add f-droid and priv ext as a base system app

[Kokokokoka]

Maybe there should be auditor installed by default too.

[thestinger]

Bundling more apps is something that will likely happen in the future, but it isn't going to be done in the short term. F-Droid also has a lot of bugs and usability issues, especially with the privileged extension, and it's not currently going to be possible to bundle that. It's broken with various new / split permissions including the OTHER_SENSORS permission added for the Sensors permission toggle in GrapheneOS. I previously maintained a patch working around this, but I want it to be fixed properly in a way that handles the standard new / split permissions too. It's only going to get worse with Android Q. I also take issue with how the standard F-Droid repository is managed. Many of the apps are abandoned and known to be insecure with unpatched vulnerabilities. They aren't hidden by default or marked as such. Apps also often go quite a while without receiving their upstream updates. For now, I would prefer if people install F-Droid themselves because the privileged extension is too broken and it's not currently up to the standards of GrapheneOS as a whole.

[Kokokokoka]

As a side note:
will you recreate noise app with repo?
Or one should use signal?

[thestinger]

You should use Signal.

[thestinger]

This is not currently planned for various reasons.

See #94 instead.

[khimaros]

For now, I would prefer if people install F-Droid themselves because the privileged extension is too broken and it's not currently up to the standards of GrapheneOS as a whole.

Sorry to revive a dead thread here, but wanted clarification. Are you suggesting to manually install/update all apps installed with F-Droid or is it possible for a user to install the privileged extension on the OTA releases of GrapheneOS?

[thestinger]

is it possible for a user to install the privileged extension on the OTA releases of GrapheneOS

That's not possible and the privileged extension is too broken for real world usage so it's not a viable option anyway.

[ypid]

I successfully build AOSP with priv ext 0.2.10 included and able to install apps. I am not sure how reliable it is yet. @khimaros Not sure if it works on GrapheneOS also.

Ref: hashbang/os#40

[thestinger]

Android 12 has support for unattended app updates by an app's installer. The installer is the app which installed the most recent version, so an app can take over providing updates after the user approves one update through it. Of course, it needs to have a matching signing key for that to be possible.