set trusted-lib in manifest to avoid security popup