Thanks Jeff for your response.
1)However if you look at it the files are compressed into the tar.gz file and the app-manager copies over to the /var/app folder and runs the install and start scripts, so if it is able to do all that not sure why giving it permissions to execute is making it less secure, unless the install and start scripts are a suspect. Having said that I will update my scripts to do just that.
2) Regarding the firmware upgrade, I never thought of that of creating the soft links via the install, that will solve the issue, I will do that. So I am guessing the App-Manager during a firmware upgrade looks for the tar.gz file under the /var/app/<app-name> folder or is there an upgrade dir where the <app-name>tar.gz file needs to be present?
3) Lastly instead of creating a brand new init script, is it possible to run the rc.update utility in the postInstall step and still change the priority? Also while it boots I was hoping the custom app starts before the lora wan server and when the conduit is being rebooted the custom app is terminated after the lora wan server is shut down. I should be able to do all that with the rc.update utility right?
All this I am doing just to compensate for the scenario where we end up loosing packets that were ack-ed by the lora wan server for an uplinked packet, but node-red already was either shutdown or not yet up and running when the conduit boots up.
Thanks,
Ajay