Error updating SIM Manager: fs-verity not set up for system package update

raxod502

On GrapheneOS, I use Aurora Store as my source of APK files that are not available from F-Droid. I keep the Google Play Store app disabled, to ensure that it does not receive or process any data.

This largely works as intended. However, I recently encountered an issue while trying to install an available update for an app that came pre-installed with GrapheneOS, called SIM Manager (com.google.android.euicc).

I collected the full details on the error in a bug report to Aurora Store, here: https://gitlab.com/AuroraOSS/AuroraStore/-/issues/1028. The short version is that the following error appears when installing the updated APK:

INSTALL_FAILED_INTERNAL_ERROR:
fs-verity not set up for system package update com.android.server.pm.PackageManagerException:
APK doesn't have fs-verity:
/data/app/~~PkpJBlIhFDWNOfJfO1JchQ==/com.google.android.euicc-Y1Wb2v0m1rBLFdgs5-42Ew==/base.apk

However, the response from the Aurora Store bug tracker is that this is likely a GrapheneOS issue or feature, and they suggested I report the problem here - hence this forum thread.

matchboxbananasynergy

This is expected. This app is updated via OS updates and cannot be updated through Play Store / Aurora Store.

Aurora Store has a blacklist feature so that you're not bugged about updating it through those means - you can use that for this app.

raxod502

Is it perhaps possible for GrapheneOS to communicate to Aurora Store that the SIM Manager app should not be managed by Aurora Store, since it is a system app? According to the Aurora Store devs, this is something that can be configured by the OS developers; they gave the following code example from CalyxOS for the SIM Manager app: https://gitlab.com/CalyxOS/platform_prebuilts_calyx_fdroid/-/commit/9ff1329fe2083403e216baaed40716a668eb241e

de0u

raxod502 Offhand it looks as if CalyxOS is building the Aurora Store app and shipping it in the OS. If so, they could add a custom filter list. But I don't expect the GrapheneOS project will ship the Aurora Store app.

raxod502

Ah, gotcha. I misunderstood what they were saying. Is there any interface or API that apps can use on GrapheneOS to know which apps are part of the base system? If so, then Aurora Store could simply check that and take care of things on their end.

de0u

raxod502 Is there any interface or API that apps can use on GrapheneOS to know which apps are part of the base system?

I don't know. This looks interesting, though: https://developer.android.com/reference/android/content/pm/PackageManager#MATCH_SYSTEM_ONLY

raxod502

@de0u I got an update from the Aurora Store folks - they say that (the relevant part of) what CalyxOS is doing in that linked commit is not shipping Aurora Store as part of the base OS, but just shipping a configuration file under the appropriate package namespace that will be automatically detected by Aurora Store. So I think that would be something GrapheneOS could do, if it is considered acceptable from a design perspective.

Here's the exact text:

That doesn't require shipping to the Aurora Store. The commit that I linked shows how to ship a blacklist XML file in the system that Aurora Store will read here.

de0u

raxod502 That doesn't require shipping to the Aurora Store.

That might be true, though CalyxOS does ship Aurora, with privileges [link redacted because the auto-moderator doesn't like it], so unless this has been tested for systems that don't do that it might not work as expected (I don't know how permissions work for /product/etc/com.aurora.store).

You could file an issue with GrapheneOS, but I think there is a fair chance it would be rejected, on the grounds that the issue is within an unsupported app trying to do an unsupported thing and there is an in-app workaround. I suspect the GrapheneOS team would not be eager to maintain just a little tweaking information each for multiple app stores.

Please note that I do not speak for the GrapheneOS project.

matchboxbananasynergy

This is no longer a problem since https://grapheneos.org/releases#2024011600:

hide specific system apps and also sandboxed Google Play from Aurora Store so users don't try to update them through it and receive errors

The commit can be found here:
https://github.com/GrapheneOS/platform_frameworks_base/commit/c066535741b470de04b083e5ebe7af4c186d515b

It was approached in a different way. Apps excluded from Aurora Store being able to see them are currently as follows:

Google Services Framework
Google Play Services
Google Play Store
eSIM actvation app
eSIM firmware updater app
Pixel Camera Services
Android Auto

raxod502

Amazing! Can't wait to update! (Although that is proving somewhat difficult due to the unrelated issue https://github.com/GrapheneOS/os-issue-tracker/issues/3153.)