Publish on f-droid

[SonaliBendre]

add on f-droid

[gavv]

Good idea

[IzzySoft]

This strongly requires having versionCode and versionName fixed (which also is why auto-updates in my repo don't work currently). Especially the former is crucial, as that's what Android uses internally to tell versions apart – and what F-Droid uses to see if there are new releases available. To both it currently looks like there was only a single release ever…

@ortex could you please take care for that? Also while on it, it would be great if versionName would reflect the tag name, i.e. currently would show 0.0.3 instead of 1.0 😉 Thanks in advance!

[gavv]

See #24 (comment)

[IzzySoft]

Concerning my repo, see my reply there – thanks, that should work. As for F-Droid, the bot will tell once it scans the repo after your opening a request for packaging. It usually looks into build.gradle first (and will fail there due to the dynamic codes), but should also take AndroidManifest.xml into consideration when it failed at the gradle. So may I encourage you to go for the RFP then? And until that's finally processed, maybe pick a badge to link to your app in my repo?

would fit nicely next to your build badge 😉

[gavv]

So may I encourage you to go for the RFP then? And until that's finally processed, maybe pick a badge to link to your app in my repo?

Sure.

The version on IzzyOnDroid is still 1.0 instead of 0.0.4. What should we do with this?

[![IzzyOnDroid](https://img.shields.io/endpoint?url=https://apt.izzysoft.de/fdroid/api/v1/shield/org.rocstreaming.rocdroid)](https://apt.izzysoft.de/fdroid/index/apk/org.rocstreaming.rocdroid)

[gavv]

So may I encourage you to go for the RFP then? And until that's finally processed, maybe pick a badge to link to your app in my repo?

#38

[IzzySoft]

The version on IzzyOnDroid is still 1.0 instead of 0.0.4. What should we do with this?

Wait for the sync 😃 See what the repo shows as last version online:

Version 1.0 (2021-11-18)

I've just updated it manually in the "staging area" (as the auto-updater would not have fetched it this time, see above), sync happens daily around 7 pm UTC (winter time; 6 pm UTC in summer time). This is how it looks in staging currently, which will be what the online site will show after the sync:

Version 0.0.4 (2022-12-14)

And thanks for adding the badge! 😍

[JamesOsborn-SE]

https://gitlab.com/fdroid/fdroiddata/-/merge_requests/14910

[IzzySoft]

Seeing the app is now available at F-Droid.org, and the Readme carrying both badges now: I assume you want to keep it available at IzzyOnDroid then? Just asking to make sure it wasn't just an oversight.

[gavv]

@IzzySoft I'm not familiar with IzzyOnDroid and its user base (and TBH F-Droid too), but IMHO if it gives any benefits to users, then why not to keep it. Unless it's a burden for you of course.

[IzzySoft]

No problem here as long as the APK does not grow too much 😉 Marked the app for "keep" then, linking here for reference. Thanks!

[IzzySoft]

Btw, while I'm here:

! repo/org.rocstreaming.rocdroid_2002.apk declares sensitive permission(s): android.permission.RECORD_AUDIO
! repo/org.rocstreaming.rocdroid_2002.apk contains signature block blobs: 0x504b4453 (DEPENDENCY_INFO_BLOCK; GOOGLE)

The permission is clear (needed by the receiver), so I just added it to the app's "green list" (giving this explanation). As for DEPENDENCY_INFO_BLOCK, this can easily be avoided with a tiny modification to your build.gradle:

android {
    dependenciesInfo {
        // Disables dependency metadata when building APKs.
        includeInApk = false
        // Disables dependency metadata when building Android App Bundles.
        includeInBundle = false
    }
}

For some background: that BLOB is supposed to be just a binary representation of your app's dependency tree. But as it's encrypted with a public key belonging to Google, only Google can read it – and nobody else can even verify what it really contains. More details can be found e.g. here: Ramping up security: additional APK checks are in place with the IzzyOnDroid repo.

Thanks in advance!

[gavv]

Btw, while I'm here:

! repo/org.rocstreaming.rocdroid_2002.apk declares sensitive permission(s): android.permission.RECORD_AUDIO
! repo/org.rocstreaming.rocdroid_2002.apk contains signature block blobs: 0x504b4453 (DEPENDENCY_INFO_BLOCK; GOOGLE)

The permission is clear (needed by the receiver), so I just added it to the app's "green list" (giving this explanation). As for DEPENDENCY_INFO_BLOCK, this can easily be avoided with a tiny modification to your build.gradle:

android {
    dependenciesInfo {
        // Disables dependency metadata when building APKs.
        includeInApk = false
        // Disables dependency metadata when building Android App Bundles.
        includeInBundle = false
    }
}

For some background: that BLOB is supposed to be just a binary representation of your app's dependency tree. But as it's encrypted with a public key belonging to Google, only Google can read it – and nobody else can even verify what it really contains. More details can be found e.g. here: Ramping up security: additional APK checks are in place with the IzzyOnDroid repo.

Thanks in advance!

Thanks, I'll handle it in #104 (comment)

[IzzySoft]

Thanks! The linked issue is closed, too, but I do not see the dependenciesInfo in the build.gradle – do I miss something there?

[gavv]

Thanks! The linked issue is closed, too, but I do not see the dependenciesInfo in the build.gradle – do I miss something there?

Sorry, I forgot to clarify.

That issue is a part of a bigger one, migrating UI to flutter: #94. (There are plans to add support to platforms other than android in future).

@Izchomatik is working on that big issue, and all the work is done in a separate branch "flutter". My changes related to permissions were also merged there. flutter branch will be merged into main after migration is fully done.

I also was planning to ping you and fdroid guys in the end to ask what other changes are needed on our or your side. For example, location of AndroidManifest is different in flutter branch, probably it'd break packaging.

[IzzySoft]

Thanks! Looking forward to that then. And yes, be welcome to reach out if you have questions! We at IzzyOnDroid as well as our colleagues at F-Droid will be there to help and assist you. There might be delays, though, depending on our workloads (the F-Droid team is not that large, and the team of IzzyOnDroid even small compared to theirs – and neither of us can be everywhere at the same time 😉).