如何找出哪个 flutter 依赖项使用特定的谷歌 package（在 F-droid 上列入黑名单）？

Question

我正在尝试向 F-droid 提交一个 flutter 应用程序。

不幸的是，我收到一条消息，指出使用了来自 Google 的列入黑名单的软件包：

2022-09-25 16:57:05,704 DEBUG: Found class 'com/google/android/play/core/assetpacks/o2'
2022-09-25 16:57:05,706 DEBUG: Found class 'com/google/android/play/core/assetpacks/f2'
2022-09-25 16:57:05,707 DEBUG: Found class 'com/google/android/play/core/assetpacks/r0'
2022-09-25 16:57:05,707 DEBUG: Found class 'com/google/android/play/core/review/d'
2022-09-25 16:57:05,707 DEBUG: Found class 'com/google/android/play/core/assetpacks/y'
2022-09-25 16:57:05,708 DEBUG: Found class 'com/google/android/play/core/assetpacks/k2'
2022-09-25 16:57:05,708 DEBUG: Found class 'com/google/android/play/core/assetpacks/e1'
2022-09-25 16:57:05,708 DEBUG: Found class 'com/google/android/gms/common/api/internal/j'
2022-09-25 16:57:05,708 DEBUG: Found class 'com/google/android/gms/common/internal/p'
2022-09-25 16:57:05,709 DEBUG: Found class 'com/google/android/play/core/review/b'
2022-09-25 16:57:05,709 DEBUG: Found class 'com/google/android/play/core/assetpacks/p0'
2022-09-25 16:57:05,709 DEBUG: Found class 'com/google/android/gms/common/internal/v/c'
2022-09-25 16:57:05,709 DEBUG: Found class 'com/google/android/gms/common/api/internal/x'
2022-09-25 16:57:05,710 DEBUG: Found class 'com/google/android/gms/common/api/internal/v'
2022-09-25 16:57:05,710 DEBUG: Found class 'com/google/android/gms/common/internal/s'
2022-09-25 16:57:05,710 DEBUG: Found class 'com/google/android/gms/common/api/internal/h'
2022-09-25 16:57:05,710 DEBUG: Found class 'com/google/android/gms/common/api/internal/e0'

等等。

我的 pubspec 看起来像这样：

dependencies:
  flutter:
    sdk: flutter


  # The following adds the Cupertino Icons font to your application.
  # Use with the CupertinoIcons class for iOS style icons.
  cupertino_icons: ^1.0.2
  trufi_core:
    git:
      url: https://github.com/AddisMap/trufi-core.git
      ref: translation-am

trufi_core 的 pubspec 是这样的：

dependencies:
  app_review: ^2.1.1+1
  async_executor: ^0.0.2
  flare_flutter: ^3.0.2
  flutter:
    sdk: flutter
  flutter_localizations:
    sdk: flutter 
  flutter_map: ^0.14.0
  device_info_plus: ^3.2.4
  diff_match_patch: ^0.4.1
  latlong2: ^0.8.1
  routemaster: ^0.9.5
  geolocator: ^8.0.3
  graphql: ^5.0.0
  path_provider: ^2.0.8
  flutter_bloc: ^8.0.0
  flutter_svg: ^1.0.0 
  equatable: ^2.0.3
  provider: ^6.0.1
  package_info_plus: ^1.3.0
  rxdart: ^0.27.3
  share_plus: ^4.0.10+1
  synchronized: ^3.0.0
  cached_network_image: ^3.2.0
  uni_links: ^0.5.1
  # Workaround fix version errors for device_info_plus
  device_info_plus_platform_interface: '2.3.0+1'

是否有一些命令可以列出使用这些类的包？

我试过 gradlew，没有运气：

android$ ./gradlew -q dependencies

------------------------------------------------------------
Root project
------------------------------------------------------------

No configurations

我也试过

$ find -name "*play*"

在我的项目文件夹中，它不会产生与这些类相关的任何内容

编辑：通过猜测，我发现app_review正在引入 play store 依赖。

还剩下 gms 服务。

我还发现我可以在本地检查 APK，而不必像这样使用 F-droid 进行构建：

~/Android/Sdk/build-tools/33.0.0/dexdump build/app/outputs/flutter-apk/app-release.apk |grep gms/location

但我仍然需要猜测 flutter 包。

这些是剩余的包/类：

 cat /tmp/classes.txt | cut -d " " -f 6|rev|cut -d/ -f2-|rev|sort|uniq
'com/google/android/gms/auth/api/signin
'com/google/android/gms/auth/api/signin/a
'com/google/android/gms/common/annotation
'com/google/android/gms/common/api
'com/google/android/gms/common/api/internal
'com/google/android/gms/common/internal
'com/google/android/gms/common/internal/v
'com/google/android/gms/common/util
'com/google/android/gms/dynamite
'com/google/android/gms/location

Answer 1

这些包被下载到 flutter 缓存中。 就我而言，因为我使用 flutter 的 snap 安装，所以它位于~/snap/flutter/common/flutter/.pub-cache/hosted/pub.dartlang.org - 另一个可能的位置是~/.pub-cache/hosted/pub.dartlang.org

因此，您可以 grep 在这些文件夹中用于谷歌库，并将它们与您的项目所需的包匹配（如果您有许多 flutter 项目，您可能需要清除缓存和flutter pub get您的项目，以便在其中包含所需的包。另一种选择是将所需的包与缓存中的包相匹配。

~/snap/flutter/common/flutter/.pub-cache/hosted/pub.dartlang.org$ find -name "*.java" -exec grep -H 'import com\.google' {} \;

这将打印出需要任何谷歌库的 java 文件，您可以识别这些包。

在上面的例子中，它似乎是geolocator_android和 github 用户 Zverik 为它提供了一个补丁分支：

将此添加到 pubspec 可能会有所帮助：

dependency_overrides:
  geolocator_android:
    git:
      url: https://github.com/Zverik/flutter-geolocator.git
      ref: floss
      path: geolocator_android