[Task] Abide by F-Droid inclusion policy

[PennRobotics]

https://f-droid.org/en/docs/Inclusion_Policy/

[PennRobotics]

Checklist One

• Free, Libre and Open Source Software
  • including all libraries and dependencies
  • buildable with only FLOSS tools
• original app author notified and does not oppose inclusion
• no build using Play Services
  • Either use microg or remove Non-Free dependencies completely
• no tracking/analytic dependencies
• no ad libraries unless FLOSS
• no build requiring Non-Free build tools, including Oracle’s JDK or some pre-release toolchains
• Source maintained and current in a publicly accessible VCS (git, hg, svn, bzr)
• Software must not download additional executable binary files (e.g. addons, auto-updates, etc.) without opt-in user consent and explanation
• own unique Android Application ID based on a domain name under control of the developer. For example, if the app is in a group called “foo” on gitlab.com, then the domain name could be io.gitlab.foo
  • should not be based on a domain name, (e.g. com.google.foo)
  • Maven Central OSSRH provides good guidance
  • When forked, it must have a new ID, different from the original
• Non-functional assets, such as artwork, might be acceptable under less permissive licenses than functional code; must still be licensed and not a copyright violation
• Trademarks must not be infringed, and any other legal requirements must be adhered to
• F-Droid does not sign up for any API keys
  • Even if provided by a third party, we include them in both binary and source code releases
• Binary dependencies such as JAR files have to be built from source or installed from Debian repos

Checklist Two

• Releases should be clearly tagged or marked

Notes

• All builds may use some prebuilt binaries:
  • Maven Central
  • Google Maven Repo
  • OSS Sonatype
  • OSS JFrog
  • JitPack.io
  • Clojars
  • CommonsWare
  • Gradle plugin repo
  • Android SDK/NDK
  • Gradle
  • Flutter SDK
  • JSC/Hermes
  • Binaries from pip wheels
  • Binaries from Nix cache
  • Rust/Rustup
  • Golang & Nodejs
  • a few other compilers/build tools

Bullshit FOSS will get flagged with the appropriate Anti-Features

When including donation information, relevant donation links must be available either:

• In a plaintext file within the source code
• In FUNDING.yml
• On the applications main website
• When using GitLab to manage source code, a common user account between F-Droid and GitLab

Inclusion How-To

• Beginner: post to the Submission Queue
  • slow
  • create a new ticket on GitLab
  • add required details
  • wait for further instructions
• Advanced: write complete metadata, test, open MR against fdroiddata repo
  • agree with F-Droid philosophy
  • Inclusion Policy (above checklists)
  • Style Guide (below checklists)
  • Metadata
  • use GitLab acct
  • local instance of F-Droid server
• App Review
  • license check (trunk- and file-level)
  • verify build script (ideally ant or gradle)
  • source downloadable
  • pre-compiled libraries/blobs?
  • are any non-source resources non-free?
  • anti-feature/user harm check
  • attempt to patch proprietary parts
  • determine update process
  • write/correct metadata, if not provided
    • fdroid rewritemeta and fdroid lint
  • build in isolated environment
  • sync changes to GitLab
  • provide feedback on failed/pending steps
• Successful merge needs about two days to land on F-Droid itself and another day to reach the Latest Apps list
• Reproducible Build is nice but not necessary
  • 1
  • 2
  • 3
  • 4
  • 5
• Builds happen daily

Style Guido

• have source
• source has AndroidManifest.xml, build.gradle, project.properties, etc.
• license
  • a source license file e.g. LICENSE.txt
  • comment header inside source code files lists the license(s)
  • libraries
    • GPLv2 incompatible with Android support library
  • artwork
  • app website
• summary: shortest possible description of what the app does or enables. Better than Email client would be Receive and send emails
• descriptions: objective and neutral third-person style; describes functionality and features—optionally followed by help snippets for specific features and links to external resources providing more info. Related apps can be linked, too
  • do not repeat the obvious, such as Android app or FOSS or specific Android version support
  • avoid repeating the summary
  • is root required?
  • are there interactions with other apps?
  • how easy is its use?
• donations. There are rules. Since I'm not soliciting, ignore this point.
• Anti-features
  • ads
  • disabled signing algorithm
  • known vulns
  • NSFW
  • no current source
  • non-free shit (addons, assets, dependencies, network services)
  • "TetheredNet" (uses an irreplaceable service)
  • tracking
  • non-free upstream
• Maintenance
  • for new versions, there are three automatic methods and one manual method
    • tags (preferred)
    • AndroidManifest.xml
    • Google Play
    • version published upstream
    • changelog