TAKwerx Market v1.8

Features in full

Capabilities

• Reads a catalog over HTTPS in ATAK's own product.inf format, so the same hosted tree is also readable by ATAK's built-in Update Server setting.
• Offers only what matches the running ATAK. A plugin built for a different ATAK release is listed and grayed with the release it was built for, rather than hidden, so the list never silently omits things.
• Per plugin: install, update, load, unload and uninstall, the same set of actions ATAK's own package manager offers.
• Shows whether an installed plugin is currently loaded into ATAK, which is otherwise not visible from the map.
• One quiet notice at ATAK start when something installed is out of date, and nothing at all when everything is current.
• Verifies every download against a SHA-256 published in the catalog, and refuses to install anything not signed by a TAK Product Center plugin-release certificate.

• Updates ATAK itself. The catalog carries the newest ATAK-CIV release; a phone on an older one is offered it, and the market installs its own build for the new ATAK first, then hands ATAK to Android, so that when ATAK comes back the market is there to move every plugin over.

The catalog hosts no plugin APKs. Each plugin entry links to that plugin's own signed release, so the plugin a user installs is the same file published by its own project. ATAK-CIV is the exception: the tak.gov release is copied to the catalog host byte for byte, its TAK Product Center signature intact, and the market pins that signature for ATAK's package before Android is asked.

Plugins from other developers are listed too, from their own signed releases. To list yours, set up its repository as described in [docs/LIST_YOUR_PLUGIN.md](docs/LIST_YOUR_PLUGIN.md) and open a listing request: https://github.com/takwerx/takwerx-market/issues/new?template=list-my-plugin.yml Every plugin the market offers, takwerx's and other developers', is listed with links at https://takwerx.github.io/takwerx-market/ (rebuilt from the live catalog).

Equipment required

Android device supported by ATAK-CIV 5.6, 5.7 or 5.8. A network connection when browsing or installing. Downloads are the size of the plugin being installed, typically 2 to 7 MB.

Works with

Any Android device supported by ATAK. No additional or external hardware, no sensors, no peripherals.

Network and security

(This is important for ATO, networking, and other security concerns)

Outbound TCP 443 (HTTPS) only.

The plugin makes three kinds of request, all HTTPS and all to the catalog host or to the plugin release it links to:

• the catalog itself, on ATAK start and when the operator opens or refreshes the pane
• a plugin icon, once per ATAK session per listed plugin
• a plugin APK, only when the operator taps Install or Update

Plain HTTP is refused at the connection, not merely avoided: a non-HTTPS URL is rejected before any request is made, and redirects cannot downgrade the transport.

No inbound ports. No listening sockets. No traffic to or from the TAK server. No CoT is generated or consumed. Nothing is sent anywhere -- the plugin only fetches, and transmits no device, user or position data of any kind.

With no network the plugin lists nothing and says so; it does not block ATAK start or any other function.

More on GitHub →