PMCA-RE RELOADED installs camera apps and plugins from sources: public GitHub repositories in which developers publish their own work. The program ships no source, hosts nothing and checks nothing. Users add the sources they choose, and the author of a source alone is responsible for what it offers. Anyone may publish a source; nobody has to approve it.
This page describes what a source has to look like (format version 1).
.apk) or plugin. For a plugin, create a key
once with pmca-console plugins keygen my-plugins.key and pack with
pmca-console plugins pack <folder> my-plugin.pmcaplugin --key my-plugins.key..apk or .pmcaplugin
attached.In a public repository — the project itself or one listing several of your
projects — add pmca-source.yaml at the root of the default branch:
---
package: com.example.timelapse
name: Timelapse
author: Jane Doe
desc: Interval shooting with exposure ramping
release:
type: github
user: janedoe
repo: timelapse
pmca-source and describe your work in its
README.pmca-console sources add janedoe/your-repository,
then pmca-console apps or pmca-console plugins available.Later releases reach your users on their own; the source file only changes when you add or remove an entry.
pmca-source.yaml.pmca-source. The program’s search, which
runs only when a user asks for it, finds repositories by that topic.Users add a source as owner/repository or with its address, in the app under
Settings → App and plugin sources or with
pmca-console sources add owner/repository.
pmca-source.yamlThe file uses the format of the
OpenMemories app list, so an
existing entry can be copied unchanged. It is a series of documents separated
by ---, each one describing one app or plugin. Only plain key: value pairs
and one nested release: block are read; anything else is ignored.
---
package: com.example.timelapse
name: Timelapse
author: Jane Doe
desc: Interval shooting with exposure ramping
homepage: https://github.com/janedoe/timelapse
release:
type: github
user: janedoe
repo: timelapse
---
kind: plugin
package: lens-notes
name: Lens notes
author: Jane Doe
desc: Compatibility notes for adapted lenses
release:
type: github
user: janedoe
repo: lens-notes-plugin
| Key | Required | Meaning |
|---|---|---|
kind |
no | app (default) or plugin. Entries of another kind are skipped. |
package |
yes | For an app, the Android package name from its manifest. For a plugin, its id from plugin.json; the plugin is refused if the two differ. |
name |
yes | Name shown in the program. |
author |
no | Shown next to the name. |
desc |
no | One-line description. |
homepage |
no | Project page. |
release |
no | Where the newest build is. Without it the entry is listed but cannot be installed. |
cert_sha256 |
no | Apps only: the SHA-256 of the certificate you sign with, as keytool -printcert -jarfile app.apk prints it (colons and case do not matter). Every download is checked against it, the first one included. |
releaseThree forms are understood. Every address must start with https://.
type: github, user, repo. The program takes the
release GitHub marks as Latest; drafts and pre-releases are never
offered. It needs an asset of the right kind: a file ending in .apk for an
app, .pmcaplugin for a plugin. Without one, older releases are not
searched and the entry cannot be installed. The release title, or its tag,
is the version shown, without a leading v (v1.2.0 shows as 1.2.0).type: yaml, url. The feed is a series of
----separated documents with version, url and optionally date and
desc; the first one is the newest.A JSON document of your own — type: json, url, download. The
document at url is an object with version and optionally build, each a
string or a number, for example {"schema":1,"version":"2.05","build":58}.
download is the address of the APK with the placeholders {version} and,
if you need it, {build}:
release:
type: json
url: https://example.com/app-release.json
download: https://dl.example.com/MyApp-v{version}.apk?build={build}
Version and build may contain only letters, digits, ., - and _. Write
the version as a string: as a number, 2.50 arrives as 2.5.
version and url directly in the release: block.Anyone may publish a source, and the program cannot know who you are. What a signature gives your users is continuity: once they have installed something from you, nobody else can slip them an “update”.
Apps. Sign every APK with the same key (v1 / JAR signature, as the cameras require). The program checks that signature on every download, as Android does before installing: every file in the archive has to match it, or the APK is refused. When a user first downloads one of your apps from your source, the program remembers the certificate it was signed with. A later version signed with a different certificate, or not signed at all, is refused.
Plugins. Create a key once and sign every plugin file with it:
pmca-console plugins keygen my-plugins.key
pmca-console plugins pack <folder> my-plugin.pmcaplugin --key my-plugins.key
The key file is your secret: keep it out of the repository and back it up.
pack adds signature.json to the archive — an Ed25519 signature over the
SHA-256 of every other file, together with your public key. The program checks
it on every install and shows the key. As with apps, the first download from
your source remembers the key, and a later version signed with another key, or
not signed, is refused; in addition, an installed signed plugin is only ever
replaced by a file signed with the same key, wherever that file comes from.
Naming your certificate. With cert_sha256 in your entry, the program
does not have to trust the first download: every APK of that entry has to be
signed with exactly that certificate, or it is refused. Add it if you publish
the fingerprint anyway, for example on your website.
If you really have to change a key, tell your users: they have to remove your source and add it again, and remove an installed plugin before installing the newly signed one.
cert_sha256 the certificate has to be the one you
named. Otherwise the download is refused and the camera is not touched.pmca-source.yaml and release feeds: 4 MB.See crates/pmca-plugin-sdk and its
examples. pmca-console plugins pack <folder> <file> builds a plugin file and
checks it exactly as installing does.