Friday, 30 September 2022

How to find out which flutter dependency uses a specific google package (blocklisted on F-droid)?

I am trying to submit a flutter app to F-droid.

Unfortunately I am getting a message that blocklisted packages from Google are used:

2022-09-25 16:57:05,704 DEBUG: Found class 'com/google/android/play/core/assetpacks/o2'
2022-09-25 16:57:05,706 DEBUG: Found class 'com/google/android/play/core/assetpacks/f2'
2022-09-25 16:57:05,707 DEBUG: Found class 'com/google/android/play/core/assetpacks/r0'
2022-09-25 16:57:05,707 DEBUG: Found class 'com/google/android/play/core/review/d'
2022-09-25 16:57:05,707 DEBUG: Found class 'com/google/android/play/core/assetpacks/y'
2022-09-25 16:57:05,708 DEBUG: Found class 'com/google/android/play/core/assetpacks/k2'
2022-09-25 16:57:05,708 DEBUG: Found class 'com/google/android/play/core/assetpacks/e1'
2022-09-25 16:57:05,708 DEBUG: Found class 'com/google/android/gms/common/api/internal/j'
2022-09-25 16:57:05,708 DEBUG: Found class 'com/google/android/gms/common/internal/p'
2022-09-25 16:57:05,709 DEBUG: Found class 'com/google/android/play/core/review/b'
2022-09-25 16:57:05,709 DEBUG: Found class 'com/google/android/play/core/assetpacks/p0'
2022-09-25 16:57:05,709 DEBUG: Found class 'com/google/android/gms/common/internal/v/c'
2022-09-25 16:57:05,709 DEBUG: Found class 'com/google/android/gms/common/api/internal/x'
2022-09-25 16:57:05,710 DEBUG: Found class 'com/google/android/gms/common/api/internal/v'
2022-09-25 16:57:05,710 DEBUG: Found class 'com/google/android/gms/common/internal/s'
2022-09-25 16:57:05,710 DEBUG: Found class 'com/google/android/gms/common/api/internal/h'
2022-09-25 16:57:05,710 DEBUG: Found class 'com/google/android/gms/common/api/internal/e0'

and so on.

My pubspec looks like this:

dependencies:
  flutter:
    sdk: flutter


  # The following adds the Cupertino Icons font to your application.
  # Use with the CupertinoIcons class for iOS style icons.
  cupertino_icons: ^1.0.2
  trufi_core:
    git:
      url: https://github.com/AddisMap/trufi-core.git
      ref: translation-am

The pubspec of trufi_core like this:

dependencies:
  app_review: ^2.1.1+1
  async_executor: ^0.0.2
  flare_flutter: ^3.0.2
  flutter:
    sdk: flutter
  flutter_localizations:
    sdk: flutter 
  flutter_map: ^0.14.0
  device_info_plus: ^3.2.4
  diff_match_patch: ^0.4.1
  latlong2: ^0.8.1
  routemaster: ^0.9.5
  geolocator: ^8.0.3
  graphql: ^5.0.0
  path_provider: ^2.0.8
  flutter_bloc: ^8.0.0
  flutter_svg: ^1.0.0 
  equatable: ^2.0.3
  provider: ^6.0.1
  package_info_plus: ^1.3.0
  rxdart: ^0.27.3
  share_plus: ^4.0.10+1
  synchronized: ^3.0.0
  cached_network_image: ^3.2.0
  uni_links: ^0.5.1
  # Workaround fix version errors for device_info_plus
  device_info_plus_platform_interface: '2.3.0+1'

Is there some command to list the packages which use those classes?

I tried gradlew, no luck:

android$ ./gradlew -q dependencies

------------------------------------------------------------
Root project
------------------------------------------------------------

No configurations

Also I tried

$ find -name "*play*"

in my project folder, which does not yield anything related to those classes

EDIT: By guesswork, I found that app_review is pulling in the play store dependency.

There is still gms services left.

I also found out that I can check the APK locally without having to build with F-droid like this:

~/Android/Sdk/build-tools/33.0.0/dexdump build/app/outputs/flutter-apk/app-release.apk |grep gms/location

But still I would need to guess the flutter packages.

Those are the remaining packages/classes:

 cat /tmp/classes.txt | cut -d " " -f 6|rev|cut -d/ -f2-|rev|sort|uniq
'com/google/android/gms/auth/api/signin
'com/google/android/gms/auth/api/signin/a
'com/google/android/gms/common/annotation
'com/google/android/gms/common/api
'com/google/android/gms/common/api/internal
'com/google/android/gms/common/internal
'com/google/android/gms/common/internal/v
'com/google/android/gms/common/util
'com/google/android/gms/dynamite
'com/google/android/gms/location


from How to find out which flutter dependency uses a specific google package (blocklisted on F-droid)?

No comments:

Post a Comment