Apks with non-free components, AntiFeatures etc part 3: Tracking

Follow-up to #2272 (closed) and #2286 (closed)

This one is about tracking libraries which are using a free license and where it's not clear whether they are opt-in or need the Tracking AntiFeature. General question: How to deal with such findings if there's no note in the YAML for clarification? Generally, once figured out, that should be put to MaintainerNotes so we need to "wonder" only once. If there's no such note at all, shall we

  • add the Tracking AntiFeature as a precaution, and wait until someone "complains" proving otherwise?
  • ask upstream (and add Tracking if there's no answer within a reasonable time frame, say 1..2 weeks)?
  • find someone to install-and-find-out (e.g. using a packet sniffer)?

Further, how do we deal with it if only some builds have the library (but not the latest ones), i.e. it was removed meanwhile? We have no such thing as per-build AntiFeatures yet. Suggestion: disable the affected builds?

/com/adjust/sdk

License: MIT. So these apps just require Tracking

  • org.mozilla.rocket: has Tracking; also uses /org/mozilla/telemetry (MPL) – again Tracking only, so covered

/org/mozilla/telemetry

License: MPL.

  • org.mozilla.klar
    • affected builds: 9-19,230-232
    • no Tracking set
    • no MaintainerNotes, so unclear whether disabled by default
    • 230-232 also have Sentry

/io/sentry

License: Apache-2.0. Needs Tracking if not opt-in

  • com.dougkeen.bart: 50
  • com.eventyay.organizer: 15,16,17 – has Tracking √
  • com.mattermost.rnbeta: 193,296
    • 296 also has /com/android/vending
    • updates disabled, the only newer build disabled as well
    • no other versions affected
  • de.geeksfactory.opacclient: 209,210,213..227
  • eu.pretix.pretixprint: 8,11,13..21
  • eu.pretix.pretixscan.droid: 16,17,21 (ff?)
  • io.mkg20001.arubanetworkslogin: 5000 (only one – which unfortunately is the latest)
  • org.adaway: opt-in, see below comment
  • tech.ula: 64,67,835694
Edited by Izzy