Recently there have been reports of internet being inaccessible to Playstore
on dirty flashes. Android added a permission whitelist for internet, similar
to for background location, so this might fix it being missing.
I messed up with the last fix. While that solved the case where there were
both 'granted=true' and 'granted=false' entries, it introduced a regression.
It was written with the assumption that whenever a permission is not granted,
there will be 'granted=false' entries. That assumption was not tested well
at the time, and further testing has revealed that there are also many
situations where there are no 'granted=' entries for permissions at all, not
even 'false'.
Since there is no defined spec for the output of dumpsys, we just do a
pessimistic case-by-case parsing of its output.
The init script was used to do it before, but init.d has been all but
abandoned by ROMs universally, so effectively the only situation in which
the init script runs is for Magisk.
This change will be very helpful for non-Magisk users, as they will no
longer have to extract and install the APK by hand.
Also deduplicate code from init script and make it just call npem.
Sometimes when a permission is not granted (e.g. when a default permission
to a system app is ungranted by the user), dumpsys emits two lines about
it, one with granted=true and the GRANTED_BY_DEFAULT flag.
Since we are not properly parsing flags and getting the full context, just
reverse the check to make sure the value doesn't fall through.
A 'false negative' grant won't hurt anyway.
MinMicroG has always had to modify npem for its own apps, but now NanoDroid
seems to have gone on hiatus, and important changes are sitting in PRs.
I fgfure it'd be more convenient if we just maintain a clone in-tree and
keep it up to date with NanoDroid's changes.
It's much more robust and complete than jarsigner and should catch more
issues than it. I suspect the flags that I'm using to make it work for
JARs (signature format v1) is a hack and not actually an intended feature
but it works for now.
It also likely has much more availability across platforms as it's a
Java applet (separately packaged for Debian etc.) instead of being part of
a JDK.
The addon.d helper functions don't like being passed directories, so we
just use find and pass the them the files ourselves.
We could have implemented the helper functions, but there's too much of
a mess going on in the addon.d world. That will probably cause more problems
that it will solve.
The cksum utility is sued for the value.
It's not cryptographically secure, but this is just a simple update
check. The actual cryptographic verification is already done by
verifycerts(). Plus, cksum is POSIX amd universally available.
FriendlyNeighborhoodShane