🚀 GitHub Store 1.8.1 — Inspect, Migrate, Stay Out of Your Way

A feature-heavy follow-up to 1.8.0. Now you can peek inside any APK before installing it, move your whole library in or out of Obtainium with one tap, silent-install on the OEMs Shizuku can't touch, and quietly tell the app to leave your battery alone. Backend keeps doing more of the heavy lifting so signed-out users get the same details signed-in ones do.

🔬 APK Inspect — see what's inside before you install

Tap Inspect on any Details screen and GitHub Store decodes the APK locally — never uploads it anywhere — and shows you exactly what you'd be installing.

• Identity, signing, file metadata — package name, version code, signing fingerprint (so you can match it against the project's published key), file size, hash.
• Compatibility at a glance — min and target SDK, supported architectures, whether the APK is debuggable.
• Components — main activity, all activities, services, broadcast receivers. Spot anything you didn't expect.
• Permissions, colour-coded by protection level — dangerous in red, signature in blue, normal in grey. Permission descriptions resolve from the framework where they exist; unknowns show the bare manifest name so nothing is hidden.
• Works on already-installed apps too — open Inspect on a tracked app to audit what's currently on your device.

This is the single most-requested feature from the post-1.8.0 user survey. No more "what does this APK actually do?" guesswork.

🛠️ Dhizuku silent install — for the phones Shizuku can't reach

Xiaomi, OPPO, vivo, Huawei devices on stock ROMs have install confirmations that ADB-pairing-only Shizuku can't bypass. Dhizuku takes a different path — Device Owner via the dpm command, no Magisk, no root.

GitHub Store now talks to Dhizuku as a third installer alongside Default and Shizuku/Sui:

• Tweaks → Installation → Dhizuku activates the silent path once Dhizuku's app is set as Device Owner.
• Auto-update integrates the same way Shizuku does — when Dhizuku is selected, periodic updates install silently.
• Real-time status indicator in Tweaks shows whether Dhizuku is unavailable / not running / permission-needed / ready.
• Falls back to standard installer if Dhizuku is detached mid-install.

If you're on an OEM where Shizuku's ADB pairing breaks every reboot, this is the answer.

📦 Obtainium import / export

Bring your Obtainium library across in one tap. Export back to Obtainium any time.

• Import flow — pick the Obtainium JSON, see a pre-import summary breaking results into three buckets: imported, already-tracked, non-GitHub-skipped (with a reason chip per row). Failed-bucket appears for unsupported features (inverted filter, missing ID).
• Export flow — emits an Obtainium-compatible JSON with a discriminator field so re-importing the export back into GitHub Store is lossless.
• Round-trip preserved — your asset filters, variant pins, and pre-release toggles survive a full export → import → export cycle.

The first real escape hatch in either direction. Move at the speed of trust.

⭐ Add from starred

A new picker that surfaces APK-shipping repos from your GitHub stars — so the apps you've already curated as interesting become one tap away from installing.

• APK badge on every row that ships at least one Android binary, so you can see at a glance which stars are app-grade.
• Sort by alphabetical / recent / star count, filter "show all" (including non-APK) when you want to browse.
• Per-row tap → Details — same flow as searching for the repo manually, just shorter.
• Resume on rate-limit — if GitHub throttles the scan partway through, the picker remembers where it stopped and resumes when ready instead of starting over.

Phase 1 ships discovery; bulk-track-without-install is on the way for a future release.

🔄 Manual refresh on Details

A real refresh button. Pull-to-refresh on Android, an overflow-menu Refresh on every platform, Ctrl/Cmd+R keyboard shortcut on desktop. Forces a fresh fetch of repo metadata + latest release straight from the backend (which then re-syncs from GitHub upstream).

• 30-second per-repo cooldown prevents accidental hammering — surfaced as a friendly retry-after toast and a live countdown on the menu item.
• Backend handles the rate-limit math so you don't burn your 60/hr (anon) or 5,000/hr (signed-in) GitHub quota on it.
• Distinct UX for each terminal state: cooldown / archived / not-found / upstream-unreachable / budget-exhausted all get their own snackbar copy.

For the times when you want to know right now if a release dropped.

📊 Open-issues count and license — for everyone, no quota cost

Before 1.8.1 we hit GitHub directly to fetch open-issues count and license info on every Details open — only worked for signed-in users, and burned a slice of their 5,000/hr quota each time.

Now both come from the backend. Anonymous and signed-in users see the same data; nobody loses GitHub quota over a Details open.

🔋 Background update check — fully toggleable

Tweaks → Updates now has a Background update check switch above the interval picker. Flip it off and the periodic worker stops cold:

• No periodic checks. No notifications. No battery drain.
• Manual update checks from any app's Details screen still work.
• Reboot-safe — the Boot receiver respects the flag too, so a stale schedule doesn't resurrect overnight.
• Interval picker chips disable visually while the toggle is off; flip it back on and the previously-selected cadence resumes.

For the users who told us "I don't always need auto-update and the check eats my battery" — answered.

🔍 Recently Released + Recently Updated search sort

Two new sort options on the Search screen:

• Recently Updated — orders by GitHub repo activity (any push/commit). Useful for finding active projects.
• Recently Released — orders by latest stable release date, sourced from the curated index. Useful for finding "what's new and shippable right now."

Both routed through the backend so they don't burn GitHub's 30/min search bucket — anonymous users can use them freely.

🎯 Installer attribution

Some apps refuse to run when their installer-package name looks "unofficial." Tweaks → Installation → Installer attribution lets you set what installer name silent installs claim:

• System default (no override).
• Preset: Play Store, F-Droid, Obtainium.
• Custom package — paste any package name.

Threaded through both Shizuku (pm install -i) and Dhizuku silent paths. Set once, applies to every silent install going forward.

🛡️ Desktop trusts your OS root certificates

If you're on Watt Toolkit, FastGithub, Fiddler, or any corporate MITM proxy, GitHub Store on desktop now trusts your OS root certificate store in addition to the JVM-bundled cacerts. No more keytool -importcert dance to make things load.

• Windows reads the Windows-ROOT keystore; macOS reads the Keychain; both layered transparently on top of the existing JVM trust manager.
• Linux already merges system roots into cacerts at JDK install time, so no change needed there.

🌑 Liquid Glass effect — retired

The liquid-glass UI overlay was making icons disappear in dark mode against transparent backgrounds. We considered patching the contrast and decided removal was cleaner. UI is now higher-contrast everywhere; nothing hides behind a translucent layer that can't read its own foreground.

🌍 Localization

13 languages on every screen. 150 strings that had drifted out of sync between English and the other 12 locales are now translated everywhere — APK Inspect, Announcements, sectioned Apps screen, Dhizuku, Add from starred, Installer attribution, error states, import summary, what's-new section all render natively.

🐛 Important bug fixes

• "Update available" sticking after self-update (#515). Updating GitHub Store from inside GitHub Store left the row pointing at the old release tag — checkForUpdates then kept re-flagging the false update on every periodic sweep. Cold-start backfill normalizes the tag, and a versionCode-parity canary in the check itself prevents the mismatch from ever firing the badge again.
• Windows installer launch on non-ASCII account names (#371). The .exe install handler used to hand the file path to Desktop.open() which rejected paths with characters outside ASCII (Cyrillic, Chinese, Arabic usernames in C:\Users\...). Now goes through cmd /c start which respects the system codepage.
• Search rate-limit dialog cascading (#524). When the backend's per-token search bucket exhausted, the client used to silently fall back to direct-GitHub /search/repositories + /releases per result, tripping GitHub's abuse detector and surfacing the global rate-limit dialog. Backend 429 now surfaces a soft retry-after toast, and the cascade is gone.
• What's-new sheet rendering in stale language after switching app language (#526, follow-up #531). Solved twice — once for VM-cached state, again for the locale-resolution race between the VM and Activity recreate.
• Apps FAB no longer covers the last app in the list (#523). Padding fixed.
• Multi-source downloads no longer clobber each other's APK file when more than one race is in flight.
• Shizuku-fallback installs no longer flip rows to "installed" prematurely before the system actually confirms.
• Self-update no longer leaves apps stuck on "Preparing to install" when the broadcast handler missed the cleanup window.
• Manual rescan surfaces every GitHub-style app on device without missing the first match.
• Tighter auth handling — single transient 401s under the same token no longer trigger spurious sign-outs.

🎬 Meet the author

If you missed the 1.8.0 video, it's still up — short intro, what GitHub Store does, what's coming next.

Watch on YouTube → | Watch on Bilibili →

📋 Tell me what to build next

Three minutes. Survey shaped 1.8.0 and 1.8.1; it's shaping 1.9 too.

Take the Survey →

Full Changelog: 1.8.0...1.8.1

🌐 Website · 📰 News · 💬 Discord