How to Create a Write-Protected MicroSD Repository Channel for Android

Updated 2026-10-28

Why Android TV needs a separate microSD repo for sideloading

Android TV units that lack the Google Play Store or that run a locked-down firmware often rely on a removable microSD card to deliver custom apps, streaming tweaks, or offline content packs. The built-in launcher on many models expects the repository to live in internal storage, which makes it easy for a user to accidentally wipe the entire system partition if they pick the wrong file type or path. By putting your sideloaded payload on a dedicated microSD partition and marking that partition as write-protected, you create a sandboxed side-load pipeline that survives a factory reset of internal storage but stays read-only to system operations.

The process works best on devices that ship with an Android TV distribution that supports sideloading via the launcher (Samsung Tizen-adjacent firmware builds, older LG webOS-linked Android TV, certain NVIDIA Shield TV revisions, and some Shiftworks units). The CleanYourTV launcher ships with a helper that can copy signed APKs into an isolated repository tree, but without a write-protection layer the content can be wiped by a system update or an OTA reset.

What write protection actually protects against

A write-protected microSD repository is not a security feature for end users, and it is not a replacement for signed, verified packages. Its role is to prevent accidental or malicious overwriting of the repository tree itself when the device is re-flashed or when a user manually copies files over the default package store. Concretely, write protection stops:

• Accidental deletion of repo-apk or repo-updates folders during a factory image restore
• Corruption of installed custom apps after a firmware flash that changes /data/local/tmp
• Partial writes that leave malformed .apk files in the install slot, which can crash the launcher

The trade-off is clear: once the write protection flag is set, neither you nor any user can replace the contents of that microSD volume through the standard launcher. That is why the flag is usually paired with a companion script that exports the repository only at the end of a sideload session, using a temporary writable mount point before re-sealing the card.

Step-by-step: building the protected repository channel

Start from a clean, factory-simulated Android TV ROM image. Do not use a device that has already had system partitions rewritten, because the write-protection flag lives in the superblock metadata and cannot be safely re-applied to a non-original base unless you are working from a known-good source.

Download the CleanYourTV launcher bundle that matches your target firmware version. Verify the checksum from the official publisher page before extraction. Unpack the bundle, locate the repo-manager binary, and run it with the device’s full host name and admin token so it can write to the block device. At this point the launcher has created a repo directory inside the mounting point you specified for external storage.

Setting the write-protection flag on the microSD card

After the repository has been populated with signed APKs, issue the following command against the block device of the inserted microSD card (replace /dev/mmcblk0 with the correct label for your hardware):

blockdev --setrw /dev/mmcblk0   # disables write access immediately
mknod /dev/mmcblk0p1 2047 cleanly   # create a protected partition entry
chattr +i /dev/mmcblk0p1           # set the immutable flag so normal mounts refuse writes

On newer Android TV builds that support the btrfs hybrid layout, you can mount the microSD with the ro option and use FSTRIM to limit the write surface. In practice the chattr +i route is more reliable on the ARM-based set-top boxes most commonly sold in North America and Europe.

Run a quick sanity check: attempt to copy a dummy file into /mnt/repo-test and confirm the operation fails with READ_FAULT. Then mount the directory normally and verify that the launcher can read the APKs in repo-apk without error.

Exporting the protected repository and closing the session

Once the export succeeds, unmount everything except the internal system partition. Re-enable write access only temporarily for the final packaging step:

sync
blockdev --setrw /dev/mmcblk0
mv /mnt/repo-export /sdcard/protected-repo.bak
blockdev --clearrw /dev/mmcblk0
blockdev --setrw /dev/mmcblk0

This swap-and-clear technique ensures that the backup archive is not left on the same physical card as the running system, and that the write-protection flag is reset for future use. On the CleanYourTV launcher, point its final step at the saved backup and let it write the signed package through the sealed channel one last time.

With the flag back in place, the microSD card can be removed, reinserted in a different Android TV unit, and mounted read-only. Any remaining custom APKs can only be read by the launcher, not replaced, which preserves the integrity of the original developer-signed payload across multiple devices. This is the cleanest write-protected sideload channel you can build without flashing custom firmware.

Related reading: more Android TV notes