1700817 - Oculus rejects app with GeckoView because WebAuthnTokenManager uses Google Mobile Services APIs

Status: ASSIGNED

(GeckoView :: General, enhancement, P3)

Description

[Nate Hill]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36

Steps to reproduce:

Hello! I developed a library for utilizing GeckoView with the Unity game engine, and when I updated the version of GeckoView it uses, one of the developers using the library reported that Oculus rejected their app update because their app contained references to Google Mobile Services APIs, which Oculus disallows. That developer dug deeper and found that the issue is that the recently added WebAuthnTokenManager class in GeckoView uses APIs from com.google.android.gms:

https://hg.mozilla.org/mozilla-central/file/tip/mobile/android/geckoview/src/main/java/org/mozilla/geckoview/WebAuthnTokenManager.java

I reverted the library back to using GeckoView v82 (geckoview-82.0.20201108180448.aar), the last version that predates the addition of the WebAuthnTokenManager class, and this allowed the developer to successfully submit their app update to Oculus. I would like to upgrade the version of GeckoView that the library uses, but since most of the library's users target Oculus, I need to create a build of GeckoView that excludes WebAuthnTokenManager.

My first attempt at this was to create a bash script that unzips the newer GeckoView AAR and its embedded classes.jar file, deletes the WebAuthnTokenManager class, and then zips the modified classes.jar and AAR back up. However, this led to a ClassNotFoundException at runtime because libxul.so appears to have a dependency on WebAuthnTokenManager. So, my plan now is to create a custom GeckoView build by modifying the GeckoView source to remove or modify the WebAuthnTokenManager class (and, of course, provide access to the source for the modified GeckoView per the MPL). However, it would be great if there was an option make WebAuthnTokenManager an optional component of GeckoView, a way to disable its usage of Google Mobile Services APIs, or an easy way to create a build without it.

Actual results:

Oculus rejects apps that contain new versions of GeckoView because GeckoView references Google Mobile Services APIs.

Expected results:

Oculus shouldn't reject apps that contains new versions of GeckoView.

Comment 1

[Emily Toop (:fluffyemily)]

Manuel is this something that you have added for FxR?

Comment 2

[Manuel Martin]

No, actually we couldn't as it's disallowed by Oculus as stated above. We are still using at a previous GeckoView version so we haven't run into this issue yet but I agree with the report above and we are going to run into the same issue when updating FxR at some point.

Comment 3

[Emily Toop (:fluffyemily)]

This can be fixed with some dark proguard magic. Will schedule in to be looked at next release.

Comment 4

[Nate Hill]

(In reply to Emily Toop (:fluffyemily) from comment #3)

This can be fixed with some dark proguard magic. Will schedule in to be looked at next release.

Thanks, Emily! I really appreciate it. I hadn't considered proguard wizardry, but that is a great idea.

Comment 5

[Daniel Veditz [:dveditz]]

A long term fix would be bug 1678045: supporting this natively instead of through GMS so the feature will work on non-Google devices. But that's long term so you'll probably want your wizardry or conditional compilation as a shorter term solution.

Comment 6

[Nate Hill]

For reference, here's the script I wrote to remove references to GMS classes from the GeckoView aar. In the future, I plan to switch to having a downstream fork so that I can also contribute updates to GeckoView.

Comment 7

[Chris Peterson [:cpeterson]]

Tasks and enhancements should have severity N/A.