Distributions
Rebuilding the Android SDK
Android is, while not a "traditional" Linux distribution, certainly the most widely deployed Linux system seen thus far. Precisely what makes it such a success is a matter of some debate, and there are those within Google who maintain that the company's strict attention to preventing forks and fragmentation of the code base are a major factor. But that commitment to maintaining a predictable definition of "what constitutes Android" may have led to a serious problem for free-software developers. In particular, recent versions of the Android software development kit (SDK) and related tools have been distributed in a bundle that requires the downloader to agree to some potentially onerous limitations of use. At least one developer found those terms to be unacceptable, and proceeded to start building the free portion of the tools over from scratch.
Sylvain Beucler, best known to many in the community for his work on the GNU Savannah and Gna! code-hosting services, raised the issue in a blog post on September 21. He noted that the new version of the Android tools—including the SDK, the native development kit (NDK), the Android Development Tools for Eclipse (ADT), and Android Studio—include code that is released under the Apache 2 and GPLv2 licenses, but are, collectively, wrapped in a click-through license agreement that includes two problematic clauses.
The first is a clause stating that the user agrees not to:
The second is a clause restricting usage of the tools solely to developing Android applications. That restriction includes specific limitations on how and where the tools can be run:
Beucler notes that the click-through agreement is only attached to the installer program provided on the main download site: if one knows (or can guess) the URLs, the individual binaries can be downloaded separately. Moreover, a significant portion of the tool set is published in source form, too, although building it can be a lengthy process, since it involves building emulator targets for multiple hardware profiles and more than 20 API levels of Android releases.
The click-through agreement may sound like a GPL violation at first (given that it restricts usage), but the text also includes disclaimers that "clarify" that the restrictions apply only to those portions of the tool set not under the Apache 2 and GPLv2 licenses. For example, after the "no fragmentation" clause comes the following addendum:
A similar statement accompanies the usage-restriction clause.
Nonetheless, the competing clauses at the very least are resulting in some confusion over what can and cannot be done using the click-through-wrapped binaries, so Beucler decided to begin a from-source rebuild of all of the free-software components of the tool set. On October 1, he announced that the free rebuilds of the SDK, NDK, and ADT were ready for consumption, and available at android-rebuilds.beuc.net. The page tracks the build status of each component, including the individual target platforms and API levels, and indicates those for which source code has not yet been released. It also provides links to Linux and Windows binaries for each component built.
Also included for each rebuilt component is a detailed description of the build environment, dependencies, and the build process used. Beucler notes that this information may help to assess the reproducibility of the various builds.
Long-term issues
This is not the first time that the concerns about the usage clauses attached to the Android SDK and related tools have been raised. In 2013, Paul Kocialkowski from the Replicant project wrote a blog post highlighting an older iteration of the usage-restriction clause. The eventual outcome of that post was a rebuild of the tool set by Replicant. Unfortunately, that rebuild—while still of value to developers targeting Replicant—is no longer current enough to serve the needs of contemporary Android app developers.
Complicating matters is the fact that no one seems entirely certain how the various clauses on the click-through agreement legally interact—or, more specifically, how Google's legal department believes they interact. The "clarification" clauses purport to impose no restrictions on the Apache and GPL-licensed components. But if those components are part of a combined work with the restricted components, then there might be a GPL violation. In any case, the restrictions claimed on the entire downloadable suite of tools is clearly enough to make some free-software developers want to steer clear. In addition, it is not clear whether or not the "personal computer" limitation would be seen to cover a server that uses the SDK to run automated builds. That is of concern to the F-Droid repository project, among others.
Beucler has asked interested members of the free-software community to contact him if they are interested in hosting the rebuilds for the long term. It is apparently a significant undertaking; the rebuilds currently take Beucler several days to run. In addition to his blog post, he contacted the the Free Software Foundation Europe (FSFE) for feedback and for input on the hosting question. FSFE hosts a mailing list to discuss software-freedom issues related to Android. Regrettably, although approval is not required to sign up for the list, the list archives are available to subscribers only, so discussions held there cannot be linked to.
There was a brief thread discussing Beucler's rebuilds and the licensing uncertainty, though. The first question was whether or not rebuilds of the Android tools should be hosted by either the Replicant or F-Droid projects. A representative from F-Droid replied that the project would be willing, in theory, to switch to an alternative source for the Android SDK (currently, F-Droid uses the official binaries provided by Google), but cautioned that it would have to ensure that the new builds continued to correspond exactly to the official offering. Otherwise, F-Droid's app packages might suffer and the project would have little choice but to switch back to Google's binary downloads, EULA or not.
This may be an issue that requires quite a bit of further debate; some people are already concerned that F-Droid is in violation of the license on the Android build tools. Others believe that the click-through license is a GPL violation or clearly unenforceable, in which case the best path forward is to take up the question with Google. In the meantime, developers concerned about running afoul of the Android SDK's license would be wise to give that license a thorough reading.
Brief items
Distribution quote of the week
Supporting all of this, the technical and the non-technical things, and empowering the people who do it, that's where the magic happens.
Newsletters and articles of interest
Distribution newsletters
- DistroWatch Weekly, Issue 630 (October 5)
- 5 things in Fedora this week (October 2)
- Linux Mint Monthly News (September)
- Ubuntu Weekly Newsletter, Issue 437 (October 4)
Android 6.0 Marshmallow, thoroughly reviewed (Ars Technica)
Ars Technica presents a lengthy review of Android 6.0 "Marshmallow". "While this is a review of the final build of "Android 6.0," we're going to cover many of Google's apps along with some other bits that aren't technically exclusive to Marshmallow. Indeed, big chunks of "Android" don't actually live in the operating system anymore. Google offloads as much of Android as possible to Google Play Services and to the Play Store for easier updating and backporting to older versions, and this structure allows the company to retain control over its open source platform. As such, consider this a look at the shipping Google Android software package rather than just the base operating system. "Review: New Android stuff Google has released recently" would be a more accurate title, though not as catchy."
Page editor: Rebecca Sobol
Next page:
Development>>