GrapheneOS custom build fails to boot after adding prebuilt APK under external/MyApp and updating handheld_product.mk

Question

am building a custom version of GrapheneOS and have been attempting to include a prebuilt APK (Mdm.apk) into the build. To achieve this, I added the APK to the 'external/MyApp' directory and then modified 'build/target/product/handheld_product.mk' to include the entry for the new package (Mdm.apk). Additionally, I created a separate prebuilt module to include a permission XML file (app.grapheneos.appstore.xml) and specified it as a required module for Mdm.apk.

The directory structure and the relevant portion of 'handheld_product.mk' look like this:

external/
|-- MyApp/
|   |-- myapp.apk
|-- app.grapheneos.myapp.xml
build/
|-- target/
|   |-- product/
|   |   |-- handheld_product.mk

However, after making these changes, the custom build no longer boots successfully. The device gets stuck or fails to proceed beyond the boot animation. I suspect there might be an issue with the way I've included the prebuilt APK and its associated permission file in the build.

Here are the relevant portions of my 'handheld_product.mk':

include $(CLEAR_VARS)
LOCAL_MODULE := app.grapheneos.myapp.xml
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_PRODUCT_MODULE := true
LOCAL_MODULE_PATH := $(TARGET_OUT_PRODUCT_ETC)/permissions
LOCAL_SRC_FILES := permissions/$(LOCAL_MODULE)
include $(BUILD_PREBUILT)

include $(CLEAR_VARS)
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE := myapp.apk
LOCAL_MODULE_CLASS := APPS
LOCAL_PRIVILEGED_MODULE := true
LOCAL_MODULE_PATH := $(TARGET_OUT)/priv-app
LOCAL_CERTIFICATE := PRESIGNED
LOCAL_SRC_FILES := myapp.apk
LOCAL_OPTIONAL_USES_LIBRARIES := androidx.window.extensions androidx.window.sidecar
LOCAL_REQUIRED_MODULES := app.grapheneos.myapp.xml
include $(BUILD_PREBUILT)

Answer 1

Have you checked to make sure all your permissions are correct? When I had this problem before I made a build without the app in question, booted, installed (via adb, but shouldn't make a difference how) the app, and then ran:

adb shell dumpsys package [your package name here]

That should bring back a list of permissions required for install which I reformatted into my priv-app permissions list. I then rebuilt with the app in question and booted successfully.

Also based on your file structure and the makefile you have, not sure if it's a mistake but if you don't store the permissions list in "MyApp/permissions", it doesn't look like the build system will find it

Lastly, your handheld_product.mk probably doesn't look like that; my guess is that's your Android.mk which belongs in your MyApp directory. The handheld_product is where you declare your app in the list of PRODUCT_PACKAGES a bit like this:

PRODUCT_PACKAGES += \
    ...
    MyApp \