microg
Work app store
Supersedes and contains #2500. Supersedes and contains #2521.
Allows users to download apps to their work profile using the special vending component "Work app store". This component is disabled, and enabled only when a work profile is added (which in turn can only be done by a device or profile admin).
Yet to do:
- rewrite download code for components (https://github.com/microg/GmsCore/pull/2500#discussion_r1769604559)
- [x] don't allocate RAM for the entire download
- [x] download directly to installer session
- add meaningful progress information
- [x] to store app
- [x] while downloading in the background through store app
- [x] while splitinstalling
- [x] determine and verify meaning of policy field in
/getEnterpriseClientPolicy - [x] test additional dpc services
- [x] show Work app store only after adding work account
- [ ] automatic dependency installation (i.e. installing Google Chrome), see https://gitlab.com/AuroraOSS/AuroraStore/-/issues/346)
- [ ] acquire user consent before provisioning work account
- [ ] automatically install / remove apps on demand of dpc controller
Current screenshot:
@fynngodau Can it help with Shelter? https://f-droid.org/it/packages/net.typeblog.shelter/
@ale5000-git No. This PR adds support for Device Policy Controller apps that want to register a Work google account. See #2521.
Shelter use a work profile, and I remember it was failing on my device but I'm not sure if the issue is with microG or with the ROM.
@fynngodau Can the download and notification process of game sub-packages be incorporated into this project? The corresponding functions have been implemented in https://github.com/microg/GmsCore/pull/2506.
@DaVinci9196 That would be beneficial, though I will not incorporate another PR into this one as it is already quite large.
The PR is getting huge and there are still some issues with split install (can cause repeated downloads resulting in a lot of data usage). To get 0.3.6 out before Christmas, I moved this to 0.3.7. I'll see if we can split this up again and make sure that all the good code can land in 0.3.7 in January.
Split Install Service is also used outside "work app store", without it some apps may not be able to download the necessary components so I think it should have priority in my opinion.
Why not split it (the rewritten one) in a separate PR so it can be merged in less time?
Hi, was wondering if there'd be any use for classes like https://review.calyxos.org/c/CalyxOS/platform_external_microg_GmsCore/+/33556/3/play-services-auth/src/main/java/com/google/android/gms/auth/account/WorkAccountApi.java ?
Split Install Service is also used outside "work app store", without it some apps may not be able to download the necessary components so I think it should have priority in my opinion.
Why not split it (the rewritten one) in a separate PR so it can be merged in less time?
Agree with this.
Hi, was wondering if there'd be any use for classes like https://review.calyxos.org/c/CalyxOS/platform_external_microg_GmsCore/+/33556/3/play-services-auth/src/main/java/com/google/android/gms/auth/account/WorkAccountApi.java ?
@Uldiniad As far as I can tell, these classes from https://developers.google.com/android/reference/com/google/android/gms/auth/account/WorkAccount are used as an interface for the consumer of the DPC controller library, aren't they? I don't think we need to implement those in microG, as they seem not to be part of the library-to-GMS API.
/e/OS 3.1.1/3.1.2 finally include this fix. I am not sure how to access the "Work App Store" though. I am only sent to the MicroG settings.
I can now set up my work profile, but I don't see how to install work apps.
Am I missing something here? Or is that not implemented yet?
Thank you everyone who made this possible and for any help!
@agentorange96 Is your work profile set up completely such that you have a managed work account showing up under Accounts in the settings, under the Work section? If not, ensure it is allowed to set up a work account in the microG settings and do the work setup from scratch.
For /e/OS' stock launcher, it is additionally necessary to restart the device after setting up due to https://gitlab.e.foundation/e/backlog/-/issues/8275.
@fynngodau Thank you for the response! It is in the accounts section under work. I did enable that setting in MicroG before any of this, including uninstalling Intune Company Portal and removing my work profile.
I am using Nova Launcher, but also I don't seem to have that issue. If I try and launch MicroG Companion it goes to MicroG settings and gives me a toast about how there's no activity for MicroG Companion itself. (I don't remember exact text)
I do have an issue where I get stuck at "Adding your device to Company Portal" and it seems MicroG Companion is trying to launch something but fails and instantly goes back to Intune company Portal to the screen it says that at. I gave this a lot more time this time before leaving this comment, but it's still stuck.
If I close Company Portal and restart it, it's logged in. I can tap my device and register it with my org and then everything seems to be set up fine. But no way to install apps. I do get a banner at the bottom saying to use the company version of the play store, and tapping it attempts to load MicroG Companion but again it redirects to MicroG settings.
Thank you again for your help!
@agentorange96 Intune is not supposed to get stuck during setup; are you positive that the Google kind of Work account is being added to your accounts screen as well, not just Intune? I.e. I think there should be two accounts, not just one. (Of course you can send a screenshot for me to check.) Because it sounds like it is stuck at creating this account, that would explain this behavior: Intune will never retry this if it fails so you can end up correctly set up but without a work Google account configured. And you need a work Google account for the Work app store to show up in the first place!
In any case: To anaylze what went wrong a log of what is happening would be most helpful. However beware that it can contain personal data, feel free to email me at the address from fynngodau.de/imprint
@fynngodau It only shows one account and it is labeled "Work account" of the type that shows a blue and white icon depicting an ID on a lanyard. So not Google. My company does not use Google accounts. Would this be a blocker? I think given this you are on the right track. Am I supposed to set up a work profile prior to adding my work account? I was letting Intune's setup do that for me. Also I'm not sure where to find the wanted log, but I can send it if needed. Thanks!
@agentorange96 Sorry for the delay.
My company does not use Google accounts. Would this be a blocker?
Despite this being mostly invisible to the user during normal use, there is (from what I have seen) always a pseudonymous Google account associated with your Microsoft account for Intune that microG would sign in to automatically. This account is the one that will later allow you to install apps
Am I supposed to set up a work profile prior to adding my work account? I was letting Intune's setup do that for me.
Your behavior is correct – it is not possible / compatible to do this manually / in some other way.
Also I'm not sure where to find the wanted log, but I can send it if needed.
Please trigger the setup of the work profile again (including waiting the delay), then go to Developer Options → Bug report. The bug report will then be generated and you can send it to my email address or inspect it manually.
@fynngodau No problem! I'd intended to email you directly, but hadn't gotten around to it. Although I'm finding it harder to remember meetings without my phone reminders, so perhaps it's something I should put some priority on. Thank you for the explanation! I'll get those logs, give them a look over both in case it makes anything obvious to me and to remove anything sensitive and then send them your way if needed. Thank you again!