How to find out which flutter dependency uses a specific google package (blocklisted on F-droid)?

Question

I am trying to submit a flutter app to F-droid.

Unfortunately I am getting a message that blocklisted packages from Google are used:

2022-09-25 16:57:05,704 DEBUG: Found class 'com/google/android/play/core/assetpacks/o2'
2022-09-25 16:57:05,706 DEBUG: Found class 'com/google/android/play/core/assetpacks/f2'
2022-09-25 16:57:05,707 DEBUG: Found class 'com/google/android/play/core/assetpacks/r0'
2022-09-25 16:57:05,707 DEBUG: Found class 'com/google/android/play/core/review/d'
2022-09-25 16:57:05,707 DEBUG: Found class 'com/google/android/play/core/assetpacks/y'
2022-09-25 16:57:05,708 DEBUG: Found class 'com/google/android/play/core/assetpacks/k2'
2022-09-25 16:57:05,708 DEBUG: Found class 'com/google/android/play/core/assetpacks/e1'
2022-09-25 16:57:05,708 DEBUG: Found class 'com/google/android/gms/common/api/internal/j'
2022-09-25 16:57:05,708 DEBUG: Found class 'com/google/android/gms/common/internal/p'
2022-09-25 16:57:05,709 DEBUG: Found class 'com/google/android/play/core/review/b'
2022-09-25 16:57:05,709 DEBUG: Found class 'com/google/android/play/core/assetpacks/p0'
2022-09-25 16:57:05,709 DEBUG: Found class 'com/google/android/gms/common/internal/v/c'
2022-09-25 16:57:05,709 DEBUG: Found class 'com/google/android/gms/common/api/internal/x'
2022-09-25 16:57:05,710 DEBUG: Found class 'com/google/android/gms/common/api/internal/v'
2022-09-25 16:57:05,710 DEBUG: Found class 'com/google/android/gms/common/internal/s'
2022-09-25 16:57:05,710 DEBUG: Found class 'com/google/android/gms/common/api/internal/h'
2022-09-25 16:57:05,710 DEBUG: Found class 'com/google/android/gms/common/api/internal/e0'

and so on.

My pubspec looks like this:

dependencies:
  flutter:
    sdk: flutter


  # The following adds the Cupertino Icons font to your application.
  # Use with the CupertinoIcons class for iOS style icons.
  cupertino_icons: ^1.0.2
  trufi_core:
    git:
      url: https://github.com/AddisMap/trufi-core.git
      ref: translation-am

The pubspec of trufi_core like this:

dependencies:
  app_review: ^2.1.1+1
  async_executor: ^0.0.2
  flare_flutter: ^3.0.2
  flutter:
    sdk: flutter
  flutter_localizations:
    sdk: flutter 
  flutter_map: ^0.14.0
  device_info_plus: ^3.2.4
  diff_match_patch: ^0.4.1
  latlong2: ^0.8.1
  routemaster: ^0.9.5
  geolocator: ^8.0.3
  graphql: ^5.0.0
  path_provider: ^2.0.8
  flutter_bloc: ^8.0.0
  flutter_svg: ^1.0.0 
  equatable: ^2.0.3
  provider: ^6.0.1
  package_info_plus: ^1.3.0
  rxdart: ^0.27.3
  share_plus: ^4.0.10+1
  synchronized: ^3.0.0
  cached_network_image: ^3.2.0
  uni_links: ^0.5.1
  # Workaround fix version errors for device_info_plus
  device_info_plus_platform_interface: '2.3.0+1'

Is there some command to list the packages which use those classes?

I tried gradlew, no luck:

android$ ./gradlew -q dependencies

------------------------------------------------------------
Root project
------------------------------------------------------------

No configurations

Also I tried

$ find -name "*play*"

in my project folder, which does not yield anything related to those classes

EDIT: By guesswork, I found that app_review is pulling in the play store dependency.

There is still gms services left.

I also found out that I can check the APK locally without having to build with F-droid like this:

~/Android/Sdk/build-tools/33.0.0/dexdump build/app/outputs/flutter-apk/app-release.apk |grep gms/location

But still I would need to guess the flutter packages.

Those are the remaining packages/classes:

 cat /tmp/classes.txt | cut -d " " -f 6|rev|cut -d/ -f2-|rev|sort|uniq
'com/google/android/gms/auth/api/signin
'com/google/android/gms/auth/api/signin/a
'com/google/android/gms/common/annotation
'com/google/android/gms/common/api
'com/google/android/gms/common/api/internal
'com/google/android/gms/common/internal
'com/google/android/gms/common/internal/v
'com/google/android/gms/common/util
'com/google/android/gms/dynamite
'com/google/android/gms/location

What if you ask the creators of trufi_core? They don't answer? — Karolina Hagegård, Oct 01 '22 at 19:05
I am in contact with them, still the question stands how to find out the java dependencies of flutter packages. I think that would be very useful. — Alex, Oct 02 '22 at 07:09
Hi @Alex, flutter_map maintainer here - noticed it in your pubspec.yaml. On a probably unrelated note to your issue, please update to flutter_map v3 when you can! v0.14.0 is now very outdated and old, and it's best to migrate sooner rather than later. If you need help, we'll be happy to help over on the Discord server. — JaffaKetchup, Oct 06 '22 at 18:06
@JaffaKetchup good comment, already on the way https://github.com/trufi-association/trufi-core/blob/main/pubspec.yaml#L27 — Alex, Oct 07 '22 at 12:28

score 1 · Accepted Answer · answered Oct 03 '22 at 08:10

The packages are downloaded to the flutter cache. In my case, because I use a snap installation of flutter, this is in ~/snap/flutter/common/flutter/.pub-cache/hosted/pub.dartlang.org - another possible location is ~/.pub-cache/hosted/pub.dartlang.org

So you can grep in those folders for google libraries and match them with the packages required from your project (if you have many flutter projects you might want to clear the cache and flutter pub get on your project to just have the required packages in there. Another option would be to match the required packages with those in the cache.

~/snap/flutter/common/flutter/.pub-cache/hosted/pub.dartlang.org$ find -name "*.java" -exec grep -H 'import com\.google' {} \;

This will print out the java files requiring any google libraries and you can identify the packages.

In the above case it seems to be geolocator_android and github user Zverik provided a patched branch for it:

Adding this to pubspec might help:

dependency_overrides:
  geolocator_android:
    git:
      url: https://github.com/Zverik/flutter-geolocator.git
      ref: floss
      path: geolocator_android

How to find out which flutter dependency uses a specific google package (blocklisted on F-droid)?

1 Answers1