oxmc
ae9e830f7f
Bound service BgUpd consults before downloading component assets: discovers a trusted cache server (mDNS and/or central lookup, policy- configurable), verifies its signed CacheToken against a pinned root key, and hands back a rewritten URL + TLS pin. Three-tier discovery policy (runtime MDM override -> vendor-baked default -> compiled default). Pairs with pawletcache-server (the LAN daemon) and BgUpd (the caller).
39 lines
1.3 KiB
XML
39 lines
1.3 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<!--
|
|
SPDX-FileCopyrightText: oxmc / PawletOS
|
|
SPDX-License-Identifier: Apache-2.0
|
|
-->
|
|
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
|
|
package="os.pawlet.cache"
|
|
android:versionCode="1">
|
|
|
|
<uses-permission android:name="android.permission.INTERNET" />
|
|
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
|
|
<uses-permission android:name="android.permission.ACCESS_WIFI_STATE" />
|
|
<uses-permission android:name="android.permission.CHANGE_WIFI_MULTICAST_STATE" />
|
|
|
|
<!-- Signature-level permission so only platform-signed callers (BgUpd,
|
|
and later the OTA/media resolvers) can bind IPawletCacheService. -->
|
|
<permission
|
|
android:name="pawletos.cache.permission.BIND_RESOLVER"
|
|
android:protectionLevel="signature" />
|
|
|
|
<application
|
|
android:allowBackup="false"
|
|
android:label="@string/app_name"
|
|
android:persistent="false"
|
|
android:supportsRtl="true">
|
|
|
|
<service
|
|
android:name=".PawletCacheService"
|
|
android:exported="true"
|
|
android:permission="pawletos.cache.permission.BIND_RESOLVER">
|
|
<intent-filter>
|
|
<action android:name="pawletos.cache.action.BIND" />
|
|
</intent-filter>
|
|
</service>
|
|
|
|
</application>
|
|
|
|
</manifest>
|