Http GTFS feeds

[CJFData]

Hi Light team! I'm encountering a few public transit agencies that serve out their gtfs feed on http:// rather than https:// besides the concerns I've related to agencies some are a little slow to implement a change. Would LightOS support downloading to particular GTFS connections over http:// ? If so, what safeguards would you require? I currently have a working connection on my debug, works ok but hardcoding an http:// address I realize may raise some flags

[dupontgu]

Did you have to add any dependencies to make it work, or was it fine with the current OKHTTP setup? I don't really have huge concerns with this, especially if the URLs are hardcoded.

[CJFData]

I had to add a netconfig directory which uses android.library plugin, with namespace, compileSdk, and minSdk set, there's an XML file that lists the URLs exempt from Android's HTTPS enforcement "cleartextTrafficPermitted="true""

The non-https:// URLs are listed in that XML doc network_security_config.xml:

<network-security-config>
<domain-config cleartextTrafficPermitted="true">
    <domain includeSubdomains="false">realtime.examplepublictransit.com/ </domain>
</domain-config>
</network-security-config>

It's a bare Android library module (just the android.library plugin) there's no equivalent for it in the Light SDK currently and AndroidManifest under the tool I cannot modify, hence the netconfig module. I have documented removal steps documented throughout as soon as these transit agencies upgrade their feeds (I've informed them it might be beneficial to have an "https://" feed...) this must come up for other transit apps though.

2. I did add two dependencies that are modules under the samekotlinx-serialization library: '-protobuf and '-json`, to decode GTFS-RT and MBTA's V3 API, but this is less about HTTP and more about digesting the GTFS-RT feeds.

[CJFData]

If adding the module outside the tool goes a little far out of the scope, I think the solution would be allowing something like this (im not committing this just copying/pasting temporarily the directory I have in Netconfig):

then if this were already in place for the SDK in the android manifest:

<application android:networkSecurityConfig="@xml/network_security_config" />

granted, i'd imagine this is something that would need to be watched from light team each time a 3rd party uses it 🫠

[CJFData]

forgot to add... this is in buildgradle as a dependency...

which causes it to build with the android manifest in netconfig

implementation(project(":netconfig"))

[CJFData]

<manifest xmlns:android="http://schemas.android.com/apk/res/android">
    <application android:networkSecurityConfig="@xml/network_security_config" />
</manifest>

This is all that androidmanifest has in netconfig, basically gradle builds pointing to netconfig> androidmanifest in netconfig > network_security_config.xml in netconfig which lists the HTTP:// URLS

[dupontgu]

Ah right I always forget about the Android usesCleartextTraffic thing. I'm taking this discussion to the team, it's going to affect more than just transit. Many internet radio streams/podcasts are http only as well.