non-free dependencies added with 2.0.1

[IzzySoft]

2.0.1 & 2.0.2 come with GMS. Most likely, so did 2.0.0 – and this has to do with your Playstore games. Oopsie, or rather not:

geolocator: ^14.0.0

Can you please take a look at Flutter and GeoLocation, to e.g. add the propver override? While on it, I also see ObjectBox. Do you use their gradle plugin? AFAIR that was what made it non-free.

[chukfinley]

Thanks for the pointer to the doc — GMS is now gone.

geolocator / GMS: applied the FLOSS geolocator_android override from your doc (Zverik's floss branch, which uses the plain Android LocationManager instead of the fused-location provider). To avoid depending on an external GitHub repo staying online, I vendored it into the repo (flutter-app/third_party/geolocator_android, MIT, provenance in its VENDORED.md) and wired it via a path: override. No Dart changes — the geolocator API is unchanged.

Verified on the release runtime classpath: 0 com.google.android.gms / play-services entries (was play-services-location before), and a debug build compiles clean. Commit a5bf562.

ObjectBox: we do not use the ObjectBox Gradle plugin (the thing that used to trigger the non-free classification) — there's no io.objectbox plugin/classpath entry anywhere in android/. It comes in purely as a transitive Maven dependency io.objectbox:objectbox-android:4.3.1, pulled by flutter_map_tile_caching (FMTC) as the backend for the offline map-tile cache. So no build-time plugin/download.

I'll cut a GMS-free release shortly so you can verify. If the ObjectBox native lib still counts as a NonFreeDep on your side even without the plugin, let me know — that one is FMTC's storage backend, so swapping it is a bigger change I'd tackle separately.

[IzzySoft]

GMS: thanks!

ObjectBox: OK, then we'll put it to the allow list for BB for now. If you can swap it out later, it cannot hurt, to be on the safe side. AFAIR, only the gradle plugin part was the issue (I hope I remember correctly, and it was not the other way around 🙈

💩 it is the other way around: they meanwhile open-sourced the plugin, but not yet the rest… They seem to still have not decided upon this, thinking about it since 2022 (or 2018, whatever you take as starting point):

The issue is tracked in objectbox/objectbox-java#1102, but even though the decisions about whether ObjectBox is going to be fully opensourced were expected "soon" after March of 2024, there still hasn't been any update after year and a half. So, unless some firm commitments are made by management, it should be assumed that ObjectBox will remain incompatible with FOSS apps. 😿

(source) So unfortunately, we can not add it to the allow list, sorry… As you wrote you will swap it eventually, we'll for now leave the (updated) NonFreeComp in, hoping it won't be needed for too long 🤞

(normally, we'd revert to the last release without it at this point. Or rather: normally, 2.0.0 would not have made it in were it not for the manual action needed with the key change, as our updater would have blocked it. But as you're willing to tackle it, we're also willing to give you some leeway there to do that without too much pressure – though we hope it can be achieved "in a timely manner™" of course 😉)

Thanks for your efforts there – past ones, and the current one! 🤗

[chukfinley]

GMS is gone — 2.0.4 is out.

I replaced geolocator entirely with libre_location (pub.dev, Apache-2.0), which uses the pure AOSP LocationManager — no Play Services at all. Its getCurrentPosition calls LocationManager.requestLocationUpdates directly (no fused provider, no foreground service).

The package ships a full background-tracking manifest, but we only do a one-shot foreground fix, so I stripped everything beyond ACCESS_FINE/COARSE_LOCATION via tools:node="remove" (background location, activity recognition, foreground service, wake lock, battery-ignore, plus its LocationService/BootReceiver).

Verified in the built APK:

• 0 com.google.android.gms / play-services entries

• 0 background/tracking permissions (only INTERNET, FINE/COARSE_LOCATION, and our existing notification/alarm perms remain)

• Tag 2.0.4+5 — commit 99a1a54be095962a2f21f18634c4c62ec2abad68

• Release + signed APKs: https://github.com/chukfinley/Besser-Bahn/releases/tag/2.0.4%2B5

• Same RB toolchain (Flutter 3.41.9, JDK 21, strip step); versionCodes 21004/22004/24004.

On ObjectBox: as noted, no Gradle plugin — it's a transitive Maven dep via FMTC's tile cache. If the prebuilt native lib still counts as a NonFreeDep on your side, let me know and I'll look at alternatives, but that's a separate/bigger change. Thanks!

[IzzySoft]

Updated NonFreeComp description to only point to Objectbox (see details in my previous comment). Thanks for getting GMS flushed out, that was indeed the bigger issue here.