As described in 204837/2#message-9ecc61fe611f195b13f5770e33904afccb01c2fa :
The "network location provider" which is finally used is selected in three steps:
- first the signatures of all packages, which are in this list AND which are installed in system, are collected (services/core/java/com/android/server/ServiceWatcher.java#L96)
- secondly the packages which implement the "network location provider service" are selected and their signatures are compared against the previous collected signatures (#L225)
- thirdly these packages are requested for their "serviceVersion" in metadate. The package which provides the highest version is used. If there are two packages with the same serviceVersion the first selected wins. (#L243)
There are no security implications because there has to be a proper signed package of "org.microg.nlp" in sytem first. (The check against the signature of this package allows for later updates of the package outside of system)
To quote Andreas Schneider from 204837:
"This doesn't have security implications as in order to use the location provider in needs to be installed as a system app. However this would allow it to be flashed to system like gapps."
On my opinion it's up to the user to decide if he want to use Gapps and Unified / MicroG. But in the first place this patch is needed to make it possible.
Change-Id: I4a046ead2cc46929d2c18cfe1561becb10a75bcd
Greenflash1986
157fff1af9