add support for delta updates and switch from gzip to brotli; verify app icon hashes before decoding them with Glide

.github/workflows/build.yml

@@ -8,11 +8,19 @@ jobs:
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          submodules: true
       - name: Set up JDK 21
         uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: 'temurin'
           java-version: 21
           cache: gradle
+      - name: Set up Rust
+        working-directory: ina
+        run: |
+          rustup toolchain install
+          rustup target add aarch64-linux-android x86_64-linux-android
+      - run: yes | "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" --install "ndk;30.0.16248370"
       - name: Build with Gradle
         run: ./gradlew build --no-daemon

.github/workflows/validate-gradle-wrapper.yml

@@ -8,4 +8,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          submodules: true
       - uses: gradle/actions/wrapper-validation@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0

.gitmodules

@@ -0,0 +1,4 @@
+[submodule "ina"]
+	path = ina
+	url = https://github.com/GrapheneOS/ina
+	branch = main

app/build.gradle.kts

@@ -34,15 +34,15 @@ android {
         }
     }
 
-    compileSdk = 36
-    buildToolsVersion = "36.1.0"
+    compileSdk = 37
+    buildToolsVersion = "37.0.0"
 
     namespace = "app.grapheneos.apps"
 
     defaultConfig {
         applicationId = "app.grapheneos.apps"
         minSdk = 31
-        targetSdk = 36
+        targetSdk = 37
         versionCode = 36
         versionName = versionCode.toString()
 
@@ -91,6 +91,8 @@ android {
 }
 
 dependencies {
+    implementation(libs.ina)
+
     implementation(libs.androidx.core.ktx)
     implementation(libs.androidx.appcompat)
     implementation(libs.androidx.constraintlayout)

app/src/main/java/app/grapheneos/apps/Notifications.kt

@@ -19,6 +19,7 @@ import app.grapheneos.apps.util.checkMainThread
 object Notifications {
     const val ID_PACKAGE_DOWNLOAD = 1
     const val ID_AUTO_UPDATE_JOB_STATUS = 2
+    const val ID_AUTO_UPDATE_DOWNLOAD_FAILED = 3
 
     private const val FIRST_DYNAMIC_ID = 1000
 

app/src/main/java/app/grapheneos/apps/PackageDownloadFgService.kt

@@ -36,7 +36,7 @@ class PackageDownloadFgService : Service() {
             }
 
             val progress = downloading.sumOf { it.downloadProgress.get() }
-            val total = downloading.sumOf { it.downloadTotal }
+            val total = downloading.sumOf { it.downloadTotal.get() }
             val remaining = total - progress
             val remainingStr = Formatter.formatShortFileSize(appContext, remaining)
 

app/src/main/java/app/grapheneos/apps/RpcProvider.kt

@@ -8,6 +8,7 @@ import android.net.Uri
 import android.os.Bundle
 import android.os.Message
 import android.os.Messenger
+import android.os.RemoteException
 import android.util.Log
 import app.grapheneos.apps.autoupdate.AutoUpdatePrefs
 import app.grapheneos.apps.core.InstallParams
@@ -16,29 +17,40 @@ import app.grapheneos.apps.core.PackageState
 import app.grapheneos.apps.core.startPackageInstall
 import app.grapheneos.apps.core.pkgManager
 import app.grapheneos.apps.util.getApplicationInfo
+import app.grapheneos.apps.util.getPackageInfoOrNull
+import app.grapheneos.apps.util.isSystemPackage
 import app.grapheneos.apps.util.maybeGetParcelable
 import app.grapheneos.apps.util.toInt
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.launch
 
+private const val TAG = "RpcProvider"
+
 class RpcProvider : ContentProvider() {
 
     override fun call(method: String, arg: String?, extras: Bundle?): Bundle? {
         when (method) {
             "update_package" -> {
                 val callingPackage = callingPackage!!
+                if (pkgManager.getPackageInfoOrNull(callingPackage)?.isSystemPackage() != true) {
+                    return null
+                }
                 val pkgName = arg!!
                 val callback = extras?.maybeGetParcelable<Messenger>("callback")
                 CoroutineScope(Dispatchers.Main).launch {
                     val res = runCatching {
                         updatePackage(callingPackage, pkgName)
                     }
                     res.exceptionOrNull()?.let {
-                        Log.e("RpcProvider", method, it)
+                        Log.e(TAG, method, it)
                     }
                     val resBool = res.getOrNull() ?: false
-                    callback?.send(Message().apply { arg1 = resBool.toInt() })
+                    try {
+                        callback?.send(Message().apply { arg1 = resBool.toInt() })
+                    } catch (e: RemoteException) {
+                        Log.e(TAG, method, e)
+                    }
                 }
                 return null
             }

app/src/main/java/app/grapheneos/apps/autoupdate/UpdateCheckJob.kt

@@ -1,8 +1,10 @@
 package app.grapheneos.apps.autoupdate
 
 import android.app.Notification
+import android.app.PendingIntent
 import android.app.job.JobParameters
 import android.app.job.JobService
+import android.content.Intent
 import android.text.format.Formatter
 import android.util.Log
 import androidx.navigation.NavDeepLinkBuilder
@@ -20,7 +22,9 @@ import app.grapheneos.apps.show
 import app.grapheneos.apps.ui.DetailsScreen
 import app.grapheneos.apps.ui.ErrorDialog
 import app.grapheneos.apps.ui.MainActivity
+import app.grapheneos.apps.util.ActivityUtils
 import app.grapheneos.apps.util.componentName
+import app.grapheneos.apps.util.intent
 import app.grapheneos.apps.util.isAppInstallationAllowed
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
@@ -84,7 +88,8 @@ class UpdateCheckJob : JobService() {
 
         val config = appResources.configuration
         val sumSize = rPackages.sumOf {
-            it.collectNeededApks(config).sumOf { it.compressedSize }
+            val state = PackageStates.getPackageState(it.packageName)
+            it.calculateDownloadSize(state, it.collectNeededApks(config))
         }.let {
             Formatter.formatShortFileSize(appContext, it)
         }
@@ -123,10 +128,16 @@ fun showAllUpToDateNotification() {
         return
     }
 
+    ActivityUtils.cancelPendingAction(Notifications.ID_AUTO_UPDATE_DOWNLOAD_FAILED)
+
     Notifications.builder(Notifications.CH_AUTO_UPDATE_ALL_UP_TO_DATE).run {
         setSmallIcon(R.drawable.ic_check)
         setContentTitle(R.string.notif_auto_update_all_up_to_date)
-        setAutoCancel(false)
+        setAutoCancel(false) // this notification is a security status indicator
+        val contentIntent = PendingIntent.getActivity(appContext, 0,
+            intent<MainActivity>().setFlags(Intent.FLAG_ACTIVITY_SINGLE_TOP),
+            PendingIntent.FLAG_IMMUTABLE)
+        setContentIntent(contentIntent)
         show(Notifications.ID_AUTO_UPDATE_JOB_STATUS)
     }
 }

app/src/main/java/app/grapheneos/apps/core/Errors.kt

@@ -128,6 +128,8 @@ class RepoUpdateError(val throwable: Throwable, val wasUpdateManuallyRequested:
     }
 }
 
+class InvalidDeltaBaseApkException(msg: String?) : Exception(msg)
+
 // All errors that happen before the installer session is committed are considered to be download
 // errors, "download" means "download into PackageInstaller session", not just "download from the
 // network"
@@ -142,6 +144,8 @@ class DownloadError(val pkgLabels: List<String>, val throwable: Throwable) : Err
             is PackagesBusyException ->
                 return appResources.getQuantityString(R.plurals.download_error_packages_busy,
                     throwable.packageNames.size)
+            is InvalidDeltaBaseApkException ->
+                return appResources.getString(R.string.download_error_delta_base_apk_invalid)
         }
         return null
     }

app/src/main/java/app/grapheneos/apps/core/Globals.kt

@@ -50,8 +50,9 @@ val localeManager: LocaleManager? = if (Build.VERSION.SDK_INT >= 33)
     appContext.getSystemService()!! else null
 
 val filesDir: File = appContext.filesDir
-val fileForTemporaryFileDescriptor = File(filesDir, "tmp_fd")
 val cacheDir: File = appContext.cacheDir
 
 // limit the number of concurrent downloads
 val httpDownloadSemaphore = Semaphore(3)
+// limit ina memory use
+val inaPatcherSemaphore = Semaphore(5)

app/src/main/java/app/grapheneos/apps/core/InstallStart.kt

@@ -165,7 +165,7 @@ private fun startInstallTaskInner(pkgs: List<RPackage>, params: InstallParams,
 }
 
 private fun handleInstallTaskError(tasks: List<InstallTask>, throwable: Throwable) {
-    if (tasks.any { !it.params.isUserInitiated || it.isManuallyCancelled }) {
+    if (tasks.any { it.isManuallyCancelled }) {
         return
     }
 
@@ -182,10 +182,17 @@ private fun handleInstallTaskError(tasks: List<InstallTask>, throwable: Throwabl
     } ?: return
 
     val template = DownloadError(tasks.map { it.rPackage.label }, error)
-    val pendingAction = ErrorDialog.createPendingDialog(template)
+    val pendingDialog = ErrorDialog.createPendingDialog(template)
 
-    ActivityUtils.addPendingAction(pendingAction) {
-        Notifications.builder(Notifications.CH_PACKAGE_DOWLOAD_FAILED).apply {
+    val notifChannel = if (tasks.any { !it.params.isUserInitiated }) {
+        pendingDialog.notificationId = Notifications.ID_AUTO_UPDATE_DOWNLOAD_FAILED
+        Notifications.CH_AUTO_UPDATE_FAILED
+    } else {
+        Notifications.CH_PACKAGE_DOWLOAD_FAILED
+    }
+
+    ActivityUtils.addPendingAction(pendingDialog) {
+        Notifications.builder(notifChannel).apply {
             setSmallIcon(R.drawable.ic_error)
             setContentTitle(R.string.notif_download_failed)
             setContentText(tasks.map { it.rPackage.label }.joinToString())