如何找出哪个 flutter 依赖项使用特定的谷歌 package（在 F-droid 上列入黑名单）？

Question

I am trying to submit a flutter app to F-droid.

Unfortunately I am getting a message that blocklisted packages from Google are used:

2022-09-25 16:57:05,704 DEBUG: Found class 'com/google/android/play/core/assetpacks/o2'
2022-09-25 16:57:05,706 DEBUG: Found class 'com/google/android/play/core/assetpacks/f2'
2022-09-25 16:57:05,707 DEBUG: Found class 'com/google/android/play/core/assetpacks/r0'
2022-09-25 16:57:05,707 DEBUG: Found class 'com/google/android/play/core/review/d'
2022-09-25 16:57:05,707 DEBUG: Found class 'com/google/android/play/core/assetpacks/y'
2022-09-25 16:57:05,708 DEBUG: Found class 'com/google/android/play/core/assetpacks/k2'
2022-09-25 16:57:05,708 DEBUG: Found class 'com/google/android/play/core/assetpacks/e1'
2022-09-25 16:57:05,708 DEBUG: Found class 'com/google/android/gms/common/api/internal/j'
2022-09-25 16:57:05,708 DEBUG: Found class 'com/google/android/gms/common/internal/p'
2022-09-25 16:57:05,709 DEBUG: Found class 'com/google/android/play/core/review/b'
2022-09-25 16:57:05,709 DEBUG: Found class 'com/google/android/play/core/assetpacks/p0'
2022-09-25 16:57:05,709 DEBUG: Found class 'com/google/android/gms/common/internal/v/c'
2022-09-25 16:57:05,709 DEBUG: Found class 'com/google/android/gms/common/api/internal/x'
2022-09-25 16:57:05,710 DEBUG: Found class 'com/google/android/gms/common/api/internal/v'
2022-09-25 16:57:05,710 DEBUG: Found class 'com/google/android/gms/common/internal/s'
2022-09-25 16:57:05,710 DEBUG: Found class 'com/google/android/gms/common/api/internal/h'
2022-09-25 16:57:05,710 DEBUG: Found class 'com/google/android/gms/common/api/internal/e0'

and so on.

My pubspec looks like this:

dependencies:
  flutter:
    sdk: flutter


  # The following adds the Cupertino Icons font to your application.
  # Use with the CupertinoIcons class for iOS style icons.
  cupertino_icons: ^1.0.2
  trufi_core:
    git:
      url: https://github.com/AddisMap/trufi-core.git
      ref: translation-am

The pubspec of trufi_core like this:

dependencies:
  app_review: ^2.1.1+1
  async_executor: ^0.0.2
  flare_flutter: ^3.0.2
  flutter:
    sdk: flutter
  flutter_localizations:
    sdk: flutter 
  flutter_map: ^0.14.0
  device_info_plus: ^3.2.4
  diff_match_patch: ^0.4.1
  latlong2: ^0.8.1
  routemaster: ^0.9.5
  geolocator: ^8.0.3
  graphql: ^5.0.0
  path_provider: ^2.0.8
  flutter_bloc: ^8.0.0
  flutter_svg: ^1.0.0 
  equatable: ^2.0.3
  provider: ^6.0.1
  package_info_plus: ^1.3.0
  rxdart: ^0.27.3
  share_plus: ^4.0.10+1
  synchronized: ^3.0.0
  cached_network_image: ^3.2.0
  uni_links: ^0.5.1
  # Workaround fix version errors for device_info_plus
  device_info_plus_platform_interface: '2.3.0+1'

Is there some command to list the packages which use those classes?

I tried gradlew, no luck:

android$ ./gradlew -q dependencies

------------------------------------------------------------
Root project
------------------------------------------------------------

No configurations

Also I tried

$ find -name "*play*"

in my project folder, which does not yield anything related to those classes

EDIT: By guesswork, I found that app_review is pulling in the play store dependency.

There is still gms services left.

I also found out that I can check the APK locally without having to build with F-droid like this:

~/Android/Sdk/build-tools/33.0.0/dexdump build/app/outputs/flutter-apk/app-release.apk |grep gms/location

But still I would need to guess the flutter packages.

Those are the remaining packages/classes:

 cat /tmp/classes.txt | cut -d " " -f 6|rev|cut -d/ -f2-|rev|sort|uniq
'com/google/android/gms/auth/api/signin
'com/google/android/gms/auth/api/signin/a
'com/google/android/gms/common/annotation
'com/google/android/gms/common/api
'com/google/android/gms/common/api/internal
'com/google/android/gms/common/internal
'com/google/android/gms/common/internal/v
'com/google/android/gms/common/util
'com/google/android/gms/dynamite
'com/google/android/gms/location

Answer 1

The packages are downloaded to the flutter cache. In my case, because I use a snap installation of flutter, this is in ~/snap/flutter/common/flutter/.pub-cache/hosted/pub.dartlang.org - another possible location is ~/.pub-cache/hosted/pub.dartlang.org

So you can grep in those folders for google libraries and match them with the packages required from your project (if you have many flutter projects you might want to clear the cache and flutter pub get on your project to just have the required packages in there. Another option would be to match the required packages with those in the cache.

~/snap/flutter/common/flutter/.pub-cache/hosted/pub.dartlang.org$ find -name "*.java" -exec grep -H 'import com\.google' {} \;

This will print out the java files requiring any google libraries and you can identify the packages.

In the above case it seems to be geolocator_android and github user Zverik provided a patched branch for it:

Adding this to pubspec might help:

dependency_overrides:
  geolocator_android:
    git:
      url: https://github.com/Zverik/flutter-geolocator.git
      ref: floss
      path: geolocator_android