2 ms·
Thank you for the detailed explanation of the F-Droid build process. You say it's possible for an application's build scripts to download binaries that don't co
by dTal 7y ago
Thank you for the detailed explanation of the F-Droid build process. You say it's possible for an application's build scripts to download binaries that don't correspond to any published source for the app, and patch them in - that seems very non-free and indeed dangerous. Is there a way of finding out if an app does this?
I also think that believing you have the source code to an app but being unable to build it because of missing, possibly proprietary dependencies is far more damaging to the FLOSS spirit than any amount of format difficulty.
- est31 7y agoThe way you can tell is to run the build and inspect the build log. Usually it prints out if it downloads something. I think it's pretty common that stuff is being downloaded during the build phase, mostly from java package hosts like mvn, jitpack, etc. There are checks in f-droid to ensure those hosts are on a whitelist of FLOSS-policy repos but the checks don't prevent any custom build logic of downloading stuff via http, cloning git repos, etc. Also while maven central does not, some of these hosts also allow takedowns of published artifacts, at least jitpack allows it and it's on the whitelist (also jitpack's policy isn't FLOSS only, only requiring that the package is on public github, which still allows for nonfree "source available" software AND jitpack doesn't have any policy about downloaded binaries during its build).