F-Droid

[dimqua]

Would be nice to have this browser available in the F-Droid repository, when it'll be released (I hope soon). That's why I should ask, do you support this idea?

┆Issue is synchronized with this Jira Task

[Rudloff]

I think the main problem here will be that the app uses several Maven repositories we (F-Droid) don't trust:

fenix/build.gradle

Line 27 in 9255962

maven {

[sm4rk0]

How is that solved in Fennec build? No untrusted repos? Sorry, couldn't decipher its build.gradle...

[Rudloff]

I think Fennec includes the Gecko source in the repository (instead of fetching prebuilt JAR files like Fenix) so we build everything from source.

[okias]

Is considered meanwhile provide nightly f-droid repository (something similiar to unofficial Firefox Beta repository?)

[dector]

Can we make a list of issues that prevent releasing Fenix to F-Droid and attack them one-by-one?

[dector]

⬆️ @Rudloff @sm4rk0 I need your help with this.

Issues that prevents Fenix to be distributed via F-Droid:

• Proprietary font.
• Dependencies from maven.mozilla.org.
• Using non-free play services library.

anything else?

[Rudloff]

Some maven repositories (which?).

The problem here is that our policy only allows dependencies built from source or fetched from a trusted repository.
Fenix uses dependencies from https://maven.mozilla.org/, which is not in our whitelist.
We decided not to add Mozilla's repository to the list because they have included non-free dependencies like Play Services in their builds in the past.

So the solution to this would be for us to build these dependencies (mostly android-components) entirely from source, but this could be a lot of work. (And some of these components also use custom repositories and non-free dependencies...)

anything else?

Fenix uses the non-free play-services-ads-identifier library.

PS: Of course, Mozilla could also provide their own F-Droid repository with non-free builds.

[dimqua]

@Rudloff could you use (and whitelist) the direct download links for all of those prebuilt dependences? GeckoView mainly.

You haven't to whitelist the whole maven repo in this case.

[Rudloff]

Fenix requires several dozen libraries hosted on https://maven.mozilla.org/, downloading all these manually would be very tedious (and against our policy).

[poperigby]

What's wrong with Maven, again?

[Rudloff]

The problem is not Maven itself but the fact that Fenix uses a Maven repository that is not trusted by the the F-Droid build server. (And the F-Droid contributors decided not to whitelist it.)
Basically, F-Droid only allows Maven/Gradle dependencies from these repositories.

To sum up, the situation is currently stuck unless one the following things happen:

• Mozilla publishes their libraries on Maven Central or jCenter (and releases a statement swearing that they don't contain any non-free code?).
• Someone convinces the F-Droid team to whitelist https://maven.mozilla.org/.
• Someone writes a recipe to build all the required libraries from source.
• Mozilla hosts their own F-Droid repository.

[dector]

Someone writes a recipe to build all the required libraries from source.

I suppose this requires some significant amount of work but doesn't seem unrealistic though. 😅

[poperigby]

Can we get a Mozilla contributor here to talk about this? Seems we need their opinion.

[poperigby]

@bbinto added this to a milestone. I assume that means they're going to do it. Right?

[dector]

@poperigby I can't speak for Mozilla, but this issue seems solvable for me.

Fenix is in beta state for now so team is focusing on building (fast) high quality product but I believe that after releasing stable version this issue will have more attention. I think we need some to make some investigation to split this task onto smaller ones and make them easier to contribute to.

[relan]

F-Droid dev here. I've been working on Fenix inclusion for the past couple of months. Here is a recipie and a set of scripts. In short, it eliminates Mozilla Maven repository and builds GeckoView, Glean, Android Components and Application Services from source (without proprietary components). Fenix itself is heavily patched to remove non-free stuff; the removal of play-services-oss-licenses and flags for other proprietary dependencies are very appreciated, @gilbsgilbs.

Fenix F-Droid is still a work-in-progress, but all the heavy lifting is done and it will eventually replace the old good Fennec F-Droid. Thanks to everyone working on this task!

[Anutrix]

* [ ]  Remove `play-services-oss-licenses` library:
  
  * [x]  PR done #13767
  * [x]  PR approved
  * [ ]  PR merged

@gilbsgilbs #13767 was merged.

[st3fan]

@relan sorry I probably missed this discussion - but what was the reason again that you can't depend on our Maven repo? Is there anything we can do?

[relan]

what was the reason again that you can't depend on our Maven repo?

Nothing specific to the Mozilla repo. F-Droid aims at building everything from source to make sure that binaries correspond to the source code. Currently we allow some widespread repositories like Maven Central, JCenter, JitPack, etc. but in the future we'd like to get rid of this legacy.

Is there anything we can do?

My wishlist :) to all upstream developers:

• Improve documentation about building components (and keep it up-to-date). For instance, there are mutual dependencies between Android Components and Application Services. Would be great to have the bootstrapping procedure described.
• Simplify build setup. For example, after some trial and error I had to set several variables and call 2 scripts to build Application Services. Would be nice if build.gradle could do this for us.
• Make builds reproducible. This would be a whole new level of transparancy.

[TheEvilSkeleton]

Just wanted come by here and say that there is a fork of Fenix, and the developer is trying to get it in F-Droid https://github.com/interfect/fenix/issues/26. @relan you might be interested

[relan]

Meanwhile, another proprietary library (com.google.android.play:core) was added in 365d101. 😞

[opusforlife2]

Was it added with a build flag to exclude it?

If not, is this something the Fenix team could take care to keep in mind for the future? Proprietary dependencies should be added with a build flag so that it is easy to build a free flavour without them.

Edit: (at least, that's the impression I've got from the conversation above.)

[gilbsgilbs]

FYI, I'm not able to keep up with my work on the build flags just yet. If somebody wants to push #13857 forward, I'll happily give write access to my repo or they can open their own PR. If not, I'll probably come back to it at some point.

[TheEvilSkeleton]

Looks like there was an ongoing MR that got merged recently: https://gitlab.com/fdroid/fdroiddata/-/merge_requests/7448

@relan I thank you so much for the hard work.

[sideeffffect]

the F-Droid repo still offers the old version 68.12.0 https://f-droid.org/en/packages/org.mozilla.fennec_fdroid/
I've created a PR to update it https://gitlab.com/fdroid/fdroiddata/-/merge_requests/7462

[uniquePWD]

I have no idea how to say this eloquently, but I believe Fennec should be archived and Fenix should be a new package.

[Dunexus]

@pwd-github If I am not mistaking, making Fenix a new package would disallow Mozilla to provide it as an update from fennec through Play Store.

[andreicristianpetcu]

F-Droid does not want to have it auto update for some reason.

"The app shares the appid with the official F-Droid Fennec build but is signed with a different key, so it won’t install as an update to any existing version and neither will the future official build install over this version."

https://forum.f-droid.org/t/welcome-a-new-fennec-f-droid/11113/16

[cognition9144]

F-Droid does not want to have it auto update for some reason.

Well, to be clear, the Fennec will share the same signing key as the old one (and all F-droid apps). Only a temporary test key for the test version.

[Lion-box]

F-Droid does not want to have it auto update for some reason.

"The app shares the appid with the official F-Droid Fennec build but is signed with a different key, so it won’t install as an update to any existing version and neither will the future official build install over this version."

https://forum.f-droid.org/t/welcome-a-new-fennec-f-droid/11113/16

Non correct.
This only concerns the test build posted by bubu.
F-Droid will build and sign and the app will update as usual.
https://forum.f-droid.org/t/welcome-a-new-fennec-f-droid/11113/44

[uniquePWD]

@pwd-github If I am not mistaking, making Fenix a new package would disallow Mozilla to provide it as an update from fennec through Play Store.

Surely creating a new package just makes all the sense. Especially given the drastic UI change the limited add-on support. Move Fennec to F-Droid Archive and support org.mozilla.fenix-fdroid in the main repo.

[Serkan-devel]

It would be great to keep the Fennec name as it is, due to the reputation that this build variant gained over the years and as mentioned here.

Adding fenix as a tag would be enough.

[rsssxd]

@relan Firefox does not allow turning off the google safe browsing feature on mobile. Will Fennec-Fenix allow this?

[andreicristianpetcu]

This should be closed https://f-droid.org/en/packages/org.mozilla.fennec_fdroid/

[opusforlife2]

This should be closed

I think this checklist is still important to achieve. #162 (comment)

@relan seemed to appreciate the benefits.

[kbrosnan]

This shipped. Thanks to @relan and anyone else involved with the f-droid Fennec/Fenix project. It is better to track tasks about upstreaming any useful code in new issues. This one is far too messy to be of much use.