1794913 - `browser-engine-gecko` has proprietary transitive dependencies and pulls Google Play Services into apps that shouldn't ship it

Status: NEW

(Firefox for Android :: Browser Engine, defect)

Description

[Christian Sadilek [:csadilek]]

From github: https://github.com/mozilla-mobile/android-components/issues/11925.

I'm trying to build a project (really a Fenix derivative) that uses org.mozilla.components:browser-engine-gecko, and also doesn't ship any proprietary class files in the build. I definitely don't want to ship the proprietary Google Play Services client libraries, which spook the oddly large category of people who consider Google untrustworthy but run AOSP-derived operating systems. Moreover, I need to be able to grant people full modification, reverse-engineering, etc. rights to the binaries, and that's probably illegal if they ship code under whatever license Google Play Services uses.

But my dependency tree looks like this:

+--- org.mozilla.components:browser-engine-gecko:96.0.15
|    +--- org.mozilla.geckoview:geckoview-omni:96.0.20220126154723
|    |    +--- org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.5.20 -> 1.5.31
|    |    |    +--- org.jetbrains.kotlin:kotlin-stdlib:1.5.31 (*)
|    |    |    \--- org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.5.31
|    |    |         \--- org.jetbrains.kotlin:kotlin-stdlib:1.5.31 (*)
|    |    +--- androidx.annotation:annotation:1.1.0 -> 1.2.0
|    |    +--- androidx.legacy:legacy-support-v4:1.0.0
...
|    |    +--- com.google.android.gms:play-services-fido:18.1.0
|    |    |    +--- com.google.android.gms:play-services-base:17.0.0
|    |    |    |    +--- androidx.collection:collection:1.0.0 -> 1.1.0 (*)
|    |    |    |    +--- androidx.core:core:1.0.0 -> 1.5.0 (*)
|    |    |    |    +--- androidx.fragment:fragment:1.0.0 -> 1.3.4 (*)
|    |    |    |    +--- com.google.android.gms:play-services-basement:17.0.0
|    |    |    |    |    +--- androidx.collection:collection:1.0.0 -> 1.1.0 (*)
|    |    |    |    |    +--- androidx.core:core:1.0.0 -> 1.5.0 (*)
|    |    |    |    |    \--- androidx.fragment:fragment:1.0.0 -> 1.3.4 (*)
|    |    |    |    \--- com.google.android.gms:play-services-tasks:17.0.0
|    |    |    |         \--- com.google.android.gms:play-services-basement:17.0.0 (*)
|    |    |    +--- com.google.android.gms:play-services-basement:17.0.0 (*)
|    |    |    \--- com.google.android.gms:play-services-tasks:17.0.0 (*)

I'm ending up with a bunch of Google Play Services stuff that I don't want, via my dependency on browser-engine-gecko.

I would have suspected #9508 of causing this, since the library is there for 2-factor authentication. But it looks to me like this might have actually happened in https://github.com/mozilla-mobile/android-components/commit/0b349f48c91a50bb7b4ffbf40c6c122ed18142d3, which swapped over to the -omni version of geckoview (which I guess means the one that ships closed-source dependencies?).

Is there an OSS-only flavor of browser-engine-gecko that I should be depending on instead? Or is the com.google.android.gms:play-services-fido dependency actually somehow optional? How can I avoid shipping it?

┆Issue is synchronized with this Jira Task

Change performed by the Move to Bugzilla add-on.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:cpeterson, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 2

[Thomas Fitzsimmons]

Attachment: "Enable Google Play services" warning message

(I suspect this is the correct bug to which to add my report.)

On GrapheneOS I have the Google Play services sandboxed application installed, but disabled.

The Firefox mobile browser puts this warning in the Android warning area:

"Enable Google Play services
Firefox won't work unless you enable Google Play services."

Firefox seems to work fine, though.

I suggest Firefox should not require or recommend Google Play services on Android. That would obviate the need for the warning.

Failing that, at least the warning could be made more precise to indicate what specific features "won't work" if Google Play services are not installed, or installed but not enabled.