The init script was used to do it before, but init.d has been all but
abandoned by ROMs universally, so effectively the only situation in which
the init script runs is for Magisk.
This change will be very helpful for non-Magisk users, as they will no
longer have to extract and install the APK by hand.
Also deduplicate code from init script and make it just call npem.
Sometimes when a permission is not granted (e.g. when a default permission
to a system app is ungranted by the user), dumpsys emits two lines about
it, one with granted=true and the GRANTED_BY_DEFAULT flag.
Since we are not properly parsing flags and getting the full context, just
reverse the check to make sure the value doesn't fall through.
A 'false negative' grant won't hurt anyway.
MinMicroG has always had to modify npem for its own apps, but now NanoDroid
seems to have gone on hiatus, and important changes are sitting in PRs.
I fgfure it'd be more convenient if we just maintain a clone in-tree and
keep it up to date with NanoDroid's changes.
It's much more robust and complete than jarsigner and should catch more
issues than it. I suspect the flags that I'm using to make it work for
JARs (signature format v1) is a hack and not actually an intended feature
but it works for now.
It also likely has much more availability across platforms as it's a
Java applet (separately packaged for Debian etc.) instead of being part of
a JDK.
The addon.d helper functions don't like being passed directories, so we
just use find and pass the them the files ourselves.
We could have implemented the helper functions, but there's too much of
a mess going on in the addon.d world. That will probably cause more problems
that it will solve.
The older method now required turning off 2FA which should not be recommended
in any case. App passwords are a much better alternative to use here.
This should have been updated long ago as I myself haven't been using this
method ever since 2FA.
The cksum utility is sued for the value.
It's not cryptographically secure, but this is just a simple update
check. The actual cryptographic verification is already done by
verifycerts(). Plus, cksum is POSIX amd universally available.
FriendlyNeighborhoodShane