009: publish AXPR23 final source and public documentation

vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_single_webview.py

@@ -0,0 +1,37 @@
+#!/usr/bin/env python3
+"""009: ship a single WebView engine (AXPR AosmiumWebView only).
+
+The AOSP/Lineage `webview` prebuilt (~255 MB) is added by
+build/make/target/product/media_product.mk, which is inherited later than
+vendor/sunfish-a16/apps.mk, so a PRODUCT_PACKAGES filter there has no effect.
+Remove the package from the media_product list instead.
+
+The provider allowlist (config_webview_packages.xml) still declares
+com.android.webview and the Google providers, so they can be installed and
+selected later; they are simply not preinstalled.
+
+Idempotent: guarded by a marker comment.
+"""
+from pathlib import Path
+
+TREE = Path(__file__).resolve().parents[4]
+MEDIA = TREE / "build/make/target/product/media_product.mk"
+MARKER = "# sunfish-a16-009-single-webview"
+LINE = "    webview \\\n"
+
+if not MEDIA.is_file():
+    raise SystemExit(f"FAIL: missing {MEDIA}")
+
+text = MEDIA.read_text()
+
+if MARKER in text:
+    print(f"already applied: {MEDIA} (single-webview)")
+    raise SystemExit(0)
+
+if LINE not in text:
+    raise SystemExit(f"FAIL: expected 'webview' entry not found in {MEDIA}")
+
+text = text.replace(LINE, "", 1)
+text = text.rstrip("\n") + f"\n\n{MARKER}: AosmiumWebView is the only shipped WebView.\n"
+MEDIA.write_text(text)
+print(f"patched: {MEDIA} (webview package removed)")

vendor/sunfish-a16/patches/009-kernel-hardening/apply_uss5_1_defconfig.sh

@@ -16,6 +16,14 @@
 # sunfish_defconfig turns it on. This kernel has no UFFDIO_MOVE (that ioctl
 # is 6.1+), so ART only opens a fd and times out. Match GOLDEN.
 #
+# MEMCG / CGROUP_PIDS: Android 16 mounts cgroup v2 and attempts per-UID memory
+# and PID controller activation. The old sunfish defconfig leaves both off,
+# which produces `+memory ... Invalid argument` at runtime. Enable the native
+# 4.14 controllers for the next candidate.
+#
+# LOCALVERSION_AUTO: the kernel source is intentionally patched in the build;
+# do not expose the source worktree's incidental `-dirty` suffix in uname.
+#
 # Usage: apply_uss5_1_defconfig.sh <kernel-tree>
 set -euo pipefail
 
@@ -23,7 +31,8 @@ K=${1:?kernel tree}
 DEF="$K/arch/arm64/configs/sunfish_defconfig"
 test -f "$DEF"
 
-for k in SECURITY_YAMA SLAB_FREELIST_RANDOM USERFAULTFD HAVE_ARCH_USERFAULTFD_MINOR; do
+for k in SECURITY_YAMA SLAB_FREELIST_RANDOM USERFAULTFD HAVE_ARCH_USERFAULTFD_MINOR \
+         MEMCG CGROUP_PIDS LOCALVERSION_AUTO; do
   sed -i "/CONFIG_${k}/d" "$DEF"
 done
 
@@ -31,6 +40,9 @@ done
   echo "# CONFIG_SECURITY_YAMA is not set"
   echo "CONFIG_SLAB_FREELIST_RANDOM=y"
   echo "# CONFIG_USERFAULTFD is not set"
+  echo "CONFIG_MEMCG=y"
+  echo "CONFIG_CGROUP_PIDS=y"
+  echo "# CONFIG_LOCALVERSION_AUTO is not set"
 } >> "$DEF"
 
-echo "OK: US-S5-1 defconfig (SLAB_FREELIST_RANDOM; YAMA, USERFAULTFD off) on $K"
+echo "OK: US-S5-1 defconfig (SLAB_FREELIST_RANDOM; MEMCG, CGROUP_PIDS on; YAMA, USERFAULTFD, LOCALVERSION_AUTO off) on $K"