Issue #1978: Find a good way to integrate APK from F-Droid
Add the Offline Calendar app by default
By adding this app by default in the ROM we provide, users can create and use a calendar that isn't connected to an email account or "the cloud". https://f-droid.org/en/packages/org.sufficientlysecure.localcalendar/
Updated by Kurtis Hanna 6 months ago
A patch to add F-Droid's build of the Offline Calendar APK was said by adjtm to be fairly trivial to write. He offered to write the patch and submit it. We can all have a discussion if and when that patch gets submitted related to whether we want to apply the patch to 6.0 0004 or not.
There were some disagreements as to whether:
1) This app should be built by Replicant in order to be included
2) F-Droid's APK of the app should be included after Replicant verifies the reproducibility of F-Droid's APK
3) F-Droid's APK of the app should be trusted without verifying that it can be built reproducibly by Replicant.
If anyone wants to discuss the issues above before the patch gets submitted, please feel free to do so here or create a new ticket or other discussion venue that directly relates to the underlying issue of shipping pre-built F-Droid APKs in Replicant Roms.
Updated by Kurtis Hanna 5 months ago
- Target version changed from Replicant 6.0 0005 to Replicant 6.0 0004
There is a patch pending on the mailing list under this thread: https://lists.osuosl.org/pipermail/replicant/2019-October/002158.html
Since it seems like such a simple patch and since it is currently pending, I decided to switch the target version for this to 6.0 0004.
Updated by Denis 'GNUtoo' Carikli 4 months ago
- Target version changed from Replicant 6.0 0004 to Replicant 6.0 0005
While the patch is good, it depends on things that don't work well in Replicant 6.0:
It either require the user to run get-prebuilts (which also require the user to setup gpg to check the apk), or to modify the build system to do it automatically.
F-Droid had exactly the same issues.
F-Droid privilege extension in the other hand has different issues: While the build is done well, as the APK is instead built by Replicant, it is most probably not signed by F-Droid key, which makes it very difficult to upgrade it.Before re-integrating APK from the F-Droid repository we should rather:
- Make the download and gpg verification automatic in some way. We could look into making it happen with repo sync as users (me included) don't expect the Android build system to fetch things during the build phase. We could also ship F-droid gpg keys in the same repository. The scripts could then be converted to help developers to upgrade the APK. It might also be possible to use repo to fetch the APK itself, and ship the gpg key and verification script from our side.
- Handle the fact that the APK could disapear by trying the default repository first, and if none are found, try the F-Droid archive repository.
Not having to run get-prebuilts and setting up gpg manually would simplify a lot the build process. We now even have a wrapper to build Replicant with vendor/replicant/build.sh that removes many (but not all) of the manual steps.