[Bug]: proprietary components added with v1.712

[IzzySoft]

Description

v1.712 arrived at IzzyOnDroid today and had our scanners scream:

• Firebase Data Transport (Utility) NonFreeNet
• Play Services Places Placereport (Map) NonFreeComp,NonFreeNet
• Google Mobile Services (Development Framework) NonFreeComp
• Firebase (Utility) NonFreeNet,NonFreeComp
• BillingClient (Payment) NonFreeComp,NonFreeNet

That renders this app effectively "no longer FOSS". As your release notes give no clue: maybe some dependency dragged those in? Then gradle :app:dependencies might help you find the culprit. Should it OTOH have been intended: maybe you'd consider a FOSS build flavor? For now, at IzzyOnDroid we need to raise the proper anti-features until this is solved:

AntiFeatures:
  NonFreeComp:
    en-US: The app contains Play Services Places Placereport, GMS, Firebase and BillingClient libraries.
    de: Die App enthält Play Services Places Placereport, GMS, Firebase und BillingClient Bibliotheken.
  NonFreeNet:
    en-US: The app uses connections to Google servers (see NonFreeComp).
    de: Die App verwendet Verbindungen zu Google Servern (siehe NonFreeComp).

Minimal Reproduction

n/a

Exception or Error

No response

[ViscousPot]

Ah this is an accidental addition leftover from a temporary build with in app purchases added. Thanks for catching it!

To be honest, this latest release is a deprecation so it doesn't have any features that need to go out to users so I'm not too fussed about the latest release not going through.

However, the new version of the app that is being worked on, will have in app purchases. Does that mean I couldn't distribute the new version when it's production ready on IzzyOnDroid?

I didn't realise that would be the case here.
(P.s. the code for the new version isn't available anywhere yet, but will be made available after some cleanup, so it will in fact be open source too)

[IzzySoft]

Unfortunately, the library you used for the purchases is proprietary itself, and further drags in a load of other proprietary libraries (as you've seen). The easiest way around I'd see is establishing build flavors, having one (e.g. named gplay) with the purchase option and another (e.g. named foss) without. An alternative path would be outsourcing all the purchase code to a separate app, which then can act as a kind of addon and interact with this one – keeping the main app entirely FOSS.

Does that mean I couldn't distribute the new version when it's production ready on IzzyOnDroid?

We usually, to a degree, tolerate this, as e.g. „new developers“ were not aware of implications, but will be working on removing/replacing those dependencies – which is not always as easy as just removing some lines of code. But apps which are FOSS and then adding proprietary dependencies, is a different pair of shoes. Things slip in accidentally, so we don't immediately „block“ but give devs a chance to fix. Intentionally adding proprietary parts is not actually on our agenda of „planned support“.

I don't know whether some alternative monetization methods might be acceptable on your end?

the code for the new version isn't available anywhere yet, but will be made available after some cleanup, so it will in fact be open source too

Good to know! Our scanners will report that to us as well then, and we'll then remove the anti-features again. Glad we caught this „in time“, so there might be a chance we find a way that works for both sides 🤞

[AntwanCarter14]

That release (v7.0.1) are consistent with Meta data release. Best (path) to take, I would presume.

[ViscousPot]

@AntwanCarter14

Just to update here: GitSync is currently nearing the end of a massive rewrite which is available right now through a Play Store beta. It's come with a lot more features, cross-platform support and I would hope, better stability. It's soon going to be fully and officially released and then I will prepare and release the open source code here. Each part of this will take some time so I appreciate the patience!

TLDR; This issue isn't relevant anymore since GitSync has been rewritten, but I will revisit the conversation post full release + open sourcing of the new code