Publish the application on the official F-Droid repo

[wuniversales]

Please publish the application on fdroid.
https://f-droid.org/
Thank you

[licaon-kter]

Hey, what's the dev's opinion on this?

This project sounds nice, they'll need to make a gradle flavour that doesn't need non-FOSS libs like Crashlytics, Firebase and Google Services (maybe more?), but given past projects like LibreSignal maybe this is not that hard.

[ian-tedesco]

The CTO stated in this discussion https://github.com/privacytoolsIO/privacytools.io/issues/1678 the following, so I guess they are trying to make it.

APKs are here, https://github.com/loki-project/session-android/releases , We will be trying to get into F-Droid repo shortly, we're just focusing on bugfixes for now since we just released.

[KeeJef]

We fully intend to get into the F-droid repository, but first we are focusing on ironing out bugs with the current releases, you can avoid Google Play by downloading the official signed APK's for now, but you will need to keep ontop of the updates manually https://github.com/loki-project/session-android/releases

[ian-tedesco]

We fully intend to get into the F-droid repository, but first we are focusing on ironing out bugs with the current releases, you can avoid Google Play by downloading the official signed APK's for now, but you will need to keep ontop of the updates manually https://github.com/loki-project/session-android/releases

Is there a way to check which version I'm using?

[KeeJef]

We fully intend to get into the F-droid repository, but first we are focusing on ironing out bugs with the current releases, you can avoid Google Play by downloading the official signed APK's for now, but you will need to keep ontop of the updates manually https://github.com/loki-project/session-android/releases

Is there a way to check which version I'm using?

No, not right now on Android, but a version number in the settings menu will be added next release

[ZarVladimirII]

Is there a way to check which version I'm using?

Install MyPhoneExplorer from fjsoft. You can also synchronize Offline, save apks from all Apps, Contacts, SMS all stored with a passphrase encrypted.

[Neurognostic]

Any update on this? Would really like to keep Session up to date with F-Droid. Being available on F-Droid also gives users some peace of mind due to their strict FLOSS Inclusion Policy and auditing during the build process.

https://f-droid.org/en/contribute/
https://f-droid.org/en/docs/Inclusion_Policy/
https://gitlab.com/fdroid/fdroiddata/blob/master/CONTRIBUTING.md
https://f-droid.org/docs/Submitting_to_F-Droid_Quick_Start_Guide/

[KeeJef]

We haven't started on this yet, as our priority is still improving the user experience of Session at the moment. We release signed APK's regularly here, https://github.com/loki-project/session-android/releases they don't bundle with any google services so you can just download them and run them on any Android phone without the google play store

[ian-tedesco]

Any idea how long will it take to start working on this?

[KeeJef]

Depends on how quickly we can fix up multi device, push notifications and message sending reliability, maybe a month or two?

[EchedelleLR]

We haven't started on this yet, as our priority is still improving the user experience of Session at the moment. We release signed APK's regularly here, https://github.com/loki-project/session-android/releases they don't bundle with any google services so you can just download them and run them on any Android phone without the google play store

Seems that in the end comes bundled with that but "optional" which acts strange as showed in other issue I created.

[gary-host-laptop]

Just a heads up, while they keep working on the F-Droid release, you can keep up to date more easily through IzzyOnDroid's repository, you can add them to your F-Droid repositories' list or use another custom application store like Aurora Droid.

https://apt.izzysoft.de/fdroid/
https://auroraoss.com/downloads.php

[licaon-kter]

Can the user backup/restore once F-Droid is ready?

[gary-host-laptop]

I guess it'll depend on how they do it, I have some applications installed through Aurora Droid which are the same on F-Droid, but some others (like Geometric Weather) seem to have incompatible signatures and will need either an update or a reinstall to work properly. Still, Session has a key back up system, so therefore you could be able to simply uninstall it and log in again in the worst case scenario.

[licaon-kter]

Aurora Droid uses the main repo too, of course it's the same signature. :)

Geometric Weather was just merged in, so IzzyDroid would drop it soon.

[ghost]

Still no updates on this?
I'd really like to recommend Session as many people are moving from Whatsapp to Signal (which isn't any better) currently.
Having the option to download the app from F-Droid would give you more trust in the FOSS community and a big advantage over Signal whose lead dev doesn't want the app published in the F-Droid.

[Dev-i-l]

very much looking forward to this, will switch once it's there

[trymeouteh]

+1 for degoogled android users.

[KeeJef]

Session has now been added to F-Droid, you can add the Session repository and download the app (inside F-Droid) using the following link https://fdroid.getsession.org/fdroid/repo/ , ongoing updates will be provided through this repo.

[Neurognostic]

@KeeJef, I am curious. What are the reasons Session cannot be distributed from the official F-Droid repository? Is Session not able to be compliant with F-Droid's Inclusion Policy?

Distributing through F-Droid's official repository and meeting their requirements gives user's confidence that the application respects their freedom and is being built from source by a trusted third party.

[licaon-kter]

@KeeJef

Session has now been added to F-Droid
That's...not...what...it...means.

"You can now add the Sessions repo to F-Droid" is the correct phrasing.

[KeeJef]

@KeeJef, I am curious. What are the reasons Session cannot be distributed from the official F-Droid repository? Is Session not able to be compliant with F-Droid's Inclusion Policy?

Two primary reasons:

1. We offer all users the option to use Google FCM for reliable push notifications, or use background polling to provide less reliable notifications. If they choose to use background polling then they wont use Google services at all, but its an option we want to provide, even in the F-Droid version for now. Having a messaging application which is unable to provide reliable notifications is not very useful and leads to high abandonment.

2. AFIK F-Droid requires that dependencies for the application be on their "well known repositories" whitelist of dependencies when building the application. Some of our dependencies which are open source are not supported in their whitelist (SQLCipher, LazySodium and a few others), it would require significant tinkering to refactor the codebase to use only dependencies on the whitelist

"You can now add the Sessions repo to F-Droid" is the correct phrasing.

The App is called Session not Sessions. You can add the Session repository inside F-Droid and pull the latest releases from there

[licaon-kter]

Requires knows open source artefacts or build from source, no need to refactor then. But the recipe will be more elaborate.

[Neurognostic]

We offer all users the option to use Google FCM for reliable push notifications, or use background polling to provide less reliable notifications. If they choose to use background polling then they wont use Google services at all, but its an option we want to provide, even in the F-Droid version for now. Having a messaging application which is unable to provide reliable notifications is not very useful and leads to high abandonment.

As you may be aware, Google FCM is a limitation that many developers run into when trying to be FOSS. Telegram, for example, has a separate build/fork that, among other changes, trades FCM for a persistent notification and Tutanota, as another example, built their own push notification service with SSE. And there are other solutions available if being completely FOSS is an objective of the project (maybe its not?).

AFIK F-Droid requires that dependencies for the application be on their "well known repositories" whitelist of dependencies when building the application. Some of our dependencies which are open source are not supported in their whitelist (SQLCipher, LazySodium and a few others), it would require significant tinkering to refactor the codebase to use only dependencies on the whitelist

I was not able to find any mention of a whitelist of libraries in the Inclusion Policy, the Inclusion Submission How-to, or in any previous submissions to the Request for Packaging repo on GitLab; only that the libraries be "Free, Libre and Open Source software." But I am not an Android developer and have not gone through the process, so could be missing something.

---

While it is nice to be able to use the F-Droid or AuroraDroid applications to keep Session up to date without involving Google, we could already do that with IzzyOnDroid's repository, which just grabs the latest build from your releases.

Since Session was not published to F-Droid's official repository, which I believe was what the spirit of this issue/request was about, can we please reopen the issue until a future where Session (or a fork) can be completely FOSS and included in the official repository?

[licaon-kter]

@Neurognostic see fdroidserver/fdroidserver/scanner.py look up "maven" where's there's a list of known maven repos that hold mostly FOSS artefacts.

[soredake]

for a persistent notification

Which can be hidden...

[KeeJef]

As you may be aware, Google FCM is a limitation that many developers run into when trying to be FOSS. Telegram, for example, has a separate build/fork that, among other changes, trades FCM for a persistent notification and Tutanota, as another example, built there own push notification service with SSE.

None of this is possible for Session since we can't hold onion routed persistent connections open with the Service Node network, that would require the integration of Lokinet which is not yet implemented on mobile. Currently the non Google notifications service uses a background polling based approach + Onion requests, however this is frequently shut down by the devices battery management systems. None of the solutions we have seen thus far can reach the reliability of FCM while maintaining privacy, in the future we will be able to use Lokinet to solve many of these problems, using FCM is not ideal, but that's something we're working on.

And there are other solutions available if being completely FOSS is an objective of the project (maybe its not?).

Whether the app is completely FOSS or not seems ideological, yes the apps code does include Google FCM right now, but if the user chooses to use background notifications the Google code path is never visited and the app can be used entirely without using Google. Personally I don't see the issue with offering users choice about which code paths they interact with. Although i do see the issues with using Google services which we intend to move away from once we can get Lokinet working on mobile devices.

[ltguillaume]

But the Session F-Droid doesn't even has screenshots. I guess this is from somewhere else, maybe the Izzy's repo? Then it's the official apk with firebase.

Well crap, I was sure I disabled Izzy... but it wasn't. So sorry to have inconvenienced you with this.

BTW, what causes the huge size difference between the official APK (via Izzy, 37MB) and the new F-Droid APK (79MB)?

[darhma]

I suppose it is because the f-droid apk contains versions for all the various architectures, but I am not 100% sure

[linsui]

Yes, the Session F-Droid is a univeral apk and Izzy only takes the amrv7 one due to resource limitation. You can see the similiar sizes on https://github.com/oxen-io/session-android/releases.

[shuvashish76]

The app name is rebranded as Session F-Droid and the id is changed to network.loki.messenger.fdroid

There's no problem with anyone taking Session and removing / adding code, perhaps just make it clear in the title/release notes that this is not officially distributed by the Session team.

@linsui @KeeJef
Ok the both app name & id has been changed for F-Droid but I don't understand how the app is unofficial when it's linked to same repo, same bugtracker, same project website link.

[nahuhh]

The app name is rebranded as Session F-Droid and the id is changed to network.loki.messenger.fdroid

There's no problem with anyone taking Session and removing / adding code, perhaps just make it clear in the title/release notes that this is not officially distributed by the Session team.

@linsui @KeeJef
Ok the both app name & id has been changed for F-Droid but I don't understand how the app is unofficial when it's linked to same repo, same bugtracker, same project website link.

Its unofficial / a fork because the changes were not approved, merged or considered in the official repo.

@linsui
While there is no package name conflict, there is this (screenshot below) when installing alongside session official.
Are you able to fix this?

If not, np. Ill just uninstall session official

[linsui]

I'll fix it, thanks for your report!

[shuvashish76]

Its unofficial / a fork because the changes were not approved, merged or considered in the official repo.

That's what, if it's a fork/unofficial then why all its metadata linked to official repo & where is the forked version sourcecode & repo link?

[linsui]

That's what, if it's a fork/unofficial then why all its metadata linked to official repo & where is the forked version sourcecode & repo link?

It's patched at the build time with the steps in the F-Droid build metadata.

[licaon-kter]

@shuvashish76
All the changes are seen here: https://gitlab.com/fdroid/fdroiddata/-/blob/6f6f183c2277fb65318328f4dac9c148003a95e8/metadata/network.loki.messenger.fdroid.yml#L64-L86

This is a normal process for many apps (cleaning up bad stuff), hence no need for full repos and what not.

[shuvashish76]

This is a normal process for many apps (cleaning up bad stuff), hence no need for full repos and what not.

Forks which only re-brand an app but do not add value for users might not get accepted.

Which is somewhat true in this case as F-Droid users can't post their unofficial app crashreports, logs, suggestions in official repo issue tracker. If the official devs have no problems with issues coming from unofficial version then technically its official.

Is it ethical for F-Droid to put official repo link, author name etc in an unofficial app metadata, even if does it's confusing for users why it's unofficial?

[licaon-kter]

Read above for the reasons, devs don't have time/will to do this properly. A contributor helps. etc.

What is the problem exactly? It's not like the users aren't aware of what they install: https://gitlab.com/fdroid/fdroiddata/-/blob/6f6f183c2277fb65318328f4dac9c148003a95e8/metadata/network.loki.messenger.fdroid.yml#L19-L22

[shuvashish76]

@licaon-kter Thanks for the quick reply, I was just curious how F-Droid & opensource in general works :)

[KeeJef]

Hey @linsui would you mind changing the name of the app distributor from "Oxen" to something more clear? people seem to be confusing this with the official distribution and sending customer support tickets to us regarding the app. You can ping me on Session if you want to know more 05d871fc80ca007eed9b2f4df72853e2a2d5465a92fcb1889fb5c84aa2833b3b40

[linsui]

@KeeJef Is it enough to remove the AuthorName? I'm not sure how to make it clearer that this is not an official fork.

[KeeJef]

@KeeJef Is it enough to remove the AuthorName? I'm not sure how to make it clearer that this is not an official fork.

Yeah, removal of the author name would be fine, something like "Oxen unofficial" would work too, or you could just list your own name/nickname as the author. Thanks

[nahuhh]

I'll fix it, thanks for your report!

I can confirm you can now install Session F-Droid alongside the official Session.

Thanks for the quick update!

[linsui]

@KeeJef https://gitlab.com/fdroid/fdroiddata/-/merge_requests/11260 Done. 👌

[nahuhh]

@linsui would you be able to help do the same for another app?

051ef68b400257a9ce1e30a46cd871ad089cfd9d42c2bd2d29945de973eca7197f

Can contact me on session here ^

[linsui]

@nahuhh Which app?

[TPS]

@KeeJef https://gitlab.com/fdroid/fdroiddata/-/merge_requests/11260 Done. 👌

This is available on the main F-Droid repo since 6/26/22. Close FTW?

[KeeJef]

@KeeJef https://gitlab.com/fdroid/fdroiddata/-/merge_requests/11260 Done. 👌

This is available on the main F-Droid repo since 6/26/22. Close FTW?

We will probably still seek to publish an official version in the F-Droid repo, when we resolve an alternative privacy preserving PN strategy, so keeping this open for now.

[linsui]

Since the website flavor already removed all non-free libs, can we publish an official version in the F-Droid repo?

[EchedelleLR]

Do they support UnifiedPush in the end? I think people should go to SimpleX instead given all the situation here.

[linsui]

No, I thought they just provide a no-op stub. https://github.com/oxen-io/session-android/tree/master/app/src/website/kotlin/org/thoughtcrime/securesms/notifications

[Daniel-Khodabakhsh]

Has something changed recently, or did the build start including non-free code?

I ask because from the above it seemed like @linsui's unofficial Session F-Droid resolved this, but currently this app is showing "[t]he upstream source code is not entirely Free" Anti-Feature message:

[licaon-kter]

@Daniel-Khodabakhsh that has been there since the beginning https://gitlab.com/fdroid/fdroiddata/-/commit/6f6f183c2277fb65318328f4dac9c148003a95e8#79c6dd9c3e334b7160e7aec60398da3b855ff61b_0_2

It's more about the more changes it needs to be made FOSS the more it warrants such a flag, eg. https://gitlab.com/fdroid/fdroiddata/-/blob/b9ae6bbc7145337b53ed45ae4457420dea97c621/metadata/network.loki.messenger.fdroid.yml#L804-L821

More discussions here: https://gitlab.com/fdroid/fdroiddata/-/issues/2481