oxmc
d1832f4b35
The XML only carried the two microG repos; add F-Droid Official, IzzyOnDroid and FUTO so the prebuilt client ships the same repo set as the JSON. The XML string-array needs the full DER-encoded signing certificate, not the SHA-256 fingerprint the JSON stores, so each certificate was pulled from that repo's index-v1.jar signature block and verified: SHA-256 of the DER matches the fingerprint in the JSON. microG pubkeys are unchanged.
vendor/partner_gms — PawletOS
Bundles a small set of prebuilt FOSS APKs (microG + app stores) into the PawletOS build. Forked from lineageos4microg/android_vendor_partner_gms and trimmed down for PawletOS — this repo now just documents and installs the apps below; it is no longer kept in sync with upstream.
All APKs are official, unmodified prebuilts signed by their original developers
(presigned: true), so signature spoofing works and the stores can self-update.
Included apps
| App | Package | Purpose |
|---|---|---|
| GmsCore | com.google.android.gms |
microG — FOSS reimplementation of Google Play Services |
| FakeStore | com.android.vending |
Empty stub that mocks the Play Store's presence for apps that require it |
| GsfProxy | com.google.android.gsf |
GmsCore proxy for legacy GCM compatibility |
| F-Droid | org.fdroid.fdroid |
FOSS app catalogue |
| F-Droid Privileged Extension | org.fdroid.fdroid.privileged |
Silent install/removal for F-Droid |
| Aurora Store | com.aurora.store |
Play Store client (preload variant) |
apps/FDroid/additional_repos.xml pre-seeds the microG F-Droid repo.
How it's wired
vendorsetup.shdownloads each APK (from GitHub / F-Droid / GitLab) into itsapps/**folder at sync time. Versions are pinned by the.version_codefile next to each app (and.microg_releasefor the microG bundle).gms.mkadds the modules toPRODUCT_PACKAGES.- Each app's
Android.bpimports the APK and, where needed, installs itsprivapp-permissions-*.xml(privileged allowlist) anddefault-permissions-*.xml(runtime pre-grants).
Signature spoofing
Restricted / system-level only. The FAKE_PACKAGE_SIGNATURE permission is
declared signature|privileged by the framework patch in
patches/frameworks/base/, so no third-party app can request it. It is
granted only via privapp-permissions to the privileged microG apps that need it
(com.google.android.gms, com.android.vending).
Maintainer notes
When bumping to a new microG release, update the pinned versions:
.microg_releaseapps/GMS/GmsCore/.version_codeapps/FakeStore/.version_code
Other apps pin their own .version_code (apps/GMS/GsfProxy,
apps/FDroid, apps/FDroid/FDroidPrivilegedExtension, apps/AuroraStore).