[Replicant] Proprietary blob found in all Replicant 6.0 builds

[Denis 'GNUtoo' Carikli]

On Tue, 3 Nov 2020 16:48:33 +0100
Denis 'GNUtoo' Carikli <GNUtoo at cyberdimension.org> wrote:
> > A few months after LineageOS forked, some bits of Ambient's
> > integration were removed. However a lot still remains in the
> > currently available today trees.
> > https://github.com/LineageOS/android_vendor_cm/blob/cm-13.0/ambientsdk/Android.mk
> >
> > Due to Replicant being a fork of LineageOS, it too contains Ambient.
> > 
> > All 6.0 Replicant builds contain the proprietary AmbientSDK Java
> > library blob. I have verified this by decompilation.
> Do you have more details on that?
> More precisely:
> - Is there a file name or set of file names?
> - Do you know the location of the binaries in the source code
>   repositories?
> 
> After trying to remove it, it might be a good idea to test if it is
> really removed.
Note that I'm not familiar with maven, pom and all that.

According to Putti on #replicant, That Android.mk "seems to download it
from https://repo1.maven.org/maven2". That wasn't clear to me at
first.

So I'll try to remove it and see what happens.

Thanks to that info I've also looked at the aar file that is supposed to
be under the Apache2 license according to the pom, but it indeed
contains a class.jar without the corresponding source code. 

In addition at least some of the files contains the following:
> /*====*====*====*====*====*====*====*====*====*====*====*====*====*====*====*
>  *  Copyright (c) 2015 Cyanogen Inc.
>  *     All Rights Reserved.
>  *     Cyanogen Confidential and Proprietary.
>  *
> =========================================================================*/

Denis.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.osuosl.org/pipermail/replicant/attachments/20201103/201e9431/attachment.asc>