AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.
Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.
This commit is contained in:
sunfish-admin committed
commit
12d2179c20
150 files changed
+26263
No files matched your search
@@ -0,0 +1,104 @@
|
||||
# Research: 005 restricted signature spoofing
|
||||
|
||||
## Decision: First working stack = `004` leftovers + spoofing + modern location
|
||||
|
||||
**Decision**: Ship one LAB validation build that includes (1) unfinished `004`
|
||||
packaging fixes, (2) restricted spoofing, (3) BeaconDB location docs — and
|
||||
**exclude** `006` banking and `007` root.
|
||||
|
||||
**Rationale**: Owner: first phase that must work is microG + patched Play +
|
||||
spoofing. Banking/root are later regressions.
|
||||
|
||||
**Alternatives considered**: Separate tiny `004b` rebuild only — rejected;
|
||||
wastes a flash cycle before spoofing lands. Pulling `006` early — rejected;
|
||||
blocks focus.
|
||||
|
||||
## Decision: Spoofing implementation source = EXTENDROM / AXP (port to A16)
|
||||
|
||||
**Decision**: Use [EXTENDROM_SIGNATURE_SPOOFING](https://github.com/sfX-android/android_vendor_extendrom/wiki/EXTENDROM_SIGNATURE_SPOOFING)
|
||||
as the attributable primary source (matches GOLDEN behaviour:
|
||||
`allow_signature_fake`, Developer Options, per-app `FAKE_PACKAGE_SIGNATURE`).
|
||||
Port patches from the closest supported Android line (**A15** is STABLE/tested;
|
||||
GOLDEN is A15) onto **A16 / LOS 23.2**.
|
||||
|
||||
**Rationale**: Stock LOS 23.2 tree on `rom-dev01` has **no**
|
||||
`FAKE_PACKAGE_SIGNATURE` / `allow_signature_fake` (inventory 2026-09-15). AXP
|
||||
GOLDEN proves the UX and setting key. Old `android_signature_spoofing` repo is
|
||||
obsolete per upstream.
|
||||
|
||||
**Alternatives considered**:
|
||||
|
||||
| Option | Why not |
|
||||
|--------|---------|
|
||||
| lineageos4microg unrestricted spoof | Constitution forbids open spoofing |
|
||||
| Magisk / LSPosed FakeGApps | Forbidden; rootless Compatibility MVP |
|
||||
| Wait for LOS to grow A16 EXTENDROM dir | Blocks first stack; we port ourselves |
|
||||
|
||||
**A16 note**: EXTENDROM wiki table lists A15, not A16. Expect conflict resolution
|
||||
(`repo diff` / split patches) per EXTENDROM porting guide. Record deltas in
|
||||
`docs/a15-a16-delta.md`.
|
||||
|
||||
## Decision: Must spoof `signingInfo`, not only `signatures[]`
|
||||
|
||||
**Decision**: Implementation MUST spoof both legacy `PackageInfo.signatures` and
|
||||
modern `PackageInfo.signingInfo` (GET_SIGNING_CERTIFICATES).
|
||||
|
||||
**Rationale**: microG #2680 / EXTENDROM #48 — Google/Play check `signingInfo` on
|
||||
modern Android; Self-Check “correct signature” fails if only legacy arrays are
|
||||
faked. LOS Gerrit has A13–A15 fixes; ensure A16 port includes equivalent.
|
||||
|
||||
## Decision: Allow-list = microG GmsCore + project Phonesky
|
||||
|
||||
**Decision**: Effective spoofing limited to:
|
||||
|
||||
- `com.google.android.gms` — official microG signer (`73aaa390…` short on GOLDEN)
|
||||
- `com.android.vending` — project Phonesky JKS
|
||||
SHA-256 digest
|
||||
`31:31:86:CB:7D:F2:D4:01:33:72:12:07:B7:29:73:E8:52:F6:1C:87:67:C3:21:E5:C7:50:39:01:1B:83:BD:56`
|
||||
|
||||
Privapp/default XMLs that bind by cert digest MUST use **our** digest (not
|
||||
AXP’s `00:5C:98:05:…`).
|
||||
|
||||
**Rationale**: Constitution + GOLDEN grants; AXP `er_*` XMLs bind Phonesky by
|
||||
digest.
|
||||
|
||||
## Decision: Global toggle default OFF
|
||||
|
||||
**Decision**: `allow_signature_fake` defaults to disabled; user enables in
|
||||
Developer Options (AXP setup guide).
|
||||
|
||||
**Rationale**: Matches oracle docs and reduces surprise attack surface.
|
||||
|
||||
## Decision: `004` packaging leftovers are a `005` ship gate
|
||||
|
||||
**Decision**: Before declaring `005` done, the flashable zip MUST include:
|
||||
|
||||
1. `LOCAL_REPLACE_PREBUILT_APK_INSTALLED` for GmsCore/Gsf/Phonesky (already in
|
||||
working-tree `vendor/sunfish-a16/Android.mk`)
|
||||
2. Phonesky privapp extras for Play 52 / A16 FGS:
|
||||
`FOREGROUND_SERVICE_SYSTEM_EXEMPTED`, `SCHEDULE_EXACT_ALARM` /
|
||||
`USE_EXACT_ALARM`, plus prior grammatical/status-bar entries
|
||||
|
||||
**Rationale**: Measured LAB failures — PRESIGNED strip → no `pm path`; missing
|
||||
FGS allowlist → VpaService/DownloadService crash. Remount pushes are not the
|
||||
shipped artifact.
|
||||
|
||||
## Decision: Modern location = BeaconDB (not UnifiedNlp backends)
|
||||
|
||||
**Decision**: Document configuring microG Location to use an Ichnaea-compatible
|
||||
URL (`https://api.beacondb.net` or documented successor). Do **not** package
|
||||
Déjà Vu / Nominatim NLP / MLS apps.
|
||||
|
||||
**Rationale**: microG 0.3.x dropped UnifiedNlp backends; MLS retired (2025);
|
||||
GOLDEN also has no NLP backend packages. Owner wants modern stack.
|
||||
|
||||
**Alternatives considered**: Ship UnifiedNlp backends — rejected (obsolete for
|
||||
0.3.x primary path).
|
||||
|
||||
## Decision: Out of scope remains `006`/`007`
|
||||
|
||||
**Decision**: No Insular/banking hard-gates; no KSU/SusFS in this feature’s
|
||||
acceptance.
|
||||
|
||||
**Rationale**: Owner confirmation 2026-09-15 — first phase is microG + Play +
|
||||
spoofing only.
|
||||
Reference in new issue
Block a user