F-droid availability? #7
Comments
|
I have no idea how to do this (someone else did this with my old fork). I'll do this whenever I find the time, unless someone else wants to do this... 😅 |
|
@polymorphicshade inclusion was just requested with my repo. I'm fine with adding it, but have a few questions a.o. from my scanner reports, so let me copy those over here for you: Top-down:
SigningBlock: I guess Android Studio (or IntelliJ IDEA) is used for signing? In that case, the following should be integrated with android {
dependenciesInfo {
// Disables dependency metadata when building APKs.
includeInApk = false
// Disables dependency metadata when building Android App Bundles.
includeInBundle = false
}
}For some background: that BLOB is supposed to be just a binary representation of your app's dependency tree. But as it's encrypted with a public key belonging to Google, only Google can read it – and nobody else can even verify what it contains. The entire Fastlane tree is untouched from NewPipe. Could it please be updated to match the app? Especially some screenshots would be good to have, and the proper shortdesc/fulldesc. Thanks for checking (and implementing what's needed 😉) |
|
The one asking the user to confirm? Fine, then I can remove the
Yeah, that's what the permission
Vanilla NewPipe is not in my repo, so I cannot tell. But with the latest updates to my APK checks those permissions turn up "red" as being sensitive, unless an explanation is added what for they are necessary. I have no issues with
Thanks a lot! |
Yes, Newpipe has a floating mini-player. Btw, I'm sure you @IzzySoft are aware that @polymorphicshade did have another Newpipe fork based on the previous Newpipe version in your repo (org.polymorphicshade.newpipe). Since this one is basically an updated version of this fork and the other one is out-of-development (https://github.com/polymorphicshade/NewPipe), consider removing the old fork from the repo :) |
|
@ColorfulShire thanks! And yes, I'm aware of that – and yes again, it's already "marked for removal" here. I'll just need to prepare the transition (was busy with other things), like adding a comment to the description of the "old one" that it's continued as "new one", to give those currently using that a chance to find there way "over". |
|
Thanks, added them all to the allow-list here then:
As for the signing BLOB, please see above. Easy to get rid of that – which would also remove it from the screenshot. Err, from where the screenshot was taken from of course… |
@IzzySoft seems the actual app name went MIA, it currently reads:
Major cliffhanger! 😄 Also, might I suggest putting the note above the regular description instead of below? Most F-Droid clients don't show the full description of an app until you tap a Read more button, which someone who is already using the app and just trying to find out if there are updates isn't likely to do. |
|
@kaoneko thanks for the pointers! Fixed both, should go live within the next half hour. |
|
Hmpf, one more thing:
What is this? Someone complained to me:
That's violating the inclusion criteria concerning self-updaters. Those must be strictly opt-in, with all details explained – as such side-loaded updates bypass the scans performed by the repo (F-Droid's and mine). Can you please remove that? |
|
So no word, @polymorphicshade? You're still there? |
OH! Sorry... I acknowledged your comment with a thumbs-up, not realizing that wasn't enough 😅 |
|
np – and thanks for the explicit statement. I must admit I saw 4 thumbs when I first checked, but didn't check whom they came from 🙈 |
|
TeamNewPipe/NewPipe#10785 (comment) | TeamNewPipe/NewPipe#10790 @polymorphicshade This is already fixed in upstream for upcoming vv0.27.0 |
|
Requested at F-Droid: https://gitlab.com/fdroid/rfp/-/issues/2707 |
|
Why closed? Official F-Droid repo inclusion not planned? @polymorphicshade |
It is on F-Droid under the IzzyOnDroid repo. |
|
Yes. I assume originally the issue was created for official F-Droid repo. I've requested for packaging at F-Droid. So I'm asking if you intend to publish there or no interest for it. |
|
@shuvashish76 oh! I understand what you're saying now. |
|
@licaon-kter & @eighthave from F-Droid team working on it do have a look on #52 Thanks. |
|
@shuvashish76 I recently pushed a fix to master that should fix that Git clone issue they mention (hopefully...) |
And what solution did the two find? That issue is closed with no reference to a solution.
Ah, you found it yourself? Glad to read it's solved then! And of course Tubular is welcome to stay in the IzzyOnDroid repo if you want it to.
Deal with what? |
I couldn't even clone the repo locally, since there's some olden corruption or whatever :(
but indeed, now it is fixed 🎉
There's no Izzy repo unless you add it. this issue was closed because of a misunderstanding I guess?! the OP asks for the app being built by f-droid.org (like NewPipe is built too) Will take a look asap, now that we can clone :) |
Yes, that was described. I was wondering about the solution. Meanwhile I know it: @obfusk has provided a fix, see #60 – as that's implemented, you should now be able to clone.
Yupp 😃 |
Being unable to clone was because of a file with wrong mode bits (see #60 for my explanation). There was never any kind of corruption; you mistook a transient network error ("fetch-pack: unexpected disconnect while reading sideband packet") for an fsck failure. |
|
@polymorphicshade any updates? |
|
This draft recipe metadata/org.polymorphicshade.tubular.yml builds, but it's not build reproducible (ref: https://f-droid.org/docs/Inclusion_How-To/#reproducible-builds) difflog: tub999.log was the APK in https://github.com/polymorphicshade/Tubular/releases/tag/v0.27.2 built from c276531 ? Or maybe from some local dirty tree? |
|
what is the reason that release.yml could build the apk but f-droid reproducible build cannot? Tubular/.github/workflows/release.yml Lines 23 to 55 in c276531 |
|
Not sure I follow. As said, F-Droid can build it just fine. But, as you can read in the attached log, there are differences compared to the released tagged apk. Somebody familiar with the codebase can read and maybe figure out why this happens. |
|
It looks like a commit updating the Hebrew locale hasn't been pushed. |
|
It's RB at IzzyOnDroid btw. Both last versions, as you can see:
Green shield = verified. See here for details on the shields. |
|
OK, so interesting, 0.27.1 has the same issue, same affected files, IW translation If we dissemble and compare the Tubular 0.27.2 IW vs HE from the release page https://github.com/polymorphicshade/Tubular/releases/tag/v0.27.2 comparing this with Newpipe 0.27.2 IW vs HE (this is reproducible in F-Droid) Did you change the way IW strings are generated compared to NewPipe? compare with my local builds of Tubular 0.27.2 IW ...which seem to match sizes to those of NewPipe Can somebody speaking IW confirm that the Github/Izzy APK shows all the strings ok and compare with NewPipe? |
|
So looks like the issue is symlinks treatment, looking at the comment above #7 (comment) and doing that and now it's repro two issues here:
|
|
https://github.com/polymorphicshade/Tubular/blob/master/app/src/main/res/values-iw |
|
NewPipe isn't built on Windows or with Back in February, I just did Before #60 was fixed I used the same workaround as the CI still does -- My recommendation would be to stop building with |
|
As Youtube breaks the app so often, do you also consider setting up your own F-Droid repository so people can add it? |
|
An alternative to this is IzzyOnDroid (since he doesn't build the apps himself, but takes the APKs from GitHub and co) or Obtainium. |
|
@rugk scroll up a little, it is already available at IzzyOnDroid: https://apt.izzysoft.de/packages/org.polymorphicshade.tubular 😉 |
|
Sure, but I don't want to include that as it contains many unrelated apps and I basically just want an up-to-date NewPipe fork here. Officially from the devs is another plus (although I trust @IzzySoft of course, but you know). |
thanks 😍
No, luckily we do not depend on F-Droid builds. We couldn't provide the timely updates then 🙈 and that would be a problem with things like…
right? So IzzyOnDroid takes the APKs signed by the devs your trust, and ships those – but not before having scanned them left and right, see Ramping up security: additional APK checks are in place with the IzzyOnDroid repo.
Ah. You mean it's only quality if a certain person or org builds? Or did you mean something like… Reproducible Builds, special client support and more in our repo maybe? More than 20% of the apps at IoD are covered by RB meanwhile, and that number is still increasing. And Tubular is one of those RB apps. So one of our verification builders built it from source (in this case it was Fay's, see above). There will probably soon be a verification builder verificator, if you want to call it that – one that runs all the recipes from the existing builders to see if it can reproduce their verification… So the only point left from your wishlist, @rugk, is to want a bunch of "1 app only repos". Which then lack all the extra checks (and extra trust). Those are pretty good for development of course, to provide test builds to team and testers. But it also puts extra work on the shoulders of the dev team, which then has to maintain that repo as well… |
|
Yeah nothing against your repo, but my point stays, that I don't want my F-Droid cluttered with apps I do not need, which may or may not be (fully) open-source and whatever they may be scanned or nor, it's more about tracking issues (yeah you may also scan that, and we have exodus for that, but really, if I were to install such apps, I could use Google Play/Aurora Store) and that the app comes from the devs itself. It was mostly inspired by the old Newpipe thing, which was convenient and I thought F-Droid also had https://f-droid.org/repomaker/ for setting up such a repo relatively simple. |
|
With latest F-Droid, one can choose the repo source for the app, per app. One can as well select which repo to pick by default by the order of the repos in the settings, the repo listed first with the app available will be the on picked by default. So with current F-Droid there are several options to select packages from multiple repositories, particularly if one prefers packages from one over the other. Some prefer apks signed by the developer (IzzyOnDroid does this for us), some prefer to have apks from official F-Droid repo if possible, and some other would prefer the most up to date packages. For the latest, IzsyOnDroid is pretty close to the latest release on the developer releases, so that's a great option to grab latest, and still using F-Droid instead of grabbing the apk directly from the developer releases, and if not wanting the rest of the packages, keep IzzyOnDroid after the official F-Droid repo in the list of repos, or even place it as the last one, and when searching for apps, make sure to select them from other repos... I really see no need for additional repos, if unofficial ones like IzzyOnDroid grab the apks pretty close to their developers release. I still like for most apps to have the option between the official F-Droid repo, which might not be as up to date, but is built and signed by the F-Droid folks, and the IzzyOnDroid one, or other alternatives if available. BTW, newPipe is a good example of a multi-repo app. When you search for it (I don't have it installed, since I prefer Tubular), and you select it, you'll see in the repositories field: The only down side of multiple repos as of now, is that the more amount of packages from the repo, the longer it takes for the F-Droid app to update the metadata for each repo, jeje. |
Google Play/Aurora Store doesn't allow developers to sign their own apps any more. And they certainly don't have a way to check the provided APK matches the source code. Or have any kind of checks for non-free or tracking libraries like IzzyOnDroid does. With Reproducible Builds, both IzzyOnDroid and F-Droid provide the exact same APK the developer does, verified to correspond to the published source code, with additional checks (IzzyOnDroid has several checks F-Droid doesn't, and vice versa). And IzzyOnDroid updates faster, which as you yourself pointed out is very useful for apps like Tubular :) Edit: and any non-free components in IzzyOnDroid are clearly labelled with anti-features. |
Checklist
Feature description
Great to se the new app. I hope that the new app will be on f-droid. Maybe it's even in the pipeline due to the delay in f-droid, but it would be nice to know if it's planned to be there.
Why do you want this feature?
.
Additional information
No response
The text was updated successfully, but these errors were encountered: