Drive API (/com/google/api/services/drive): NonFreeDep,NonFreeNet

6 offenders.

which currently taint your app, making it non-FOSS (those libs are "free" like "free beer", but not libre). Then, I could take a per-ABI build into my repo (or one that covers both ARM archs but leaves out the x86 ones, for size reasons – the current APK size is already hard at the limit of 30M).

[finiasz]

Thanks @IzzySoft for listing these. We currently have some high priority taks in our roadmap we need to focus on, but we will try building a flavor of the app that does not include these libs. Also, regarding the size of the apk, the next release of Olvid will be integrating the new emoji2 lib from AndroidX, with a bundled font: this will probably increase the size of the apk by quite a lot (my current all archs apk sits at 39MB)!

[IzzySoft]

@finiasz all at your schedule, of course. As the Debian folks use to say: "It's ready when it's ready". Thanks for taking care! With an overall size of almost 40M (see @kumy – that's what I meant with "size won't decrease"). If you want to go straight for F-Droid, there is no "technical size issue". But if you want to start with a test-drive via my repo, I'd definitely need per-ABI builds then (and would pick the ARMv7 one as it covers the most devices); each of them will then probably be around 20..25M with the new library I guess…

[rzr]

Related-to: https://reports.exodus-privacy.eu.org/en/reports/search/io.olvid.messenger/

[finiasz]

Well, in part related only :) The tracker found by exodus is a false positive. The OpenTelemetry tracker found is a dependency of the Google Drive library, but is not used as a tracker by this library.

But indeed, the Google Drive library has to be removed for F-Droid.

[BaptisteRichard]

Gentle bump here, as I'm really looking forward to using Olvid once it's entirely free of google libraries :)

[Poussinou]

Could you please in the meantime attach a signed release APK to your releases so that people without Play Store can still download, use and update your app easily?

[rzr]

May we create an other issue to make "offenders" optional at build time then a new ticket could be created at f-droid tracker ?

https://gitlab.com/IzzyOnDroid/repo/-/issues/221

[finiasz]

The latest release contains a new "nogoogle" flavor which should remove most offenders. If there are still some, please let us know in this thread!

[IzzySoft]

I cannot verify as no (signed release) APKs are attached to that release (see #3 and #6). If you let me know once they're available, I gladly take another look.

[Morse6690]

Hi Devs. Just wondering if there was any further news on this one?

[finiasz]

Hi, I spent some more time checking the feasibility. The nogoogle flavor of the app should be compatible in terms of licence and dependencies and the app build process seems to work in the gitlab CI. However, publishing the app on F-Droid requires rebuilding everything from source inside the CI, including WebRTC and sqlite-JDBC (which has .so libraries that are not accepted by the CI when bundled in the app source code).

We unfortunately do not have time to work on this at the moment, but the topic is not closed! We still want to publish our app on F-Droid some day.

[Neustradamus]

To follow this ticket.

[sbernard31]

@finiasz where it seems there is still a lot of works to be available in official F-Droid Repository, any chances to fallback on other short/mid term solutions ?

1) Providing your own repository (compatible with F-Droid clients)

The molly app do that.

See molly repo :

• https://molly.im/download/fdroid/
• https://github.com/mollyim/fdroid
• https://molly.im/fdroid/

I don't know how this kind of repo is created maybe using : https://f-droid.org/repomaker/ from f-droid ?
Or maybe you can ask to molly project (https://github.com/mollyim/mollyim-android) ?

2) Be compatible with Obtanium

Maybe even easier to setup and also more secure alternative could be to provide a way to install/update using Obtainium.

See : https://github.com/ImranR98/Obtainium/wiki

3) The alternative for the future ? accrescent

F-droid has some security drawback, see :

• https://privsec.dev/posts/android/f-droid-security-issues/
• https://www.privacyguides.org/fr/android/obtaining-apps/#f-droid

Probably too soon but a lot are pushing accrescent as a real secure alternative for the future :

• https://x.com/GrapheneOS/status/1783278906658746581
• https://privsec.dev/posts/android/f-droid-security-issues/#looking-to-the-future

---

Not directly linked to Android App but more about Linux App, I didn't find any repository about the Linux App so I ask here.
Please redirect me on corresponding repository if it exists.

So the question, I see there is no way to get automatic update for Linux app : https://olvid.io/faq/comment-installer-olvid/

If you installed Olvid from the tar.gz archive, you simply need to replace the previous installation. We assume you have the possibility to run commands as root using sudo and that Olvid was installed in /opt.

This is not so good for a secure app, so any chance that the app will be available on Flathub ?

[rzr]

Native linux support could be interesting, but it should be a separate ticket, to support rebuild from source

[sbernard31]

Native linux support could be interesting, but it should be a separate ticket, to support rebuild from source

I talked about Desktop application (I don't know if this desktop app is "native"). I agree the issue should be open to the corresponding repository but didn't find any repo about that. If it exist I can create the issue there (edit and remove my previous comment)

OR maybe you say that the Linux app is just the android app + a kind of Android/Linux layer ?

[rzr]

Native linux support could be interesting, but it should be a separate ticket, to support rebuild from source

I talked about Desktop application (I don't know if this desktop app is "native"). I agree the issue should be open to the corresponding repository but didn't find any repo about that. If it exist I can create the issue there (edit and remove my previous comment)

OR maybe you say that the Linux app is just the android app + a kind of Android/Linux layer ?

No idea, I am just a curious person like you

[finiasz]

We have a Linux application available for download on our webpage:

• it is not yet open-source, but will become open-source at some point (when we are ready!)
• it is a native Java + JavaFX app, not a web app or an electron app
• it is not a direct port of the Android application, but it reuses the same cryptographic engine:
  • the obv_engine folder of this repo is used (with a slight modification to allow for local file encryption)
  • the app layer and UI is completely re-implemented in JavaFX with databases using ORMLite

[sbernard31]

Thx @finiasz for clarify that. 🙏

Any comment about : #2 (comment) ?

[finiasz]

Well, not much has changed regarding this.... We still want to build our app for F-Droid, but have not found enough time to focus on this. This is one of many items in our backlog that regularly gets postponed because of more urgent matters.

[IzzySoft]

@finiasz adding a (release-signed) APK to each new release would be a starter not taking too much energy. Whenever you think you've made progress, you could let me know to run the IzzyOnDroid scanners over it then. And should a scan tell it's eligible for inclusion with IoD, I'd do that automatically – so it would be available at the IzzyOnDroid repo already, even should it not (yet) be fully eligible for F-Droid.org.

My offer from 2 years ago still stands 😉

[sbernard31]

adding a (release-signed) APK to each new release would be a starter not taking too much energy.

I think this could also make it works for Obtainium.