Merge "Allow untrusted apps to read apks" into oc-mr1-dev