009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.
Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding, bundled apps, and AXP-class product surface docs/scripts.
This commit is contained in:
sunfish-admin committed
1 parent
fd793b9471
commit
deaaf42caa
129 files changed
+11769
-141
No files matched your search
Executable
+152
@@ -0,0 +1,152 @@
|
||||
#!/bin/bash
|
||||
# 009 bacon — AXP Magisk preroot + combo4+Clang-FORTIFY kernel (LAB-verified pack).
|
||||
# Does NOT apply Graphene Stage1 mega-pack (not boot-OK yet on LOS23/Clang).
|
||||
set -e
|
||||
cd /srv/rom/src/lineage
|
||||
export HOME=/home/android-build
|
||||
export CCACHE_DIR=/srv/rom/ccache
|
||||
export USE_CCACHE=1
|
||||
export PATH=/home/android-build/bin:/usr/local/bin:/usr/bin:/bin:$PATH
|
||||
export ANDROID_BUILD_TOP=/srv/rom/src/lineage
|
||||
unset OUT_DIR || true
|
||||
export SUNFISH_A16_MAGISK_PREROOT=1
|
||||
export MAGISK_APK=/srv/rom/prebuilts/magisk/Magisk-v30.7.apk
|
||||
|
||||
LOGDIR=/srv/rom/logs/009-build
|
||||
mkdir -p "$LOGDIR"
|
||||
LOG=$LOGDIR/bacon-axp-combo4-fortify.log
|
||||
exec > >(tee -a "$LOG") 2>&1
|
||||
|
||||
echo "=== START 009-bacon-axp-combo4-fortify $(date -Is) ==="
|
||||
|
||||
LIVE=kernel/google/msm-4.14
|
||||
BASE=28f9290ae067
|
||||
test -d "$LIVE"
|
||||
|
||||
echo "=== reset kernel @ $BASE ==="
|
||||
git -C "$LIVE" reset --hard "$BASE"
|
||||
git -C "$LIVE" clean -fdq
|
||||
|
||||
APPLY=vendor/sunfish-a16/patches/009-kernel-hardening/apply_combo4_fortify.sh
|
||||
test -x "$APPLY" || chmod +x "$APPLY"
|
||||
bash "$APPLY" "$LIVE"
|
||||
|
||||
DEF=$LIVE/arch/arm64/configs/sunfish_defconfig
|
||||
if grep -qE "^CONFIG_KSU.*=y" "$DEF"; then
|
||||
echo "FAIL: $DEF still enables KernelSU" >&2
|
||||
exit 1
|
||||
fi
|
||||
for k in FORTIFY_SOURCE INIT_ON_ALLOC_DEFAULT_ON INIT_ON_FREE_DEFAULT_ON \
|
||||
SECURITY_DMESG_RESTRICT SLAB_FREELIST_HARDENED; do
|
||||
if ! grep -q "^CONFIG_${k}=y" "$DEF"; then
|
||||
echo "FAIL: missing CONFIG_${k}=y" >&2
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
grep -q "ret = __underlying_strlen(q);" "$LIVE/include/linux/string.h"
|
||||
echo "OK: combo4+FORTIFY markers + nested-strlen fix present"
|
||||
|
||||
rm -f out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image.lz4 \
|
||||
out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image \
|
||||
out/target/product/sunfish/kernel
|
||||
echo "OK: cleared prior Image for kernel rebuild"
|
||||
|
||||
# FLAG_SECURE + Settings UX (idempotent)
|
||||
python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_wms_disable_secure_debuggable_gate.py
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_disable_user_apps.py
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_private_dns_providers.py
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_connectivity_check.py
|
||||
|
||||
PH=/srv/rom/src/lineage/vendor/sunfish-a16/prebuilt/Phonesky.apk
|
||||
test -e "$PH"
|
||||
AAPT=/srv/rom/src/lineage/prebuilts/sdk/tools/linux/bin/aapt
|
||||
if ! "$AAPT" dump permissions "$PH" 2>/dev/null | grep -q USE_EXACT_ALARM; then
|
||||
echo "FAIL: Phonesky missing USE_EXACT_ALARM" >&2
|
||||
exit 1
|
||||
fi
|
||||
echo "OK: Phonesky has USE_EXACT_ALARM"
|
||||
|
||||
MAGISK_STAGE_DIR=/srv/rom/src/lineage/out/.magisk \
|
||||
vendor/sunfish-a16/magisk/prepare_magisk.sh
|
||||
python3 vendor/sunfish-a16/magisk/apply_releasetools_hook.py --top "$ANDROID_BUILD_TOP" --force
|
||||
test -f out/.magisk/READY
|
||||
|
||||
rm -rf out/soong/.intermediates/build/make/tools/releasetools/releasetools_common
|
||||
rm -rf out/soong/.intermediates/build/make/tools/releasetools/add_img_to_target_files
|
||||
rm -rf out/target/product/sunfish/obj/PACKAGING/target_files_intermediates
|
||||
rm -f out/target/product/sunfish/lineage-*.zip \
|
||||
out/target/product/sunfish/boot.img \
|
||||
out/target/product/sunfish/system/priv-app/Phonesky/Phonesky.apk
|
||||
touch frameworks/base/services/core/java/com/android/server/wm/WindowManagerService.java
|
||||
|
||||
set +u
|
||||
# shellcheck disable=SC1091
|
||||
source build/envsetup.sh
|
||||
set -e
|
||||
breakfast sunfish userdebug
|
||||
test "${TARGET_RELEASE:-}" = "bp4a"
|
||||
|
||||
echo "=== mka bacon $(date -Is) ==="
|
||||
set -o pipefail
|
||||
mka bacon -j8
|
||||
ec=${PIPESTATUS[0]}
|
||||
echo "bacon_exit=$ec $(date -Is)"
|
||||
[ "$ec" -eq 0 ] || exit "$ec"
|
||||
|
||||
PROD=out/target/product/sunfish
|
||||
BID=$(date -u +%Y%m%dT%H%M%SZ)
|
||||
DEST=/srv/rom/artifacts/009-axp-los23-port/${BID}-axp-combo4-fortify
|
||||
mkdir -p "$DEST"
|
||||
|
||||
TF_BOOT=$(find "$PROD/obj/PACKAGING/target_files_intermediates" -path "*/IMAGES/boot.img" 2>/dev/null | head -1)
|
||||
MAKE_BOOT=$PROD/boot.img
|
||||
if [ -n "${TF_BOOT:-}" ] && [ -f "$TF_BOOT" ]; then
|
||||
cp -v "$TF_BOOT" "$DEST/boot.img"
|
||||
cp -v "$MAKE_BOOT" "$DEST/boot-make.img" 2>/dev/null || true
|
||||
echo "boot_source=target_files_IMAGES"
|
||||
else
|
||||
cp -v "$MAKE_BOOT" "$DEST/boot.img"
|
||||
echo "WARN: no TF IMAGES/boot.img — using Make boot"
|
||||
fi
|
||||
|
||||
cp -v "$PROD"/lineage-*-UNOFFICIAL-sunfish.zip "$DEST/" 2>/dev/null || true
|
||||
for f in vbmeta.img dtbo.img; do
|
||||
[ -f "$PROD/$f" ] && cp -v "$PROD/$f" "$DEST/"
|
||||
done
|
||||
|
||||
# Magisk present, KernelSU absent
|
||||
MB=out/.magisk/magiskboot
|
||||
if [ -x "$MB" ]; then
|
||||
rm -rf "$DEST/boot-check" && mkdir -p "$DEST/boot-check"
|
||||
if "$MB" unpack "$DEST/boot.img" "$DEST/boot-check" >/dev/null 2>&1; then
|
||||
if [ -f "$DEST/boot-check/ramdisk.cpio" ]; then
|
||||
if "$MB" cpio "$DEST/boot-check/ramdisk.cpio" "exists overlay.d/sbin/magisk64.xz" \
|
||||
|| "$MB" cpio "$DEST/boot-check/ramdisk.cpio" "exists overlay.d/sbin/magisk.xz"; then
|
||||
echo "OK: Magisk overlay in boot.img"
|
||||
else
|
||||
echo "WARN: Magisk overlay not detected in boot.img ramdisk"
|
||||
fi
|
||||
fi
|
||||
else
|
||||
echo "WARN: magiskboot unpack failed (host SIGILL flake possible); skip TF check"
|
||||
fi
|
||||
fi
|
||||
if strings "$DEST/boot.img" | grep -qiE 'KernelSU|CONFIG_KSU_SUSFS'; then
|
||||
echo "FAIL: KernelSU strings in boot.img" >&2
|
||||
exit 1
|
||||
fi
|
||||
echo "OK: no KernelSU strings in boot.img"
|
||||
|
||||
{
|
||||
echo "artifact=$DEST"
|
||||
echo "kernel_base=$BASE"
|
||||
echo "hardening=combo4+clang-fortify (nested __underlying_strlen)"
|
||||
echo "magisk=preroot EXTENDROM-class v30.7"
|
||||
echo "stage1_graphene=NOT_INCLUDED (not boot-OK on LOS23 yet)"
|
||||
date -u +"built=%Y-%m-%dT%H:%M:%SZ"
|
||||
} | tee "$DEST/README.txt"
|
||||
|
||||
(cd "$DEST" && sha256sum boot.img boot-make.img lineage-*-UNOFFICIAL-sunfish.zip 2>/dev/null || true) \
|
||||
| tee "$DEST/SHA256SUMS"
|
||||
|
||||
echo "=== DONE $DEST $(date -Is) ==="
|
||||
@@ -0,0 +1,142 @@
|
||||
#!/bin/bash
|
||||
# 009 bacon — Stage1+combo4+FORTIFY + CVE bisect half (h1|h2).
|
||||
# Usage on rom-dev01: CVE_BISECT=h1 bash scripts/009-bacon-axp-stage1-combo4-cve-bisect.sh
|
||||
set -e
|
||||
BISECT="${CVE_BISECT:?set CVE_BISECT=h1 or h2}"
|
||||
case "$BISECT" in h1|h2) ;; *) echo "CVE_BISECT must be h1 or h2" >&2; exit 2 ;; esac
|
||||
|
||||
cd /srv/rom/src/lineage
|
||||
export HOME=/home/android-build
|
||||
export CCACHE_DIR=/srv/rom/ccache
|
||||
export USE_CCACHE=1
|
||||
export PATH=/home/android-build/bin:/usr/local/bin:/usr/bin:/bin:$PATH
|
||||
export ANDROID_BUILD_TOP=/srv/rom/src/lineage
|
||||
unset OUT_DIR || true
|
||||
export SUNFISH_A16_MAGISK_PREROOT=1
|
||||
export MAGISK_APK=/srv/rom/prebuilts/magisk/Magisk-v30.7.apk
|
||||
unset PRODUCT_DEFAULT_DEV_CERTIFICATE || true
|
||||
|
||||
LOGDIR=/srv/rom/logs/009-build
|
||||
mkdir -p "$LOGDIR"
|
||||
LOG=$LOGDIR/bacon-axp-stage1-combo4-cve-${BISECT}.log
|
||||
exec > >(tee -a "$LOG") 2>&1
|
||||
|
||||
echo "=== START 009-bacon-axp-stage1-combo4-cve-${BISECT} $(date -Is) ==="
|
||||
|
||||
LIVE=kernel/google/msm-4.14
|
||||
BASE=28f9290ae067
|
||||
KH=vendor/sunfish-a16/patches/009-kernel-hardening
|
||||
LIST="$KH/cve-bisect-${BISECT}.list"
|
||||
test -f "$LIST"
|
||||
test -d "$LIVE"
|
||||
|
||||
echo "=== reset kernel @ $BASE ==="
|
||||
git -C "$LIVE" reset --hard "$BASE"
|
||||
git -C "$LIVE" clean -fdq
|
||||
|
||||
chmod +x "$KH"/apply_stage1_combo4.sh "$KH"/apply_cve_strict.sh \
|
||||
"$KH"/apply_stage1.sh "$KH"/apply_combo4_fortify.sh 2>/dev/null || true
|
||||
|
||||
bash "$KH/apply_stage1_combo4.sh" "$LIVE"
|
||||
export CVE_STRICT_LIST="$LIST"
|
||||
bash "$KH/apply_cve_strict.sh" "$LIVE"
|
||||
|
||||
DEF=$LIVE/arch/arm64/configs/sunfish_defconfig
|
||||
if grep -qE "^CONFIG_KSU.*=y" "$DEF"; then
|
||||
echo "FAIL: KernelSU in defconfig" >&2
|
||||
exit 1
|
||||
fi
|
||||
for k in FORTIFY_SOURCE INIT_ON_ALLOC_DEFAULT_ON INIT_ON_FREE_DEFAULT_ON \
|
||||
SECURITY_DMESG_RESTRICT SLAB_FREELIST_HARDENED; do
|
||||
grep -q "^CONFIG_${k}=y" "$DEF" || { echo "FAIL missing $k" >&2; exit 1; }
|
||||
done
|
||||
grep -q "ret = __underlying_strlen(q);" "$LIVE/include/linux/string.h"
|
||||
echo "OK: Stage1+combo4+FORTIFY + CVE-${BISECT} markers present"
|
||||
|
||||
rm -f out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image.lz4 \
|
||||
out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image \
|
||||
out/target/product/sunfish/kernel
|
||||
|
||||
python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_wms_disable_secure_debuggable_gate.py
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_disable_user_apps.py
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_private_dns_providers.py
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_connectivity_check.py
|
||||
|
||||
PH=/srv/rom/src/lineage/vendor/sunfish-a16/prebuilt/Phonesky.apk
|
||||
test -e "$PH"
|
||||
AAPT=/srv/rom/src/lineage/prebuilts/sdk/tools/linux/bin/aapt
|
||||
"$AAPT" dump permissions "$PH" 2>/dev/null | grep -q USE_EXACT_ALARM
|
||||
|
||||
MAGISK_STAGE_DIR=/srv/rom/src/lineage/out/.magisk \
|
||||
vendor/sunfish-a16/magisk/prepare_magisk.sh
|
||||
python3 vendor/sunfish-a16/magisk/apply_releasetools_hook.py --top "$ANDROID_BUILD_TOP" --force
|
||||
test -f out/.magisk/READY
|
||||
|
||||
rm -rf out/soong/.intermediates/build/make/tools/releasetools/releasetools_common
|
||||
rm -rf out/soong/.intermediates/build/make/tools/releasetools/add_img_to_target_files
|
||||
rm -rf out/target/product/sunfish/obj/PACKAGING/target_files_intermediates
|
||||
rm -f out/target/product/sunfish/lineage-*.zip \
|
||||
out/target/product/sunfish/boot.img \
|
||||
out/target/product/sunfish/system/priv-app/Phonesky/Phonesky.apk
|
||||
touch frameworks/base/services/core/java/com/android/server/wm/WindowManagerService.java
|
||||
|
||||
set +u
|
||||
# shellcheck disable=SC1091
|
||||
source build/envsetup.sh
|
||||
set -e
|
||||
unset PRODUCT_DEFAULT_DEV_CERTIFICATE || true
|
||||
breakfast sunfish userdebug
|
||||
test "${TARGET_RELEASE:-}" = "bp4a"
|
||||
|
||||
echo "=== mka bacon $(date -Is) ==="
|
||||
set -o pipefail
|
||||
mka bacon -j8
|
||||
ec=${PIPESTATUS[0]}
|
||||
echo "bacon_exit=$ec $(date -Is)"
|
||||
[ "$ec" -eq 0 ] || exit "$ec"
|
||||
|
||||
PROD=out/target/product/sunfish
|
||||
BID=$(date -u +%Y%m%dT%H%M%SZ)
|
||||
DEST=/srv/rom/artifacts/009-axp-los23-port/${BID}-axp-stage1-combo4-cve-${BISECT}
|
||||
mkdir -p "$DEST"
|
||||
|
||||
TF_BOOT=$(find "$PROD/obj/PACKAGING/target_files_intermediates" -path "*/IMAGES/boot.img" 2>/dev/null | head -1)
|
||||
MAKE_BOOT=$PROD/boot.img
|
||||
if [ -n "${TF_BOOT:-}" ] && [ -f "$TF_BOOT" ]; then
|
||||
cp -v "$TF_BOOT" "$DEST/boot.img"
|
||||
cp -v "$MAKE_BOOT" "$DEST/boot-make.img" 2>/dev/null || true
|
||||
else
|
||||
cp -v "$MAKE_BOOT" "$DEST/boot.img"
|
||||
fi
|
||||
cp -v "$PROD"/lineage-*-UNOFFICIAL-sunfish.zip "$DEST/" 2>/dev/null || true
|
||||
for f in vbmeta.img dtbo.img; do
|
||||
[ -f "$PROD/$f" ] && cp -v "$PROD/$f" "$DEST/"
|
||||
done
|
||||
|
||||
WLAN=$PROD/vendor/lib/modules/wlan.ko
|
||||
if [ -f "$WLAN" ] && [ -f "$PROD/obj/KERNEL_OBJ/Module.symvers" ]; then
|
||||
KCRC=$(awk '$2=="kmalloc_caches"{print $1; exit}' "$PROD/obj/KERNEL_OBJ/Module.symvers")
|
||||
MCRC=$(/sbin/modprobe --dump-modversions "$WLAN" 2>/dev/null | awk '$2=="kmalloc_caches"{print $1; exit}')
|
||||
echo "wlan kmalloc_caches kernel=$KCRC module=$MCRC"
|
||||
fi
|
||||
|
||||
if strings "$DEST/boot.img" | grep -qiE 'KernelSU|CONFIG_KSU_SUSFS'; then
|
||||
echo "FAIL: KernelSU in boot" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
{
|
||||
echo "artifact=$DEST"
|
||||
echo "bisect=$BISECT"
|
||||
echo "list=$LIST"
|
||||
echo "hardening=Stage1+combo4+FORTIFY + CVE-${BISECT}"
|
||||
echo "signing=test-keys"
|
||||
echo "flash=fastboot flash boot boot.img (preferred for bisect); sideload zip if Wi-Fi breaks"
|
||||
echo "recover=fastboot flash boot from 20260929T123401Z-axp-stage1-combo4"
|
||||
date -u +"built=%Y-%m-%dT%H:%M:%SZ"
|
||||
} | tee "$DEST/README.txt"
|
||||
|
||||
(cd "$DEST" && sha256sum boot.img boot-make.img lineage-*-UNOFFICIAL-sunfish.zip 2>/dev/null || true) \
|
||||
| tee "$DEST/SHA256SUMS"
|
||||
|
||||
echo "=== DONE $DEST $(date -Is) ==="
|
||||
@@ -0,0 +1,142 @@
|
||||
#!/bin/bash
|
||||
# 009 bacon — Stage1+combo4+FORTIFY + CVE clean-offset allowlist (no huge patch offsets).
|
||||
# Does not include cve-high-offset-ge200.txt. test-keys. Do not flash until boot-tested.
|
||||
set -e
|
||||
cd /srv/rom/src/lineage
|
||||
export HOME=/home/android-build
|
||||
export CCACHE_DIR=/srv/rom/ccache
|
||||
export USE_CCACHE=1
|
||||
export PATH=/home/android-build/bin:/usr/local/bin:/usr/bin:/bin:$PATH
|
||||
export ANDROID_BUILD_TOP=/srv/rom/src/lineage
|
||||
unset OUT_DIR || true
|
||||
export SUNFISH_A16_MAGISK_PREROOT=1
|
||||
export MAGISK_APK=/srv/rom/prebuilts/magisk/Magisk-v30.7.apk
|
||||
unset PRODUCT_DEFAULT_DEV_CERTIFICATE || true
|
||||
|
||||
LOGDIR=/srv/rom/logs/009-build
|
||||
mkdir -p "$LOGDIR"
|
||||
LOG=$LOGDIR/bacon-axp-stage1-combo4-cve-clean.log
|
||||
exec > >(tee -a "$LOG") 2>&1
|
||||
|
||||
echo "=== START 009-bacon-axp-stage1-combo4-cve-clean $(date -Is) ==="
|
||||
|
||||
LIVE=kernel/google/msm-4.14
|
||||
BASE=28f9290ae067
|
||||
KH=vendor/sunfish-a16/patches/009-kernel-hardening
|
||||
LIST="$KH/cve-clean-offset.list"
|
||||
test -f "$LIST"
|
||||
test -d "$LIVE"
|
||||
|
||||
echo "=== reset kernel @ $BASE ==="
|
||||
git -C "$LIVE" reset --hard "$BASE"
|
||||
git -C "$LIVE" clean -fdq
|
||||
|
||||
chmod +x "$KH"/apply_stage1_combo4.sh "$KH"/apply_cve_strict.sh \
|
||||
"$KH"/apply_stage1.sh "$KH"/apply_combo4_fortify.sh 2>/dev/null || true
|
||||
|
||||
bash "$KH/apply_stage1_combo4.sh" "$LIVE"
|
||||
export CVE_STRICT_LIST="$LIST"
|
||||
# Strict quality gates (defaults in apply_cve_strict.sh)
|
||||
unset CVE_STRICT_CONTINUE || true
|
||||
export CVE_MAX_FUZZ=1
|
||||
export CVE_MAX_ABS_OFFSET=200
|
||||
bash "$KH/apply_cve_strict.sh" "$LIVE"
|
||||
|
||||
DEF=$LIVE/arch/arm64/configs/sunfish_defconfig
|
||||
if grep -qE "^CONFIG_KSU.*=y" "$DEF"; then
|
||||
echo "FAIL: KernelSU in defconfig" >&2
|
||||
exit 1
|
||||
fi
|
||||
for k in FORTIFY_SOURCE INIT_ON_ALLOC_DEFAULT_ON INIT_ON_FREE_DEFAULT_ON \
|
||||
SECURITY_DMESG_RESTRICT SLAB_FREELIST_HARDENED; do
|
||||
grep -q "^CONFIG_${k}=y" "$DEF" || { echo "FAIL missing $k" >&2; exit 1; }
|
||||
done
|
||||
grep -q "ret = __underlying_strlen(q);" "$LIVE/include/linux/string.h"
|
||||
echo "OK: Stage1+combo4+FORTIFY + CVE-clean-offset markers present"
|
||||
|
||||
rm -f out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image.lz4 \
|
||||
out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image \
|
||||
out/target/product/sunfish/kernel
|
||||
|
||||
python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_wms_disable_secure_debuggable_gate.py
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_disable_user_apps.py
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_private_dns_providers.py
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_connectivity_check.py
|
||||
|
||||
PH=/srv/rom/src/lineage/vendor/sunfish-a16/prebuilt/Phonesky.apk
|
||||
test -e "$PH"
|
||||
AAPT=/srv/rom/src/lineage/prebuilts/sdk/tools/linux/bin/aapt
|
||||
"$AAPT" dump permissions "$PH" 2>/dev/null | grep -q USE_EXACT_ALARM
|
||||
|
||||
MAGISK_STAGE_DIR=/srv/rom/src/lineage/out/.magisk \
|
||||
vendor/sunfish-a16/magisk/prepare_magisk.sh
|
||||
python3 vendor/sunfish-a16/magisk/apply_releasetools_hook.py --top "$ANDROID_BUILD_TOP" --force
|
||||
test -f out/.magisk/READY
|
||||
|
||||
rm -rf out/soong/.intermediates/build/make/tools/releasetools/releasetools_common
|
||||
rm -rf out/soong/.intermediates/build/make/tools/releasetools/add_img_to_target_files
|
||||
rm -rf out/target/product/sunfish/obj/PACKAGING/target_files_intermediates
|
||||
rm -f out/target/product/sunfish/lineage-*.zip \
|
||||
out/target/product/sunfish/boot.img \
|
||||
out/target/product/sunfish/system/priv-app/Phonesky/Phonesky.apk
|
||||
touch frameworks/base/services/core/java/com/android/server/wm/WindowManagerService.java
|
||||
|
||||
set +u
|
||||
# shellcheck disable=SC1091
|
||||
source build/envsetup.sh
|
||||
set -e
|
||||
unset PRODUCT_DEFAULT_DEV_CERTIFICATE || true
|
||||
breakfast sunfish userdebug
|
||||
test "${TARGET_RELEASE:-}" = "bp4a"
|
||||
|
||||
echo "=== mka bacon $(date -Is) ==="
|
||||
set -o pipefail
|
||||
mka bacon -j8
|
||||
ec=${PIPESTATUS[0]}
|
||||
echo "bacon_exit=$ec $(date -Is)"
|
||||
[ "$ec" -eq 0 ] || exit "$ec"
|
||||
|
||||
PROD=out/target/product/sunfish
|
||||
BID=$(date -u +%Y%m%dT%H%M%SZ)
|
||||
DEST=/srv/rom/artifacts/009-axp-los23-port/${BID}-axp-stage1-combo4-cve-clean
|
||||
mkdir -p "$DEST"
|
||||
|
||||
TF_BOOT=$(find "$PROD/obj/PACKAGING/target_files_intermediates" -path "*/IMAGES/boot.img" 2>/dev/null | head -1)
|
||||
MAKE_BOOT=$PROD/boot.img
|
||||
if [ -n "${TF_BOOT:-}" ] && [ -f "$TF_BOOT" ]; then
|
||||
cp -v "$TF_BOOT" "$DEST/boot.img"
|
||||
cp -v "$MAKE_BOOT" "$DEST/boot-make.img" 2>/dev/null || true
|
||||
else
|
||||
cp -v "$MAKE_BOOT" "$DEST/boot.img"
|
||||
fi
|
||||
cp -v "$PROD"/lineage-*-UNOFFICIAL-sunfish.zip "$DEST/" 2>/dev/null || true
|
||||
for f in vbmeta.img dtbo.img; do
|
||||
[ -f "$PROD/$f" ] && cp -v "$PROD/$f" "$DEST/"
|
||||
done
|
||||
|
||||
WLAN=$PROD/vendor/lib/modules/wlan.ko
|
||||
if [ -f "$WLAN" ] && [ -f "$PROD/obj/KERNEL_OBJ/Module.symvers" ]; then
|
||||
KCRC=$(awk '$2=="kmalloc_caches"{print $1; exit}' "$PROD/obj/KERNEL_OBJ/Module.symvers")
|
||||
MCRC=$(/sbin/modprobe --dump-modversions "$WLAN" 2>/dev/null | awk '$2=="kmalloc_caches"{print $1; exit}')
|
||||
echo "wlan kmalloc_caches kernel=$KCRC module=$MCRC"
|
||||
fi
|
||||
|
||||
if strings "$DEST/boot.img" | grep -qiE 'KernelSU|CONFIG_KSU_SUSFS'; then
|
||||
echo "FAIL: KernelSU in boot" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
{
|
||||
echo "artifact=$DEST"
|
||||
echo "list=$LIST (cve-strict minus high-offset>=200 minus denylist)"
|
||||
echo "hardening=Stage1+combo4+FORTIFY + CVE-clean-offset"
|
||||
echo "signing=test-keys"
|
||||
echo "flash=fastboot flash boot ONLY after owner OK; recover=Stage1 boot.img"
|
||||
echo "note=do not flash full 503 CVE zip"
|
||||
date -u +"built=%Y-%m-%dT%H:%M:%SZ"
|
||||
} | tee "$DEST/README.txt"
|
||||
|
||||
(cd "$DEST" && sha256sum boot.img boot-make.img lineage-*-UNOFFICIAL-sunfish.zip 2>/dev/null || true) \
|
||||
| tee "$DEST/SHA256SUMS"
|
||||
|
||||
echo "=== DONE $DEST $(date -Is) ==="
|
||||
@@ -0,0 +1,155 @@
|
||||
#!/bin/bash
|
||||
# 009 bacon — Stage1+combo4+FORTIFY + CVE clean-offset + high-offset batch1 (≤10).
|
||||
# Batch1: intentional CVE_MAX_ABS_OFFSET=9999 after spot-check (fuzz=0). test-keys.
|
||||
# Do not flash until boot-tested. Recover = last clean BOOT_OK boot.img.
|
||||
set -e
|
||||
cd /srv/rom/src/lineage
|
||||
export HOME=/home/android-build
|
||||
export CCACHE_DIR=/srv/rom/ccache
|
||||
export USE_CCACHE=1
|
||||
export PATH=/home/android-build/bin:/usr/local/bin:/usr/bin:/bin:$PATH
|
||||
export ANDROID_BUILD_TOP=/srv/rom/src/lineage
|
||||
unset OUT_DIR || true
|
||||
export SUNFISH_A16_MAGISK_PREROOT=1
|
||||
export MAGISK_APK=/srv/rom/prebuilts/magisk/Magisk-v30.7.apk
|
||||
unset PRODUCT_DEFAULT_DEV_CERTIFICATE || true
|
||||
|
||||
LOGDIR=/srv/rom/logs/009-build
|
||||
mkdir -p "$LOGDIR"
|
||||
LOG=$LOGDIR/bacon-axp-stage1-combo4-cve-hi-batch1.log
|
||||
exec > >(tee -a "$LOG") 2>&1
|
||||
|
||||
echo "=== START 009-bacon-axp-stage1-combo4-cve-hi-batch1 $(date -Is) ==="
|
||||
|
||||
LIVE=kernel/google/msm-4.14
|
||||
BASE=28f9290ae067
|
||||
KH=vendor/sunfish-a16/patches/009-kernel-hardening
|
||||
LIST_CLEAN="$KH/cve-clean-offset.list"
|
||||
LIST_HI="$KH/cve-high-offset-batch1.list"
|
||||
test -f "$LIST_CLEAN"
|
||||
test -f "$LIST_HI"
|
||||
test -d "$LIVE"
|
||||
|
||||
echo "=== reset kernel @ $BASE ==="
|
||||
git -C "$LIVE" reset --hard "$BASE"
|
||||
git -C "$LIVE" clean -fdq
|
||||
|
||||
chmod +x "$KH"/apply_stage1_combo4.sh "$KH"/apply_cve_strict.sh \
|
||||
"$KH"/apply_stage1.sh "$KH"/apply_combo4_fortify.sh 2>/dev/null || true
|
||||
|
||||
bash "$KH/apply_stage1_combo4.sh" "$LIVE"
|
||||
|
||||
export CVE_STRICT_LIST="$LIST_CLEAN"
|
||||
unset CVE_STRICT_CONTINUE || true
|
||||
export CVE_MAX_FUZZ=1
|
||||
export CVE_MAX_ABS_OFFSET=200
|
||||
bash "$KH/apply_cve_strict.sh" "$LIVE"
|
||||
|
||||
echo "=== high-offset batch1 (elevated abs-offset gate; fuzz still ≤1) ==="
|
||||
export CVE_STRICT_LIST="$LIST_HI"
|
||||
export CVE_MAX_ABS_OFFSET=9999
|
||||
bash "$KH/apply_cve_strict.sh" "$LIVE"
|
||||
|
||||
DEF=$LIVE/arch/arm64/configs/sunfish_defconfig
|
||||
if grep -qE "^CONFIG_KSU.*=y" "$DEF"; then
|
||||
echo "FAIL: KernelSU in defconfig" >&2
|
||||
exit 1
|
||||
fi
|
||||
for k in FORTIFY_SOURCE INIT_ON_ALLOC_DEFAULT_ON INIT_ON_FREE_DEFAULT_ON \
|
||||
SECURITY_DMESG_RESTRICT SLAB_FREELIST_HARDENED; do
|
||||
grep -q "^CONFIG_${k}=y" "$DEF" || { echo "FAIL missing $k" >&2; exit 1; }
|
||||
done
|
||||
grep -q "ret = __underlying_strlen(q);" "$LIVE/include/linux/string.h"
|
||||
# batch1 markers (spot-checked)
|
||||
grep -q "mmget_still_valid" "$LIVE/mm/madvise.c"
|
||||
grep -q "sched_release_group" "$LIVE/kernel/sched/core.c"
|
||||
grep -q "fwnode_handle_put(tcpci->tcpc.fwnode)" "$LIVE/drivers/usb/typec/tcpm/tcpci.c"
|
||||
echo "OK: Stage1+combo4+FORTIFY + CVE-clean + hi-batch1 markers present"
|
||||
|
||||
rm -f out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image.lz4 \
|
||||
out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image \
|
||||
out/target/product/sunfish/kernel
|
||||
|
||||
python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_wms_disable_secure_debuggable_gate.py
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_disable_user_apps.py
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_private_dns_providers.py
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_connectivity_check.py
|
||||
|
||||
PH=/srv/rom/src/lineage/vendor/sunfish-a16/prebuilt/Phonesky.apk
|
||||
test -e "$PH"
|
||||
AAPT=/srv/rom/src/lineage/prebuilts/sdk/tools/linux/bin/aapt
|
||||
"$AAPT" dump permissions "$PH" 2>/dev/null | grep -q USE_EXACT_ALARM
|
||||
|
||||
MAGISK_STAGE_DIR=/srv/rom/src/lineage/out/.magisk \
|
||||
vendor/sunfish-a16/magisk/prepare_magisk.sh
|
||||
python3 vendor/sunfish-a16/magisk/apply_releasetools_hook.py --top "$ANDROID_BUILD_TOP" --force
|
||||
test -f out/.magisk/READY
|
||||
|
||||
rm -rf out/soong/.intermediates/build/make/tools/releasetools/releasetools_common
|
||||
rm -rf out/soong/.intermediates/build/make/tools/releasetools/add_img_to_target_files
|
||||
rm -rf out/target/product/sunfish/obj/PACKAGING/target_files_intermediates
|
||||
rm -f out/target/product/sunfish/lineage-*.zip \
|
||||
out/target/product/sunfish/boot.img \
|
||||
out/target/product/sunfish/system/priv-app/Phonesky/Phonesky.apk
|
||||
touch frameworks/base/services/core/java/com/android/server/wm/WindowManagerService.java
|
||||
|
||||
set +u
|
||||
# shellcheck disable=SC1091
|
||||
source build/envsetup.sh
|
||||
set -e
|
||||
unset PRODUCT_DEFAULT_DEV_CERTIFICATE || true
|
||||
breakfast sunfish userdebug
|
||||
test "${TARGET_RELEASE:-}" = "bp4a"
|
||||
|
||||
echo "=== mka bacon $(date -Is) ==="
|
||||
set -o pipefail
|
||||
mka bacon -j8
|
||||
ec=${PIPESTATUS[0]}
|
||||
echo "bacon_exit=$ec $(date -Is)"
|
||||
[ "$ec" -eq 0 ] || exit "$ec"
|
||||
|
||||
PROD=out/target/product/sunfish
|
||||
BID=$(date -u +%Y%m%dT%H%M%SZ)
|
||||
DEST=/srv/rom/artifacts/009-axp-los23-port/${BID}-axp-stage1-combo4-cve-hi-batch1
|
||||
mkdir -p "$DEST"
|
||||
|
||||
TF_BOOT=$(find "$PROD/obj/PACKAGING/target_files_intermediates" -path "*/IMAGES/boot.img" 2>/dev/null | head -1)
|
||||
MAKE_BOOT=$PROD/boot.img
|
||||
if [ -n "${TF_BOOT:-}" ] && [ -f "$TF_BOOT" ]; then
|
||||
cp -v "$TF_BOOT" "$DEST/boot.img"
|
||||
cp -v "$MAKE_BOOT" "$DEST/boot-make.img" 2>/dev/null || true
|
||||
else
|
||||
cp -v "$MAKE_BOOT" "$DEST/boot.img"
|
||||
fi
|
||||
cp -v "$PROD"/lineage-*-UNOFFICIAL-sunfish.zip "$DEST/" 2>/dev/null || true
|
||||
for f in vbmeta.img dtbo.img; do
|
||||
[ -f "$PROD/$f" ] && cp -v "$PROD/$f" "$DEST/"
|
||||
done
|
||||
|
||||
WLAN=$PROD/vendor/lib/modules/wlan.ko
|
||||
if [ -f "$WLAN" ] && [ -f "$PROD/obj/KERNEL_OBJ/Module.symvers" ]; then
|
||||
KCRC=$(awk '$2=="kmalloc_caches"{print $1; exit}' "$PROD/obj/KERNEL_OBJ/Module.symvers")
|
||||
MCRC=$(/sbin/modprobe --dump-modversions "$WLAN" 2>/dev/null | awk '$2=="kmalloc_caches"{print $1; exit}')
|
||||
echo "wlan kmalloc_caches kernel=$KCRC module=$MCRC"
|
||||
fi
|
||||
|
||||
if strings "$DEST/boot.img" | grep -qiE 'KernelSU|CONFIG_KSU_SUSFS'; then
|
||||
echo "FAIL: KernelSU in boot" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
{
|
||||
echo "artifact=$DEST"
|
||||
echo "list_clean=$LIST_CLEAN (429)"
|
||||
echo "list_hi=$LIST_HI (7; dropped CVE-2023-3777 missing nft_chain_is_bound)"
|
||||
echo "hardening=Stage1+combo4+FORTIFY + CVE-clean + hi-batch1"
|
||||
echo "cve_max_abs_offset_hi=9999"
|
||||
echo "signing=test-keys"
|
||||
echo "flash=fastboot flash boot ONLY after owner OK; recover=cve-clean BOOT_OK"
|
||||
date -u +"built=%Y-%m-%dT%H:%M:%SZ"
|
||||
} | tee "$DEST/README.txt"
|
||||
|
||||
(cd "$DEST" && sha256sum boot.img boot-make.img lineage-*-UNOFFICIAL-sunfish.zip 2>/dev/null || true) \
|
||||
| tee "$DEST/SHA256SUMS"
|
||||
|
||||
echo "=== DONE $DEST $(date -Is) ==="
|
||||
+160
@@ -0,0 +1,160 @@
|
||||
#!/bin/bash
|
||||
# 009 bacon — Stage1+combo4+FORTIFY + CVE clean + hi-batch1 + hi-batch2.
|
||||
# Elevated CVE_MAX_ABS_OFFSET=9999 for high-offset lists. test-keys.
|
||||
# Recover = hi-batch1 BOOT_OK boot.img (or cve-clean).
|
||||
set -e
|
||||
cd /srv/rom/src/lineage
|
||||
export HOME=/home/android-build
|
||||
export CCACHE_DIR=/srv/rom/ccache
|
||||
export USE_CCACHE=1
|
||||
export PATH=/home/android-build/bin:/usr/local/bin:/usr/bin:/bin:$PATH
|
||||
export ANDROID_BUILD_TOP=/srv/rom/src/lineage
|
||||
unset OUT_DIR || true
|
||||
export SUNFISH_A16_MAGISK_PREROOT=1
|
||||
export MAGISK_APK=/srv/rom/prebuilts/magisk/Magisk-v30.7.apk
|
||||
unset PRODUCT_DEFAULT_DEV_CERTIFICATE || true
|
||||
|
||||
LOGDIR=/srv/rom/logs/009-build
|
||||
mkdir -p "$LOGDIR"
|
||||
LOG=$LOGDIR/bacon-axp-stage1-combo4-cve-hi-batch2.log
|
||||
exec > >(tee -a "$LOG") 2>&1
|
||||
|
||||
echo "=== START 009-bacon-axp-stage1-combo4-cve-hi-batch2 $(date -Is) ==="
|
||||
|
||||
LIVE=kernel/google/msm-4.14
|
||||
BASE=28f9290ae067
|
||||
KH=vendor/sunfish-a16/patches/009-kernel-hardening
|
||||
LIST_CLEAN="$KH/cve-clean-offset.list"
|
||||
LIST_HI1="$KH/cve-high-offset-batch1.list"
|
||||
LIST_HI2="$KH/cve-high-offset-batch2.list"
|
||||
test -f "$LIST_CLEAN"
|
||||
test -f "$LIST_HI1"
|
||||
test -f "$LIST_HI2"
|
||||
test -d "$LIVE"
|
||||
|
||||
echo "=== reset kernel @ $BASE ==="
|
||||
git -C "$LIVE" reset --hard "$BASE"
|
||||
git -C "$LIVE" clean -fdq
|
||||
|
||||
chmod +x "$KH"/apply_stage1_combo4.sh "$KH"/apply_cve_strict.sh \
|
||||
"$KH"/apply_stage1.sh "$KH"/apply_combo4_fortify.sh 2>/dev/null || true
|
||||
|
||||
bash "$KH/apply_stage1_combo4.sh" "$LIVE"
|
||||
|
||||
export CVE_STRICT_LIST="$LIST_CLEAN"
|
||||
unset CVE_STRICT_CONTINUE || true
|
||||
export CVE_MAX_FUZZ=1
|
||||
export CVE_MAX_ABS_OFFSET=200
|
||||
bash "$KH/apply_cve_strict.sh" "$LIVE"
|
||||
|
||||
echo "=== high-offset batch1 (prior LAB OK) ==="
|
||||
export CVE_STRICT_LIST="$LIST_HI1"
|
||||
export CVE_MAX_ABS_OFFSET=9999
|
||||
bash "$KH/apply_cve_strict.sh" "$LIVE"
|
||||
|
||||
echo "=== high-offset batch2 ==="
|
||||
export CVE_STRICT_LIST="$LIST_HI2"
|
||||
export CVE_MAX_ABS_OFFSET=9999
|
||||
bash "$KH/apply_cve_strict.sh" "$LIVE"
|
||||
|
||||
DEF=$LIVE/arch/arm64/configs/sunfish_defconfig
|
||||
if grep -qE "^CONFIG_KSU.*=y" "$DEF"; then
|
||||
echo "FAIL: KernelSU in defconfig" >&2
|
||||
exit 1
|
||||
fi
|
||||
for k in FORTIFY_SOURCE INIT_ON_ALLOC_DEFAULT_ON INIT_ON_FREE_DEFAULT_ON \
|
||||
SECURITY_DMESG_RESTRICT SLAB_FREELIST_HARDENED; do
|
||||
grep -q "^CONFIG_${k}=y" "$DEF" || { echo "FAIL missing $k" >&2; exit 1; }
|
||||
done
|
||||
grep -q "ret = __underlying_strlen(q);" "$LIVE/include/linux/string.h"
|
||||
grep -q "mmget_still_valid" "$LIVE/mm/madvise.c"
|
||||
echo "OK: Stage1+combo4+FORTIFY + CVE-clean + hi-batch1+2 markers present"
|
||||
|
||||
rm -f out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image.lz4 \
|
||||
out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image \
|
||||
out/target/product/sunfish/kernel
|
||||
|
||||
python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_wms_disable_secure_debuggable_gate.py
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_disable_user_apps.py
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_private_dns_providers.py
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_connectivity_check.py
|
||||
|
||||
PH=/srv/rom/src/lineage/vendor/sunfish-a16/prebuilt/Phonesky.apk
|
||||
test -e "$PH"
|
||||
AAPT=/srv/rom/src/lineage/prebuilts/sdk/tools/linux/bin/aapt
|
||||
"$AAPT" dump permissions "$PH" 2>/dev/null | grep -q USE_EXACT_ALARM
|
||||
|
||||
MAGISK_STAGE_DIR=/srv/rom/src/lineage/out/.magisk \
|
||||
vendor/sunfish-a16/magisk/prepare_magisk.sh
|
||||
python3 vendor/sunfish-a16/magisk/apply_releasetools_hook.py --top "$ANDROID_BUILD_TOP" --force
|
||||
test -f out/.magisk/READY
|
||||
|
||||
rm -rf out/soong/.intermediates/build/make/tools/releasetools/releasetools_common
|
||||
rm -rf out/soong/.intermediates/build/make/tools/releasetools/add_img_to_target_files
|
||||
rm -rf out/target/product/sunfish/obj/PACKAGING/target_files_intermediates
|
||||
rm -f out/target/product/sunfish/lineage-*.zip \
|
||||
out/target/product/sunfish/boot.img \
|
||||
out/target/product/sunfish/system/priv-app/Phonesky/Phonesky.apk
|
||||
touch frameworks/base/services/core/java/com/android/server/wm/WindowManagerService.java
|
||||
|
||||
set +u
|
||||
# shellcheck disable=SC1091
|
||||
source build/envsetup.sh
|
||||
set -e
|
||||
unset PRODUCT_DEFAULT_DEV_CERTIFICATE || true
|
||||
breakfast sunfish userdebug
|
||||
test "${TARGET_RELEASE:-}" = "bp4a"
|
||||
|
||||
echo "=== mka bacon $(date -Is) ==="
|
||||
set -o pipefail
|
||||
mka bacon -j8
|
||||
ec=${PIPESTATUS[0]}
|
||||
echo "bacon_exit=$ec $(date -Is)"
|
||||
[ "$ec" -eq 0 ] || exit "$ec"
|
||||
|
||||
PROD=out/target/product/sunfish
|
||||
BID=$(date -u +%Y%m%dT%H%M%SZ)
|
||||
DEST=/srv/rom/artifacts/009-axp-los23-port/${BID}-axp-stage1-combo4-cve-hi-batch2
|
||||
mkdir -p "$DEST"
|
||||
|
||||
TF_BOOT=$(find "$PROD/obj/PACKAGING/target_files_intermediates" -path "*/IMAGES/boot.img" 2>/dev/null | head -1)
|
||||
MAKE_BOOT=$PROD/boot.img
|
||||
if [ -n "${TF_BOOT:-}" ] && [ -f "$TF_BOOT" ]; then
|
||||
cp -v "$TF_BOOT" "$DEST/boot.img"
|
||||
cp -v "$MAKE_BOOT" "$DEST/boot-make.img" 2>/dev/null || true
|
||||
else
|
||||
cp -v "$MAKE_BOOT" "$DEST/boot.img"
|
||||
fi
|
||||
cp -v "$PROD"/lineage-*-UNOFFICIAL-sunfish.zip "$DEST/" 2>/dev/null || true
|
||||
for f in vbmeta.img dtbo.img; do
|
||||
[ -f "$PROD/$f" ] && cp -v "$PROD/$f" "$DEST/"
|
||||
done
|
||||
|
||||
WLAN=$PROD/vendor/lib/modules/wlan.ko
|
||||
if [ -f "$WLAN" ] && [ -f "$PROD/obj/KERNEL_OBJ/Module.symvers" ]; then
|
||||
KCRC=$(awk '$2=="kmalloc_caches"{print $1; exit}' "$PROD/obj/KERNEL_OBJ/Module.symvers")
|
||||
MCRC=$(/sbin/modprobe --dump-modversions "$WLAN" 2>/dev/null | awk '$2=="kmalloc_caches"{print $1; exit}')
|
||||
echo "wlan kmalloc_caches kernel=$KCRC module=$MCRC"
|
||||
fi
|
||||
|
||||
if strings "$DEST/boot.img" | grep -qiE 'KernelSU|CONFIG_KSU_SUSFS'; then
|
||||
echo "FAIL: KernelSU in boot" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
{
|
||||
echo "artifact=$DEST"
|
||||
echo "list_clean=$LIST_CLEAN (429)"
|
||||
echo "list_hi1=$LIST_HI1"
|
||||
echo "list_hi2=$LIST_HI2"
|
||||
echo "hardening=Stage1+combo4+FORTIFY + CVE-clean + hi-batch1+2"
|
||||
echo "cve_max_abs_offset_hi=9999"
|
||||
echo "signing=test-keys"
|
||||
echo "flash=fastboot flash boot; recover=hi-batch1 BOOT_OK"
|
||||
date -u +"built=%Y-%m-%dT%H:%M:%SZ"
|
||||
} | tee "$DEST/README.txt"
|
||||
|
||||
(cd "$DEST" && sha256sum boot.img boot-make.img lineage-*-UNOFFICIAL-sunfish.zip 2>/dev/null || true) \
|
||||
| tee "$DEST/SHA256SUMS"
|
||||
|
||||
echo "=== DONE $DEST $(date -Is) ==="
|
||||
+162
@@ -0,0 +1,162 @@
|
||||
#!/bin/bash
|
||||
# 009 bacon — Stage1+combo4+FORTIFY + CVE clean + hi-batch1+2+3.
|
||||
# Elevated CVE_MAX_ABS_OFFSET=9999 for high-offset lists. test-keys.
|
||||
# Recover = hi-batch2 BOOT_OK boot.img.
|
||||
set -e
|
||||
cd /srv/rom/src/lineage
|
||||
export HOME=/home/android-build
|
||||
export CCACHE_DIR=/srv/rom/ccache
|
||||
export USE_CCACHE=1
|
||||
export PATH=/home/android-build/bin:/usr/local/bin:/usr/bin:/bin:$PATH
|
||||
export ANDROID_BUILD_TOP=/srv/rom/src/lineage
|
||||
unset OUT_DIR || true
|
||||
export SUNFISH_A16_MAGISK_PREROOT=1
|
||||
export MAGISK_APK=/srv/rom/prebuilts/magisk/Magisk-v30.7.apk
|
||||
unset PRODUCT_DEFAULT_DEV_CERTIFICATE || true
|
||||
|
||||
LOGDIR=/srv/rom/logs/009-build
|
||||
mkdir -p "$LOGDIR"
|
||||
LOG=$LOGDIR/bacon-axp-stage1-combo4-cve-hi-batch3.log
|
||||
exec > >(tee -a "$LOG") 2>&1
|
||||
|
||||
echo "=== START 009-bacon-axp-stage1-combo4-cve-hi-batch3 $(date -Is) ==="
|
||||
|
||||
LIVE=kernel/google/msm-4.14
|
||||
BASE=28f9290ae067
|
||||
KH=vendor/sunfish-a16/patches/009-kernel-hardening
|
||||
LIST_CLEAN="$KH/cve-clean-offset.list"
|
||||
LIST_HI1="$KH/cve-high-offset-batch1.list"
|
||||
LIST_HI2="$KH/cve-high-offset-batch2.list"
|
||||
LIST_HI3="$KH/cve-high-offset-batch3.list"
|
||||
test -f "$LIST_CLEAN"
|
||||
test -f "$LIST_HI1"
|
||||
test -f "$LIST_HI2"
|
||||
test -f "$LIST_HI3"
|
||||
test -d "$LIVE"
|
||||
|
||||
echo "=== reset kernel @ $BASE ==="
|
||||
git -C "$LIVE" reset --hard "$BASE"
|
||||
git -C "$LIVE" clean -fdq
|
||||
|
||||
chmod +x "$KH"/apply_stage1_combo4.sh "$KH"/apply_cve_strict.sh \
|
||||
"$KH"/apply_stage1.sh "$KH"/apply_combo4_fortify.sh 2>/dev/null || true
|
||||
|
||||
bash "$KH/apply_stage1_combo4.sh" "$LIVE"
|
||||
|
||||
export CVE_STRICT_LIST="$LIST_CLEAN"
|
||||
unset CVE_STRICT_CONTINUE || true
|
||||
export CVE_MAX_FUZZ=1
|
||||
export CVE_MAX_ABS_OFFSET=200
|
||||
bash "$KH/apply_cve_strict.sh" "$LIVE"
|
||||
|
||||
export CVE_MAX_ABS_OFFSET=9999
|
||||
for L in "$LIST_HI1" "$LIST_HI2" "$LIST_HI3"; do
|
||||
echo "=== high-offset $(basename "$L") ==="
|
||||
export CVE_STRICT_LIST="$L"
|
||||
bash "$KH/apply_cve_strict.sh" "$LIVE"
|
||||
done
|
||||
|
||||
DEF=$LIVE/arch/arm64/configs/sunfish_defconfig
|
||||
if grep -qE "^CONFIG_KSU.*=y" "$DEF"; then
|
||||
echo "FAIL: KernelSU in defconfig" >&2
|
||||
exit 1
|
||||
fi
|
||||
for k in FORTIFY_SOURCE INIT_ON_ALLOC_DEFAULT_ON INIT_ON_FREE_DEFAULT_ON \
|
||||
SECURITY_DMESG_RESTRICT SLAB_FREELIST_HARDENED; do
|
||||
grep -q "^CONFIG_${k}=y" "$DEF" || { echo "FAIL missing $k" >&2; exit 1; }
|
||||
done
|
||||
grep -q "ret = __underlying_strlen(q);" "$LIVE/include/linux/string.h"
|
||||
grep -q "mmget_still_valid" "$LIVE/mm/madvise.c"
|
||||
echo "OK: Stage1+combo4+FORTIFY + CVE-clean + hi-batch1+2+3 markers present"
|
||||
|
||||
rm -f out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image.lz4 \
|
||||
out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image \
|
||||
out/target/product/sunfish/kernel
|
||||
|
||||
python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_wms_disable_secure_debuggable_gate.py
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_disable_user_apps.py
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_private_dns_providers.py
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_connectivity_check.py
|
||||
|
||||
PH=/srv/rom/src/lineage/vendor/sunfish-a16/prebuilt/Phonesky.apk
|
||||
test -e "$PH"
|
||||
AAPT=/srv/rom/src/lineage/prebuilts/sdk/tools/linux/bin/aapt
|
||||
"$AAPT" dump permissions "$PH" 2>/dev/null | grep -q USE_EXACT_ALARM
|
||||
|
||||
MAGISK_STAGE_DIR=/srv/rom/src/lineage/out/.magisk \
|
||||
vendor/sunfish-a16/magisk/prepare_magisk.sh
|
||||
python3 vendor/sunfish-a16/magisk/apply_releasetools_hook.py --top "$ANDROID_BUILD_TOP" --force
|
||||
test -f out/.magisk/READY
|
||||
|
||||
rm -rf out/soong/.intermediates/build/make/tools/releasetools/releasetools_common
|
||||
rm -rf out/soong/.intermediates/build/make/tools/releasetools/add_img_to_target_files
|
||||
rm -rf out/target/product/sunfish/obj/PACKAGING/target_files_intermediates
|
||||
rm -f out/target/product/sunfish/lineage-*.zip \
|
||||
out/target/product/sunfish/boot.img \
|
||||
out/target/product/sunfish/system/priv-app/Phonesky/Phonesky.apk
|
||||
touch frameworks/base/services/core/java/com/android/server/wm/WindowManagerService.java
|
||||
|
||||
set +u
|
||||
# shellcheck disable=SC1091
|
||||
source build/envsetup.sh
|
||||
set -e
|
||||
unset PRODUCT_DEFAULT_DEV_CERTIFICATE || true
|
||||
breakfast sunfish userdebug
|
||||
test "${TARGET_RELEASE:-}" = "bp4a"
|
||||
|
||||
echo "=== mka bacon $(date -Is) ==="
|
||||
set -o pipefail
|
||||
mka bacon -j8
|
||||
ec=${PIPESTATUS[0]}
|
||||
echo "bacon_exit=$ec $(date -Is)"
|
||||
[ "$ec" -eq 0 ] || exit "$ec"
|
||||
|
||||
PROD=out/target/product/sunfish
|
||||
BID=$(date -u +%Y%m%dT%H%M%SZ)
|
||||
DEST=/srv/rom/artifacts/009-axp-los23-port/${BID}-axp-stage1-combo4-cve-hi-batch3
|
||||
mkdir -p "$DEST"
|
||||
|
||||
TF_BOOT=$(find "$PROD/obj/PACKAGING/target_files_intermediates" -path "*/IMAGES/boot.img" 2>/dev/null | head -1)
|
||||
MAKE_BOOT=$PROD/boot.img
|
||||
if [ -n "${TF_BOOT:-}" ] && [ -f "$TF_BOOT" ]; then
|
||||
cp -v "$TF_BOOT" "$DEST/boot.img"
|
||||
cp -v "$MAKE_BOOT" "$DEST/boot-make.img" 2>/dev/null || true
|
||||
else
|
||||
cp -v "$MAKE_BOOT" "$DEST/boot.img"
|
||||
fi
|
||||
cp -v "$PROD"/lineage-*-UNOFFICIAL-sunfish.zip "$DEST/" 2>/dev/null || true
|
||||
for f in vbmeta.img dtbo.img; do
|
||||
[ -f "$PROD/$f" ] && cp -v "$PROD/$f" "$DEST/"
|
||||
done
|
||||
|
||||
WLAN=$PROD/vendor/lib/modules/wlan.ko
|
||||
if [ -f "$WLAN" ] && [ -f "$PROD/obj/KERNEL_OBJ/Module.symvers" ]; then
|
||||
KCRC=$(awk '$2=="kmalloc_caches"{print $1; exit}' "$PROD/obj/KERNEL_OBJ/Module.symvers")
|
||||
MCRC=$(/sbin/modprobe --dump-modversions "$WLAN" 2>/dev/null | awk '$2=="kmalloc_caches"{print $1; exit}')
|
||||
echo "wlan kmalloc_caches kernel=$KCRC module=$MCRC"
|
||||
fi
|
||||
|
||||
if strings "$DEST/boot.img" | grep -qiE 'KernelSU|CONFIG_KSU_SUSFS'; then
|
||||
echo "FAIL: KernelSU in boot" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
{
|
||||
echo "artifact=$DEST"
|
||||
echo "list_clean=$LIST_CLEAN (429)"
|
||||
echo "list_hi1=$LIST_HI1"
|
||||
echo "list_hi2=$LIST_HI2"
|
||||
echo "list_hi3=$LIST_HI3"
|
||||
echo "hardening=Stage1+combo4+FORTIFY + CVE-clean + hi-batch1+2+3"
|
||||
echo "cve_max_abs_offset_hi=9999"
|
||||
echo "signing=test-keys"
|
||||
echo "flash=fastboot flash boot; recover=hi-batch2 BOOT_OK"
|
||||
date -u +"built=%Y-%m-%dT%H:%M:%SZ"
|
||||
} | tee "$DEST/README.txt"
|
||||
|
||||
(cd "$DEST" && sha256sum boot.img boot-make.img lineage-*-UNOFFICIAL-sunfish.zip 2>/dev/null || true) \
|
||||
| tee "$DEST/SHA256SUMS"
|
||||
|
||||
echo "=== DONE $DEST $(date -Is) ==="
|
||||
# Force clean exit even if tee gets SIGPIPE on detach wrap
|
||||
exit 0
|
||||
+380
@@ -0,0 +1,380 @@
|
||||
#!/bin/bash
|
||||
# 009 bacon — ship pack with project release keys (US-S2).
|
||||
# Stage1+combo4+FORTIFY + CVE clean + hi-batch1+2+3 + PRODUCT_DEFAULT_DEV_CERTIFICATE.
|
||||
# Requires $HOME/.android-certs/releasekey.{pk8,x509.pem}. userdebug.
|
||||
set -e
|
||||
cd /srv/rom/src/lineage
|
||||
export HOME=/home/android-build
|
||||
export CCACHE_DIR=/srv/rom/ccache
|
||||
export USE_CCACHE=1
|
||||
export PATH=/home/android-build/bin:/usr/local/bin:/usr/bin:/bin:$PATH
|
||||
export ANDROID_BUILD_TOP=/srv/rom/src/lineage
|
||||
unset OUT_DIR || true
|
||||
export SUNFISH_A16_MAGISK_PREROOT=1
|
||||
export MAGISK_APK=/srv/rom/prebuilts/magisk/Magisk-v30.7.apk
|
||||
|
||||
LOGDIR=/srv/rom/logs/009-build
|
||||
mkdir -p "$LOGDIR"
|
||||
LOG=$LOGDIR/bacon-axp-stage1-combo4-cve-hi-releasekeys.log
|
||||
exec > >(tee -a "$LOG") 2>&1
|
||||
|
||||
echo "=== START 009-bacon-axp-cve-hi-releasekeys $(date -Is) ==="
|
||||
|
||||
CERT_DIR="${ANDROID_CERTS_DIR:-$HOME/.android-certs}"
|
||||
if [[ ! -f "$CERT_DIR/releasekey.pk8" || ! -f "$CERT_DIR/releasekey.x509.pem" ]]; then
|
||||
echo "FAIL: missing $CERT_DIR/releasekey.{pk8,x509.pem}" >&2
|
||||
exit 1
|
||||
fi
|
||||
export PRODUCT_DEFAULT_DEV_CERTIFICATE="$CERT_DIR/releasekey"
|
||||
echo "OK: PRODUCT_DEFAULT_DEV_CERTIFICATE=$PRODUCT_DEFAULT_DEV_CERTIFICATE"
|
||||
|
||||
LIVE=kernel/google/msm-4.14
|
||||
BASE=28f9290ae067
|
||||
KH=vendor/sunfish-a16/patches/009-kernel-hardening
|
||||
LIST_CLEAN="$KH/cve-clean-offset.list"
|
||||
LIST_HI1="$KH/cve-high-offset-batch1.list"
|
||||
LIST_HI2="$KH/cve-high-offset-batch2.list"
|
||||
LIST_HI3="$KH/cve-high-offset-batch3.list"
|
||||
test -f "$LIST_CLEAN"
|
||||
test -f "$LIST_HI1"
|
||||
test -f "$LIST_HI2"
|
||||
test -f "$LIST_HI3"
|
||||
test -d "$LIVE"
|
||||
|
||||
echo "=== reset kernel @ $BASE ==="
|
||||
git -C "$LIVE" reset --hard "$BASE"
|
||||
git -C "$LIVE" clean -fdq
|
||||
|
||||
chmod +x "$KH"/apply_stage1_combo4.sh "$KH"/apply_cve_strict.sh \
|
||||
"$KH"/apply_stage1.sh "$KH"/apply_combo4_fortify.sh 2>/dev/null || true
|
||||
|
||||
bash "$KH/apply_stage1_combo4.sh" "$LIVE"
|
||||
|
||||
# US-S5-1 — Yama + SLAB_FREELIST_RANDOM (Graphene/AXP defconfig gaps)
|
||||
chmod +x "$KH/apply_uss5_1_defconfig.sh" 2>/dev/null || true
|
||||
bash "$KH/apply_uss5_1_defconfig.sh" "$LIVE"
|
||||
|
||||
export CVE_STRICT_LIST="$LIST_CLEAN"
|
||||
unset CVE_STRICT_CONTINUE || true
|
||||
export CVE_MAX_FUZZ=1
|
||||
export CVE_MAX_ABS_OFFSET=200
|
||||
bash "$KH/apply_cve_strict.sh" "$LIVE"
|
||||
|
||||
export CVE_MAX_ABS_OFFSET=9999
|
||||
for L in "$LIST_HI1" "$LIST_HI2" "$LIST_HI3"; do
|
||||
echo "=== high-offset $(basename "$L") ==="
|
||||
export CVE_STRICT_LIST="$L"
|
||||
bash "$KH/apply_cve_strict.sh" "$LIVE"
|
||||
done
|
||||
|
||||
DEF=$LIVE/arch/arm64/configs/sunfish_defconfig
|
||||
if grep -qE "^CONFIG_KSU.*=y" "$DEF"; then
|
||||
echo "FAIL: KernelSU in defconfig" >&2
|
||||
exit 1
|
||||
fi
|
||||
for k in FORTIFY_SOURCE INIT_ON_ALLOC_DEFAULT_ON INIT_ON_FREE_DEFAULT_ON \
|
||||
SECURITY_DMESG_RESTRICT SLAB_FREELIST_HARDENED \
|
||||
SECURITY_YAMA SLAB_FREELIST_RANDOM; do
|
||||
grep -q "^CONFIG_${k}=y" "$DEF" || { echo "FAIL missing $k" >&2; exit 1; }
|
||||
done
|
||||
grep -q "ret = __underlying_strlen(q);" "$LIVE/include/linux/string.h"
|
||||
grep -q "mmget_still_valid" "$LIVE/mm/madvise.c"
|
||||
echo "OK: Stage1+combo4+FORTIFY + CVE-clean + hi-batch1+2+3 markers present"
|
||||
|
||||
rm -f out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image.lz4 \
|
||||
out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image \
|
||||
out/target/product/sunfish/kernel
|
||||
|
||||
python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_wms_disable_secure_debuggable_gate.py
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_disable_user_apps.py
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_private_dns_providers.py
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_connectivity_check.py
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_unofficial_build_id.py
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_drop_openssh_packages.py
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_drop_jelly_gallery2.py
|
||||
|
||||
# Host prebuilts → vendor/sunfish-a16/prebuilt (rsync --delete must not wipe these).
|
||||
mkdir -p vendor/sunfish-a16/prebuilt
|
||||
link_prebuilt() {
|
||||
local name="$1" src="$2"
|
||||
local dst="vendor/sunfish-a16/prebuilt/$name"
|
||||
ln -sfn "$src" "$dst"
|
||||
test -e "$dst" || { echo "FAIL: missing prebuilt $dst -> $src" >&2; exit 1; }
|
||||
}
|
||||
link_prebuilt Phonesky.apk /srv/rom/prebuilts/phonesky/Phonesky.apk
|
||||
link_prebuilt GmsCore.apk /srv/rom/prebuilts/microg/GmsCore.apk
|
||||
link_prebuilt GsfProxy.apk /srv/rom/prebuilts/microg/GsfProxy.apk
|
||||
link_prebuilt AuroraStore.apk /srv/rom/prebuilts/axp-apps/AuroraStore.apk
|
||||
link_prebuilt Droidify.apk /srv/rom/prebuilts/axp-apps/Droidify.apk
|
||||
link_prebuilt FossifyGallery.apk /srv/rom/prebuilts/axp-apps/FossifyGallery.apk
|
||||
AAPT=/srv/rom/src/lineage/prebuilts/sdk/tools/linux/bin/aapt
|
||||
"$AAPT" dump permissions vendor/sunfish-a16/prebuilt/Phonesky.apk 2>/dev/null | grep -q USE_EXACT_ALARM
|
||||
|
||||
# Early hook so LINEAGE_VERSION includes AXP-Resurection-Pro (before version.mk).
|
||||
mkdir -p vendor/extra
|
||||
ln -sfn ../sunfish-a16/extra-product.mk vendor/extra/product.mk
|
||||
test -f vendor/extra/product.mk
|
||||
|
||||
MAGISK_STAGE_DIR=/srv/rom/src/lineage/out/.magisk \
|
||||
vendor/sunfish-a16/magisk/prepare_magisk.sh
|
||||
python3 vendor/sunfish-a16/magisk/apply_releasetools_hook.py --top "$ANDROID_BUILD_TOP" --force
|
||||
test -f out/.magisk/READY
|
||||
|
||||
rm -rf out/soong/.intermediates/build/make/tools/releasetools/releasetools_common
|
||||
rm -rf out/soong/.intermediates/build/make/tools/releasetools/add_img_to_target_files
|
||||
rm -rf out/target/product/sunfish/obj/PACKAGING/target_files_intermediates
|
||||
rm -f out/target/product/sunfish/lineage-*.zip \
|
||||
out/target/product/sunfish/boot.img \
|
||||
out/target/product/sunfish/system/priv-app/Phonesky/Phonesky.apk
|
||||
touch frameworks/base/services/core/java/com/android/server/wm/WindowManagerService.java
|
||||
|
||||
set +u
|
||||
# shellcheck disable=SC1091
|
||||
source build/envsetup.sh
|
||||
set -e
|
||||
# re-export after envsetup (some trees clear it)
|
||||
export PRODUCT_DEFAULT_DEV_CERTIFICATE="$CERT_DIR/releasekey"
|
||||
breakfast sunfish userdebug
|
||||
test "${TARGET_RELEASE:-}" = "bp4a"
|
||||
BT_SEPOL=$(get_build_var MAINLINE_BLUETOOTH_SEPOLICY_DEV_CERTIFICATES)
|
||||
echo "MAINLINE_BLUETOOTH_SEPOLICY_DEV_CERTIFICATES=$BT_SEPOL"
|
||||
case "$BT_SEPOL" in
|
||||
*vendor/sunfish-a16/certs*) ;;
|
||||
*) echo "FAIL: BT sepolicy certs still AOSP default ($BT_SEPOL)" >&2; exit 1 ;;
|
||||
esac
|
||||
AVB_KEY=$(get_build_var BOARD_AVB_KEY_PATH)
|
||||
AVB_ALG=$(get_build_var BOARD_AVB_ALGORITHM)
|
||||
echo "BOARD_AVB_KEY_PATH=$AVB_KEY"
|
||||
echo "BOARD_AVB_ALGORITHM=$AVB_ALG"
|
||||
case "$AVB_KEY" in
|
||||
*vendor/sunfish-a16/certs/avb.pem) ;;
|
||||
*) echo "FAIL: AVB key not project certs/avb.pem ($AVB_KEY)" >&2; exit 1 ;;
|
||||
esac
|
||||
[[ "$AVB_ALG" == "SHA256_RSA4096" ]] || { echo "FAIL: AVB alg=$AVB_ALG" >&2; exit 1; }
|
||||
|
||||
echo "=== mka bacon $(date -Is) signing=$PRODUCT_DEFAULT_DEV_CERTIFICATE ==="
|
||||
set -o pipefail
|
||||
mka bacon -j8
|
||||
ec=${PIPESTATUS[0]}
|
||||
echo "bacon_exit=$ec $(date -Is)"
|
||||
[ "$ec" -eq 0 ] || exit "$ec"
|
||||
|
||||
# Post-ship gates: drop pipefail. Early-exit awk/head + large pipes otherwise
|
||||
# yield exit=141 (SIGPIPE) and skip Magisk/AVB/US-S4 checks.
|
||||
set +o pipefail
|
||||
|
||||
PROD=out/target/product/sunfish
|
||||
BID=$(date -u +%Y%m%dT%H%M%SZ)
|
||||
DEST=/srv/rom/artifacts/009-axp-los23-port/${BID}-axp-stage1-combo4-cve-hi-releasekeys
|
||||
mkdir -p "$DEST"
|
||||
|
||||
# Ship pair = target_files IMAGES (Magisk boot + matching vbmeta). OUT/*.img can be
|
||||
# stock make images that do NOT match the OTA payload — do not prefer those.
|
||||
TF_IMG=$(find "$PROD/obj/PACKAGING/target_files_intermediates" -type d -path '*/IMAGES' 2>/dev/null | head -1)
|
||||
[[ -n "${TF_IMG:-}" && -d "$TF_IMG" ]] || { echo "FAIL: missing target_files IMAGES" >&2; exit 1; }
|
||||
TF_IMG=$(readlink -f "$TF_IMG")
|
||||
for f in boot.img vbmeta.img vbmeta_system.img dtbo.img; do
|
||||
[[ -f "$TF_IMG/$f" ]] || { echo "FAIL: missing $TF_IMG/$f" >&2; exit 1; }
|
||||
cp -v "$TF_IMG/$f" "$DEST/"
|
||||
done
|
||||
# Large partition images: hardlink into DEST so verify_image stays repeatable
|
||||
# after OUT is cleaned (same FS). Fallback: absolute symlink, then full copy.
|
||||
for f in vendor.img product.img system.img system_ext.img; do
|
||||
[[ -f "$TF_IMG/$f" ]] || continue
|
||||
rm -f "$DEST/$f"
|
||||
if cp -al "$TF_IMG/$f" "$DEST/$f" 2>/dev/null; then
|
||||
echo "hardlink $f -> $DEST/$f"
|
||||
elif ln -sfn "$TF_IMG/$f" "$DEST/$f"; then
|
||||
echo "symlink-abs $f -> $TF_IMG/$f"
|
||||
else
|
||||
cp -v "$TF_IMG/$f" "$DEST/$f"
|
||||
fi
|
||||
done
|
||||
# Keep make OUT boot for forensics only (often stock / non-Magisk).
|
||||
cp -v "$PROD/boot.img" "$DEST/boot-make-out.img" 2>/dev/null || true
|
||||
cp -v "$PROD"/lineage-*-UNOFFICIAL*.zip "$DEST/" 2>/dev/null || \
|
||||
cp -v "$PROD"/lineage-*.zip "$DEST/" 2>/dev/null || true
|
||||
|
||||
# Publish AXP Resurection Pro ship name (hardlink/copy). Lineage bacon.mk still
|
||||
# emits lineage-*.zip; do not rebuild solely to rename.
|
||||
ZIP_LINEAGE=$(ls "$DEST"/lineage-*.zip 2>/dev/null | head -1 || true)
|
||||
if [[ -n "${ZIP_LINEAGE:-}" ]]; then
|
||||
# lineage-23.2-YYYYMMDD-UNOFFICIAL[-AXP-Resurection[-Pro]]-sunfish.zip
|
||||
# → AXP-Resurection-Pro-23.2-YYYYMMDD-sunfish.zip
|
||||
ZIP_BASE=$(basename "$ZIP_LINEAGE")
|
||||
ZIP_AXP=$(echo "$ZIP_BASE" | sed -E \
|
||||
's/^lineage-([0-9]+\.[0-9]+)-([0-9]{8})(-[0-9]{6})?-UNOFFICIAL(-AXP-Resurection(-Pro)?)?-sunfish\.zip$/AXP-Resurection-Pro-\1-\2\3-sunfish.zip/')
|
||||
if [[ "$ZIP_AXP" == "$ZIP_BASE" ]]; then
|
||||
ZIP_AXP="AXP-Resurection-Pro-${ZIP_BASE#lineage-}"
|
||||
fi
|
||||
ln -f "$ZIP_LINEAGE" "$DEST/$ZIP_AXP" 2>/dev/null || cp -v "$ZIP_LINEAGE" "$DEST/$ZIP_AXP"
|
||||
echo "ship_zip=$ZIP_AXP (from $ZIP_BASE)"
|
||||
fi
|
||||
|
||||
WLAN=$PROD/vendor/lib/modules/wlan.ko
|
||||
if [ -f "$WLAN" ] && [ -f "$PROD/obj/KERNEL_OBJ/Module.symvers" ]; then
|
||||
KCRC=$(awk '$2=="kmalloc_caches"{print $1; exit}' "$PROD/obj/KERNEL_OBJ/Module.symvers")
|
||||
MCRC=$(/sbin/modprobe --dump-modversions "$WLAN" 2>/dev/null | awk '$2=="kmalloc_caches"{print $1; exit}')
|
||||
echo "wlan kmalloc_caches kernel=$KCRC module=$MCRC"
|
||||
fi
|
||||
|
||||
# Avoid pipefail SIGPIPE: never `strings | grep` on large boot.img.
|
||||
_BOOT_STR=$(mktemp)
|
||||
strings "$DEST/boot.img" >"$_BOOT_STR"
|
||||
if grep -iE 'KernelSU|CONFIG_KSU_SUSFS' "$_BOOT_STR" >/dev/null; then
|
||||
rm -f "$_BOOT_STR"
|
||||
echo "FAIL: KernelSU in boot" >&2
|
||||
exit 1
|
||||
fi
|
||||
rm -f "$_BOOT_STR"
|
||||
|
||||
# Magisk preroot must be present on the ship boot (magiskboot cpio test: 0=stock, 1=Magisk).
|
||||
MAGISKBOOT="$ANDROID_BUILD_TOP/out/.magisk/magiskboot"
|
||||
[[ -x "$MAGISKBOOT" ]] || { echo "FAIL: missing $MAGISKBOOT" >&2; exit 1; }
|
||||
MB_TMP=$(mktemp -d)
|
||||
cp "$DEST/boot.img" "$MB_TMP/boot.img"
|
||||
set +e
|
||||
( cd "$MB_TMP" && "$MAGISKBOOT" unpack boot.img >/dev/null )
|
||||
( cd "$MB_TMP" && "$MAGISKBOOT" cpio ramdisk.cpio test )
|
||||
MB_EC=$?
|
||||
set -e
|
||||
rm -rf "$MB_TMP"
|
||||
# magiskboot cpio test: 0=stock, non-zero (usually 1) = Magisk present
|
||||
[[ "$MB_EC" -ne 0 ]] || { echo "FAIL: ship boot is stock (magiskboot cpio test=$MB_EC); expected Magisk" >&2; exit 1; }
|
||||
echo "magiskboot_cpio_test=$MB_EC (non-zero => Magisk present)"
|
||||
|
||||
ZIP=$(ls "$DEST"/lineage-*-UNOFFICIAL*.zip 2>/dev/null | head -1 || true)
|
||||
if [[ -n "$ZIP" ]]; then
|
||||
unzip -p "$ZIP" META-INF/com/android/otacert 2>/dev/null | openssl x509 -noout -subject 2>/dev/null \
|
||||
| tee "$DEST/otacert-subject.txt" || true
|
||||
if grep -qi 'Test Keys\|Android\|AOSP' "$DEST/otacert-subject.txt" 2>/dev/null; then
|
||||
echo "WARN: otacert subject looks like test/AOSP — check keys wire" | tee -a "$DEST/README.txt"
|
||||
fi
|
||||
fi
|
||||
|
||||
# US-S3 artifact gates — fail closed (signing infrastructure; NOT runtime AVB harden).
|
||||
# flags=3 => HASHTREE_DISABLED|VERIFICATION_DISABLED (libavb); Magisk-friendly unlocked LAB.
|
||||
AVBTOOL="$ANDROID_BUILD_TOP/out/host/linux-x86/bin/avbtool"
|
||||
AVB_PEM="$ANDROID_BUILD_TOP/vendor/sunfish-a16/certs/avb.pem"
|
||||
AVB_PKMD="$ANDROID_BUILD_TOP/vendor/sunfish-a16/certs/avb_pkmd.bin"
|
||||
[[ -x "$AVBTOOL" ]] || { echo "FAIL: missing $AVBTOOL" >&2; exit 1; }
|
||||
[[ -f "$DEST/vbmeta.img" ]] || { echo "FAIL: missing $DEST/vbmeta.img" >&2; exit 1; }
|
||||
[[ -f "$DEST/boot.img" ]] || { echo "FAIL: missing $DEST/boot.img" >&2; exit 1; }
|
||||
[[ -f "$AVB_PEM" ]] || { echo "FAIL: missing $AVB_PEM" >&2; exit 1; }
|
||||
if [[ ! -f "$AVB_PKMD" ]]; then
|
||||
"$AVBTOOL" extract_public_key --key "$AVB_PEM" --output "$AVB_PKMD"
|
||||
fi
|
||||
|
||||
"$AVBTOOL" info_image --image "$DEST/vbmeta.img" | tee "$DEST/vbmeta-info.txt"
|
||||
EXP=$(sha1sum "$AVB_PKMD" | awk '{print $1}')
|
||||
GOT=$(awk '/^Public key \(sha1\):/{print $NF; exit}' "$DEST/vbmeta-info.txt")
|
||||
FLAGS=$(awk '/^Flags:/{print $2; exit}' "$DEST/vbmeta-info.txt")
|
||||
echo "avb_pubkey_sha1 artifact=$GOT project=$EXP flags=$FLAGS"
|
||||
[[ -n "$GOT" ]] || { echo "FAIL: could not parse vbmeta public key sha1" >&2; exit 1; }
|
||||
[[ "$GOT" == "$EXP" ]] || { echo "FAIL: vbmeta pubkey != project avb_pkmd.bin" >&2; exit 1; }
|
||||
[[ "$FLAGS" == "3" ]] || { echo "FAIL: expected vbmeta Flags 3 (Magisk track), got '$FLAGS'" >&2; exit 1; }
|
||||
|
||||
# Cryptographic check against TF sibling images in $DEST (hardlinked/copied).
|
||||
# Magisk boot footer is Algorithm NONE — chain trust is top-level vbmeta + project key.
|
||||
# Does NOT mean the device will enforce AVB at boot (flags 3 disables that).
|
||||
set +e
|
||||
(
|
||||
cd "$DEST"
|
||||
"$AVBTOOL" verify_image --image vbmeta.img --key "$AVB_PEM" \
|
||||
--expected_chain_partition "vbmeta_system:1:$AVB_PKMD"
|
||||
) >"$DEST/vbmeta-verify.txt" 2>&1
|
||||
ec_v=$?
|
||||
set -e
|
||||
cat "$DEST/vbmeta-verify.txt"
|
||||
[[ "$ec_v" -eq 0 ]] || { echo "FAIL: avbtool verify_image vbmeta.img (TF Magisk boot chain)" >&2; exit 1; }
|
||||
|
||||
set +e
|
||||
(
|
||||
cd "$DEST"
|
||||
"$AVBTOOL" verify_image --image vbmeta_system.img --key "$AVB_PEM"
|
||||
) >"$DEST/vbmeta_system-verify.txt" 2>&1
|
||||
ec_s=$?
|
||||
set -e
|
||||
cat "$DEST/vbmeta_system-verify.txt"
|
||||
[[ "$ec_s" -eq 0 ]] || { echo "FAIL: avbtool verify_image vbmeta_system.img" >&2; exit 1; }
|
||||
|
||||
# Boot footer integrity (unsigned Magisk footer is OK); do not require --key match.
|
||||
set +e
|
||||
(
|
||||
cd "$DEST"
|
||||
"$AVBTOOL" verify_image --image boot.img
|
||||
) >"$DEST/boot-verify.txt" 2>&1
|
||||
ec_b=$?
|
||||
set -e
|
||||
cat "$DEST/boot-verify.txt"
|
||||
[[ "$ec_b" -eq 0 ]] || { echo "FAIL: avbtool verify_image boot.img footer/hash" >&2; exit 1; }
|
||||
|
||||
# US-S4-1 — AXP PRO product surface (binaries gone; init.openssh.rc kept).
|
||||
SIMG="$ANDROID_BUILD_TOP/out/host/linux-x86/bin/simg2img"
|
||||
[[ -x "$SIMG" ]] || { echo "FAIL: missing $SIMG" >&2; exit 1; }
|
||||
[[ -e "$DEST/product.img" ]] || { echo "FAIL: missing $DEST/product.img" >&2; exit 1; }
|
||||
PROD_RAW=$(mktemp /tmp/axp-product-XXXX.img)
|
||||
"$SIMG" "$DEST/product.img" "$PROD_RAW"
|
||||
for p in /bin/sshd /bin/ssh /bin/scp /bin/sftp /bin/rsync /bin/start-ssh; do
|
||||
if debugfs -R "stat $p" "$PROD_RAW" 2>&1 | grep -q 'Inode:'; then
|
||||
rm -f "$PROD_RAW"
|
||||
echo "FAIL: US-S4 expected absent $p on product.img" >&2
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
if ! debugfs -R "stat /etc/init/init.openssh.rc" "$PROD_RAW" 2>&1 | grep -q 'Inode:'; then
|
||||
rm -f "$PROD_RAW"
|
||||
echo "FAIL: US-S4 expected init.openssh.rc present (AXP surface)" >&2
|
||||
exit 1
|
||||
fi
|
||||
echo "US-S4-1 product surface OK (no ssh/rsync bins; init.openssh.rc present)"
|
||||
|
||||
# US-S4-2 — AXP PRO: no Jelly / Gallery2 *apps* on product (Fossify stays).
|
||||
# Note: LOCAL_OVERRIDES removes Gallery2.apk but stale JNI symlink dirs under
|
||||
# product/app/Gallery2/lib can remain from older out/ — gate on the APK.
|
||||
for p in /app/Jelly/Jelly.apk /app/Gallery2/Gallery2.apk; do
|
||||
if debugfs -R "stat $p" "$PROD_RAW" 2>&1 | grep -q 'Inode:'; then
|
||||
rm -f "$PROD_RAW"
|
||||
echo "FAIL: US-S4-2 expected absent $p on product.img" >&2
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
# Directory-only Gallery2 leftover (jni symlinks) is not a shipped app — warn.
|
||||
if debugfs -R "stat /app/Gallery2" "$PROD_RAW" 2>&1 | grep -q 'Inode:'; then
|
||||
echo "WARN: US-S4-2 /app/Gallery2 dir still present (likely stale jni symlinks; no APK)"
|
||||
fi
|
||||
if ! debugfs -R "stat /app/FossifyGallery" "$PROD_RAW" 2>&1 | grep -q 'Inode:'; then
|
||||
rm -f "$PROD_RAW"
|
||||
echo "FAIL: US-S4-2 expected FossifyGallery present" >&2
|
||||
exit 1
|
||||
fi
|
||||
rm -f "$PROD_RAW"
|
||||
echo "US-S4-2 product surface OK (no Jelly/Gallery2 APK; FossifyGallery present)"
|
||||
|
||||
{
|
||||
echo "artifact=$DEST"
|
||||
echo "list_clean=$LIST_CLEAN (429)"
|
||||
echo "list_hi=batch1+2+3"
|
||||
echo "hardening=Stage1+combo4+FORTIFY + CVE-clean + hi-batch1+2+3 + US-S4-1-no-openssh + US-S4-2-no-jelly-gallery2 + US-S5-1-yama-slabrand"
|
||||
echo "branding=AXP-Resurection-Pro"
|
||||
echo "signing=$PRODUCT_DEFAULT_DEV_CERTIFICATE"
|
||||
echo "avb_infra=$AVB_KEY alg=$AVB_ALG flags=3 (HASHTREE_DISABLED|VERIFICATION_DISABLED)"
|
||||
echo "avb_runtime_enforce=no (unlocked Magisk track; not AVB-hardened boot)"
|
||||
echo "avb_pubkey_sha1=$GOT"
|
||||
echo "magiskboot_cpio_test=$MB_EC"
|
||||
echo "ship_images=target_files/IMAGES (not OUT make images)"
|
||||
echo "ship_zip_brand=AXP-Resurection-Pro-*-sunfish.zip (sibling of lineage-*.zip; not slim)"
|
||||
echo "flash=sideload AXP-Resurection-Pro zip (or lineage twin); boot-only insufficient"
|
||||
echo "recover=20261002T085915Z-axp-stage1-combo4-cve-hi-releasekeys"
|
||||
echo "bootloader_lock=wont"
|
||||
echo "oem_unlock=leave_enabled_escape_hatch_not_guaranteed_recovery"
|
||||
date -u +"built=%Y-%m-%dT%H:%M:%SZ"
|
||||
} | tee "$DEST/README.txt"
|
||||
|
||||
(cd "$DEST" && sha256sum boot.img boot-make-out.img vbmeta.img vbmeta_system.img dtbo.img \
|
||||
lineage-*.zip AXP-Resurection-Pro-*.zip 2>/dev/null || true) \
|
||||
| tee "$DEST/SHA256SUMS"
|
||||
|
||||
echo "FLASH_READY $DEST"
|
||||
echo "=== DONE $DEST $(date -Is) ==="
|
||||
exit 0
|
||||
@@ -0,0 +1,164 @@
|
||||
#!/bin/bash
|
||||
# 009 bacon — Stage1 + combo4+FORTIFY + CVE-strict (AXP cve_checker allowlist).
|
||||
# Intentionally test-keys (isolate CVE vs signing). Flash only after LAB boot/Wi‑Fi.
|
||||
# Do NOT flash old 20260918 *-axp-kh-cve/full (pre-FORTIFY hang).
|
||||
set -e
|
||||
cd /srv/rom/src/lineage
|
||||
export HOME=/home/android-build
|
||||
export CCACHE_DIR=/srv/rom/ccache
|
||||
export USE_CCACHE=1
|
||||
export PATH=/home/android-build/bin:/usr/local/bin:/usr/bin:/bin:$PATH
|
||||
export ANDROID_BUILD_TOP=/srv/rom/src/lineage
|
||||
unset OUT_DIR || true
|
||||
export SUNFISH_A16_MAGISK_PREROOT=1
|
||||
export MAGISK_APK=/srv/rom/prebuilts/magisk/Magisk-v30.7.apk
|
||||
# Isolate: no release keys on this CVE iteration
|
||||
unset PRODUCT_DEFAULT_DEV_CERTIFICATE || true
|
||||
|
||||
LOGDIR=/srv/rom/logs/009-build
|
||||
mkdir -p "$LOGDIR"
|
||||
LOG=$LOGDIR/bacon-axp-stage1-combo4-cve.log
|
||||
exec > >(tee -a "$LOG") 2>&1
|
||||
|
||||
echo "=== START 009-bacon-axp-stage1-combo4-cve $(date -Is) ==="
|
||||
|
||||
LIVE=kernel/google/msm-4.14
|
||||
BASE=28f9290ae067
|
||||
test -d "$LIVE"
|
||||
|
||||
echo "=== reset kernel @ $BASE ==="
|
||||
git -C "$LIVE" reset --hard "$BASE"
|
||||
git -C "$LIVE" clean -fdq
|
||||
|
||||
KH=vendor/sunfish-a16/patches/009-kernel-hardening
|
||||
chmod +x "$KH"/apply_stage1_combo4.sh "$KH"/apply_cve_strict.sh \
|
||||
"$KH"/apply_stage1_combo4_cve.sh "$KH"/apply_stage1.sh \
|
||||
"$KH"/apply_combo4_fortify.sh 2>/dev/null || true
|
||||
bash "$KH/apply_stage1_combo4_cve.sh" "$LIVE"
|
||||
|
||||
DEF=$LIVE/arch/arm64/configs/sunfish_defconfig
|
||||
if grep -qE "^CONFIG_KSU.*=y" "$DEF"; then
|
||||
echo "FAIL: $DEF still enables KernelSU" >&2
|
||||
exit 1
|
||||
fi
|
||||
for k in FORTIFY_SOURCE INIT_ON_ALLOC_DEFAULT_ON INIT_ON_FREE_DEFAULT_ON \
|
||||
SECURITY_DMESG_RESTRICT SLAB_FREELIST_HARDENED; do
|
||||
if ! grep -q "^CONFIG_${k}=y" "$DEF"; then
|
||||
echo "FAIL: missing CONFIG_${k}=y" >&2
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
grep -q "ret = __underlying_strlen(q);" "$LIVE/include/linux/string.h"
|
||||
echo "OK: Stage1 + combo4+FORTIFY + CVE markers present"
|
||||
|
||||
rm -f out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image.lz4 \
|
||||
out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image \
|
||||
out/target/product/sunfish/kernel
|
||||
echo "OK: cleared prior Image for kernel rebuild"
|
||||
|
||||
python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_wms_disable_secure_debuggable_gate.py
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_disable_user_apps.py
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_private_dns_providers.py
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_connectivity_check.py
|
||||
|
||||
PH=/srv/rom/src/lineage/vendor/sunfish-a16/prebuilt/Phonesky.apk
|
||||
test -e "$PH"
|
||||
AAPT=/srv/rom/src/lineage/prebuilts/sdk/tools/linux/bin/aapt
|
||||
if ! "$AAPT" dump permissions "$PH" 2>/dev/null | grep -q USE_EXACT_ALARM; then
|
||||
echo "FAIL: Phonesky missing USE_EXACT_ALARM" >&2
|
||||
exit 1
|
||||
fi
|
||||
echo "OK: Phonesky has USE_EXACT_ALARM"
|
||||
|
||||
MAGISK_STAGE_DIR=/srv/rom/src/lineage/out/.magisk \
|
||||
vendor/sunfish-a16/magisk/prepare_magisk.sh
|
||||
python3 vendor/sunfish-a16/magisk/apply_releasetools_hook.py --top "$ANDROID_BUILD_TOP" --force
|
||||
test -f out/.magisk/READY
|
||||
|
||||
rm -rf out/soong/.intermediates/build/make/tools/releasetools/releasetools_common
|
||||
rm -rf out/soong/.intermediates/build/make/tools/releasetools/add_img_to_target_files
|
||||
rm -rf out/target/product/sunfish/obj/PACKAGING/target_files_intermediates
|
||||
rm -f out/target/product/sunfish/lineage-*.zip \
|
||||
out/target/product/sunfish/boot.img \
|
||||
out/target/product/sunfish/system/priv-app/Phonesky/Phonesky.apk
|
||||
touch frameworks/base/services/core/java/com/android/server/wm/WindowManagerService.java
|
||||
|
||||
set +u
|
||||
# shellcheck disable=SC1091
|
||||
source build/envsetup.sh
|
||||
set -e
|
||||
# Force test-keys for this CVE pack (signing is a later stage)
|
||||
unset PRODUCT_DEFAULT_DEV_CERTIFICATE || true
|
||||
echo "OK: signing=test-keys (CVE isolation)"
|
||||
|
||||
breakfast sunfish userdebug
|
||||
test "${TARGET_RELEASE:-}" = "bp4a"
|
||||
|
||||
echo "=== mka bacon $(date -Is) ==="
|
||||
set -o pipefail
|
||||
mka bacon -j8
|
||||
ec=${PIPESTATUS[0]}
|
||||
echo "bacon_exit=$ec $(date -Is)"
|
||||
[ "$ec" -eq 0 ] || exit "$ec"
|
||||
|
||||
PROD=out/target/product/sunfish
|
||||
BID=$(date -u +%Y%m%dT%H%M%SZ)
|
||||
DEST=/srv/rom/artifacts/009-axp-los23-port/${BID}-axp-stage1-combo4-cve
|
||||
mkdir -p "$DEST"
|
||||
|
||||
TF_BOOT=$(find "$PROD/obj/PACKAGING/target_files_intermediates" -path "*/IMAGES/boot.img" 2>/dev/null | head -1)
|
||||
MAKE_BOOT=$PROD/boot.img
|
||||
if [ -n "${TF_BOOT:-}" ] && [ -f "$TF_BOOT" ]; then
|
||||
cp -v "$TF_BOOT" "$DEST/boot.img"
|
||||
cp -v "$MAKE_BOOT" "$DEST/boot-make.img" 2>/dev/null || true
|
||||
echo "boot_source=target_files_IMAGES"
|
||||
else
|
||||
cp -v "$MAKE_BOOT" "$DEST/boot.img"
|
||||
echo "WARN: no TF IMAGES/boot.img — using Make boot"
|
||||
fi
|
||||
|
||||
cp -v "$PROD"/lineage-*-UNOFFICIAL-sunfish.zip "$DEST/" 2>/dev/null || true
|
||||
for f in vbmeta.img dtbo.img; do
|
||||
[ -f "$PROD/$f" ] && cp -v "$PROD/$f" "$DEST/"
|
||||
done
|
||||
|
||||
WLAN=$PROD/vendor/lib/modules/wlan.ko
|
||||
if [ -f "$WLAN" ] && [ -f "$PROD/obj/KERNEL_OBJ/Module.symvers" ]; then
|
||||
KCRC=$(awk '$2=="kmalloc_caches"{print $1; exit}' "$PROD/obj/KERNEL_OBJ/Module.symvers")
|
||||
MCRC=$(/sbin/modprobe --dump-modversions "$WLAN" 2>/dev/null | awk '$2=="kmalloc_caches"{print $1; exit}')
|
||||
echo "wlan kmalloc_caches kernel=$KCRC module=$MCRC"
|
||||
if [ -n "$KCRC" ] && [ -n "$MCRC" ] && [ "$KCRC" = "$MCRC" ]; then
|
||||
echo "OK: wlan.ko CRC matches kernel (Wi-Fi pack coherent)"
|
||||
else
|
||||
echo "WARN: wlan.ko CRC mismatch or unreadable — check before flash"
|
||||
fi
|
||||
fi
|
||||
|
||||
MB=out/.magisk/magiskboot
|
||||
if [ -x "$MB" ]; then
|
||||
rm -rf "$DEST/boot-check" && mkdir -p "$DEST/boot-check"
|
||||
if ! "$MB" unpack "$DEST/boot.img" "$DEST/boot-check" >/dev/null 2>&1; then
|
||||
echo "WARN: magiskboot unpack failed (host SIGILL flake possible)"
|
||||
fi
|
||||
fi
|
||||
if strings "$DEST/boot.img" | grep -qiE 'KernelSU|CONFIG_KSU_SUSFS'; then
|
||||
echo "FAIL: KernelSU strings in boot.img" >&2
|
||||
exit 1
|
||||
fi
|
||||
echo "OK: no KernelSU strings in boot.img"
|
||||
|
||||
{
|
||||
echo "artifact=$DEST"
|
||||
echo "kernel_base=$BASE"
|
||||
echo "hardening=Stage1 + combo4+clang-fortify + CVE-strict (~503 AXP allowlist, denylist skipped)"
|
||||
echo "magisk=preroot EXTENDROM-class v30.7"
|
||||
echo "signing=test-keys (CVE isolation; release-keys later)"
|
||||
echo "flash=recovery wipe + sideload zip + reboot system"
|
||||
echo "note=do not flash 20260918 kh-cve/kh-full (pre-FORTIFY hang)"
|
||||
date -u +"built=%Y-%m-%dT%H:%M:%SZ"
|
||||
} | tee "$DEST/README.txt"
|
||||
|
||||
(cd "$DEST" && sha256sum boot.img boot-make.img lineage-*-UNOFFICIAL-sunfish.zip 2>/dev/null || true) \
|
||||
| tee "$DEST/SHA256SUMS"
|
||||
|
||||
echo "=== DONE $DEST $(date -Is) ==="
|
||||
Executable
+176
@@ -0,0 +1,176 @@
|
||||
#!/bin/bash
|
||||
# 009 bacon — Magisk preroot + Stage1 Graphene/AH + combo4 Clang FORTIFY.
|
||||
# Full zip so vendor modules match kernel (Wi-Fi). LAB flash only after gates.
|
||||
set -e
|
||||
cd /srv/rom/src/lineage
|
||||
export HOME=/home/android-build
|
||||
export CCACHE_DIR=/srv/rom/ccache
|
||||
export USE_CCACHE=1
|
||||
export PATH=/home/android-build/bin:/usr/local/bin:/usr/bin:/bin:$PATH
|
||||
export ANDROID_BUILD_TOP=/srv/rom/src/lineage
|
||||
unset OUT_DIR || true
|
||||
export SUNFISH_A16_MAGISK_PREROOT=1
|
||||
export MAGISK_APK=/srv/rom/prebuilts/magisk/Magisk-v30.7.apk
|
||||
|
||||
LOGDIR=/srv/rom/logs/009-build
|
||||
mkdir -p "$LOGDIR"
|
||||
LOG=$LOGDIR/bacon-axp-stage1-combo4.log
|
||||
exec > >(tee -a "$LOG") 2>&1
|
||||
|
||||
echo "=== START 009-bacon-axp-stage1-combo4 $(date -Is) ==="
|
||||
|
||||
LIVE=kernel/google/msm-4.14
|
||||
BASE=28f9290ae067
|
||||
test -d "$LIVE"
|
||||
|
||||
echo "=== reset kernel @ $BASE ==="
|
||||
git -C "$LIVE" reset --hard "$BASE"
|
||||
git -C "$LIVE" clean -fdq
|
||||
|
||||
APPLY=vendor/sunfish-a16/patches/009-kernel-hardening/apply_stage1_combo4.sh
|
||||
test -x "$APPLY" || chmod +x "$APPLY"
|
||||
bash "$APPLY" "$LIVE"
|
||||
|
||||
DEF=$LIVE/arch/arm64/configs/sunfish_defconfig
|
||||
if grep -qE "^CONFIG_KSU.*=y" "$DEF"; then
|
||||
echo "FAIL: $DEF still enables KernelSU" >&2
|
||||
exit 1
|
||||
fi
|
||||
for k in FORTIFY_SOURCE INIT_ON_ALLOC_DEFAULT_ON INIT_ON_FREE_DEFAULT_ON \
|
||||
SECURITY_DMESG_RESTRICT SLAB_FREELIST_HARDENED; do
|
||||
if ! grep -q "^CONFIG_${k}=y" "$DEF"; then
|
||||
echo "FAIL: missing CONFIG_${k}=y" >&2
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
grep -q "ret = __underlying_strlen(q);" "$LIVE/include/linux/string.h"
|
||||
# Stage1 marker (Deny USB / sysctl)
|
||||
if ! grep -q "deny_new_usb" "$LIVE/kernel/sysctl.c" \
|
||||
&& ! grep -qE "deny_new_usb|CONFIG_DENY_NEW_USB|usb_device_authorization" \
|
||||
"$LIVE/drivers/usb/core/hub.c"; then
|
||||
echo "FAIL: Stage1 Deny_USB markers missing" >&2
|
||||
exit 1
|
||||
fi
|
||||
echo "OK: Stage1 + combo4+FORTIFY markers present"
|
||||
|
||||
rm -f out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image.lz4 \
|
||||
out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image \
|
||||
out/target/product/sunfish/kernel
|
||||
echo "OK: cleared prior Image for kernel rebuild"
|
||||
|
||||
python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_wms_disable_secure_debuggable_gate.py
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_disable_user_apps.py
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_private_dns_providers.py
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_connectivity_check.py
|
||||
|
||||
PH=/srv/rom/src/lineage/vendor/sunfish-a16/prebuilt/Phonesky.apk
|
||||
test -e "$PH"
|
||||
AAPT=/srv/rom/src/lineage/prebuilts/sdk/tools/linux/bin/aapt
|
||||
if ! "$AAPT" dump permissions "$PH" 2>/dev/null | grep -q USE_EXACT_ALARM; then
|
||||
echo "FAIL: Phonesky missing USE_EXACT_ALARM" >&2
|
||||
exit 1
|
||||
fi
|
||||
echo "OK: Phonesky has USE_EXACT_ALARM"
|
||||
|
||||
MAGISK_STAGE_DIR=/srv/rom/src/lineage/out/.magisk \
|
||||
vendor/sunfish-a16/magisk/prepare_magisk.sh
|
||||
python3 vendor/sunfish-a16/magisk/apply_releasetools_hook.py --top "$ANDROID_BUILD_TOP" --force
|
||||
test -f out/.magisk/READY
|
||||
|
||||
rm -rf out/soong/.intermediates/build/make/tools/releasetools/releasetools_common
|
||||
rm -rf out/soong/.intermediates/build/make/tools/releasetools/add_img_to_target_files
|
||||
rm -rf out/target/product/sunfish/obj/PACKAGING/target_files_intermediates
|
||||
rm -f out/target/product/sunfish/lineage-*.zip \
|
||||
out/target/product/sunfish/boot.img \
|
||||
out/target/product/sunfish/system/priv-app/Phonesky/Phonesky.apk
|
||||
touch frameworks/base/services/core/java/com/android/server/wm/WindowManagerService.java
|
||||
|
||||
set +u
|
||||
# shellcheck disable=SC1091
|
||||
source build/envsetup.sh
|
||||
set -e
|
||||
|
||||
# US-S2: project release keys when present (Gate G). Fallback = AOSP test-keys.
|
||||
CERT_DIR="${ANDROID_CERTS_DIR:-$HOME/.android-certs}"
|
||||
if [[ -f "$CERT_DIR/releasekey.pk8" && -f "$CERT_DIR/releasekey.x509.pem" ]]; then
|
||||
export PRODUCT_DEFAULT_DEV_CERTIFICATE="$CERT_DIR/releasekey"
|
||||
echo "OK: PRODUCT_DEFAULT_DEV_CERTIFICATE=$PRODUCT_DEFAULT_DEV_CERTIFICATE"
|
||||
else
|
||||
echo "WARN: no $CERT_DIR/releasekey — building with AOSP test-keys"
|
||||
fi
|
||||
|
||||
breakfast sunfish userdebug
|
||||
test "${TARGET_RELEASE:-}" = "bp4a"
|
||||
|
||||
echo "=== mka bacon $(date -Is) ==="
|
||||
set -o pipefail
|
||||
mka bacon -j8
|
||||
ec=${PIPESTATUS[0]}
|
||||
echo "bacon_exit=$ec $(date -Is)"
|
||||
[ "$ec" -eq 0 ] || exit "$ec"
|
||||
|
||||
PROD=out/target/product/sunfish
|
||||
BID=$(date -u +%Y%m%dT%H%M%SZ)
|
||||
if [[ -n "${PRODUCT_DEFAULT_DEV_CERTIFICATE:-}" ]]; then
|
||||
DEST=/srv/rom/artifacts/009-axp-los23-port/${BID}-axp-stage1-combo4-releasekeys
|
||||
else
|
||||
DEST=/srv/rom/artifacts/009-axp-los23-port/${BID}-axp-stage1-combo4
|
||||
fi
|
||||
mkdir -p "$DEST"
|
||||
|
||||
TF_BOOT=$(find "$PROD/obj/PACKAGING/target_files_intermediates" -path "*/IMAGES/boot.img" 2>/dev/null | head -1)
|
||||
MAKE_BOOT=$PROD/boot.img
|
||||
if [ -n "${TF_BOOT:-}" ] && [ -f "$TF_BOOT" ]; then
|
||||
cp -v "$TF_BOOT" "$DEST/boot.img"
|
||||
cp -v "$MAKE_BOOT" "$DEST/boot-make.img" 2>/dev/null || true
|
||||
echo "boot_source=target_files_IMAGES"
|
||||
else
|
||||
cp -v "$MAKE_BOOT" "$DEST/boot.img"
|
||||
echo "WARN: no TF IMAGES/boot.img — using Make boot"
|
||||
fi
|
||||
|
||||
cp -v "$PROD"/lineage-*-UNOFFICIAL-sunfish.zip "$DEST/" 2>/dev/null || true
|
||||
for f in vbmeta.img dtbo.img; do
|
||||
[ -f "$PROD/$f" ] && cp -v "$PROD/$f" "$DEST/"
|
||||
done
|
||||
|
||||
# Module CRC sanity vs kernel (Wi-Fi)
|
||||
WLAN=$PROD/vendor/lib/modules/wlan.ko
|
||||
if [ -f "$WLAN" ] && [ -f "$PROD/obj/KERNEL_OBJ/Module.symvers" ]; then
|
||||
KCRC=$(awk '$2=="kmalloc_caches"{print $1; exit}' "$PROD/obj/KERNEL_OBJ/Module.symvers")
|
||||
MCRC=$(/sbin/modprobe --dump-modversions "$WLAN" 2>/dev/null | awk '$2=="kmalloc_caches"{print $1; exit}')
|
||||
echo "wlan kmalloc_caches kernel=$KCRC module=$MCRC"
|
||||
if [ -n "$KCRC" ] && [ -n "$MCRC" ] && [ "$KCRC" = "$MCRC" ]; then
|
||||
echo "OK: wlan.ko CRC matches kernel (Wi-Fi pack coherent)"
|
||||
else
|
||||
echo "WARN: wlan.ko CRC mismatch or unreadable — check before flash"
|
||||
fi
|
||||
fi
|
||||
|
||||
MB=out/.magisk/magiskboot
|
||||
if [ -x "$MB" ]; then
|
||||
rm -rf "$DEST/boot-check" && mkdir -p "$DEST/boot-check"
|
||||
if ! "$MB" unpack "$DEST/boot.img" "$DEST/boot-check" >/dev/null 2>&1; then
|
||||
echo "WARN: magiskboot unpack failed (host SIGILL flake possible)"
|
||||
fi
|
||||
fi
|
||||
if strings "$DEST/boot.img" | grep -qiE 'KernelSU|CONFIG_KSU_SUSFS'; then
|
||||
echo "FAIL: KernelSU strings in boot.img" >&2
|
||||
exit 1
|
||||
fi
|
||||
echo "OK: no KernelSU strings in boot.img"
|
||||
|
||||
{
|
||||
echo "artifact=$DEST"
|
||||
echo "kernel_base=$BASE"
|
||||
echo "hardening=Stage1 Graphene/AH + combo4+clang-fortify (nested __underlying_strlen)"
|
||||
echo "magisk=preroot EXTENDROM-class v30.7"
|
||||
echo "signing=${PRODUCT_DEFAULT_DEV_CERTIFICATE:-test-keys}"
|
||||
echo "flash=recovery wipe + sideload zip + reboot system (do NOT flash boot onto other slot alone)"
|
||||
date -u +"built=%Y-%m-%dT%H:%M:%SZ"
|
||||
} | tee "$DEST/README.txt"
|
||||
|
||||
(cd "$DEST" && sha256sum boot.img boot-make.img lineage-*-UNOFFICIAL-sunfish.zip 2>/dev/null || true) \
|
||||
| tee "$DEST/SHA256SUMS"
|
||||
|
||||
echo "=== DONE $DEST $(date -Is) ==="
|
||||
Executable
+113
@@ -0,0 +1,113 @@
|
||||
#!/bin/bash
|
||||
# Usage: 009-bisect-ksync-one.sh <name> [CONFIG_FOO] ...
|
||||
# Rebuilds kernel with optional CONFIG_=y extras, injects into GOODMAKE.
|
||||
set -eo pipefail
|
||||
NAME=${1:?name}; shift
|
||||
cd /srv/rom/src/lineage
|
||||
export HOME=/home/android-build CCACHE_DIR=/srv/rom/ccache USE_CCACHE=1
|
||||
export PATH=/home/android-build/bin:/usr/local/bin:/usr/bin:/bin:$PATH
|
||||
export ANDROID_BUILD_TOP=/srv/rom/src/lineage
|
||||
unset OUT_DIR || true
|
||||
LIVE=kernel/google/msm-4.14
|
||||
DEF=$LIVE/arch/arm64/configs/sunfish_defconfig
|
||||
GOOD=/srv/rom/artifacts/009-axp-los23-port/20260918T143547Z-axp-full/boot-make.img
|
||||
MB=$(find /srv/rom/prebuilts/magisk -name magiskboot | head -1)
|
||||
|
||||
echo "=== ksync-$NAME START $(date -Is) configs=[$*] ==="
|
||||
git -C "$LIVE" reset --hard 28f9290ae067
|
||||
git -C "$LIVE" clean -fd
|
||||
sed -i '/CONFIG_KSU/d' "$DEF"
|
||||
echo '# CONFIG_KSU is not set' >> "$DEF"
|
||||
for k in FORTIFY_SOURCE INIT_ON_ALLOC_DEFAULT_ON INIT_ON_FREE_DEFAULT_ON SECURITY_DMESG_RESTRICT SLAB_FREELIST_HARDENED SLAB_HARDENED; do
|
||||
sed -i "/CONFIG_${k}/d" "$DEF"
|
||||
done
|
||||
for cfg in "$@"; do
|
||||
echo "${cfg}=y" >> "$DEF"
|
||||
echo "enable $cfg"
|
||||
done
|
||||
|
||||
# Clang FORTIFY port (no BUG stubs). See docs/009-fortify-clang-port.md
|
||||
case " $* " in
|
||||
*" CONFIG_FORTIFY_SOURCE "*)
|
||||
python3 /srv/rom/artifacts/009-axp-los23-port/scripts/apply_fortify_clang.py "$LIVE"
|
||||
# Driver bounds for Clang/LTO fortify false-path link (docs/009-fortify-pos0-link-failure-20260927.md)
|
||||
patch -p1 --forward --batch -d "$LIVE" < /srv/rom/artifacts/009-axp-los23-port/scripts/0001-driver-bounds-rtac-fils.patch
|
||||
if [ "${FORTIFY_DIAG:-0}" = 1 ]; then
|
||||
python3 /srv/rom/artifacts/009-axp-los23-port/scripts/apply_fortify_diag.py "$LIVE"
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
|
||||
# Plaintext panic mirror into alt ramoops (no FORTIFY). See docs/009-fortify-diag-capture-plan.md
|
||||
# Also applied via FORTIFY_DIAG above when building fortify-diag.
|
||||
if [ "${PSTORE_ALT_PLAIN:-0}" = 1 ]; then
|
||||
python3 /srv/rom/artifacts/009-axp-los23-port/scripts/apply_fortify_diag.py "$LIVE"
|
||||
fi
|
||||
|
||||
# FORTIFY stubs DISABLED by default (see docs/009-fortify-clang-port.md).
|
||||
# Set ALLOW_FORTIFY_BUG_STUBS=1 only for archaeology — not a valid port.
|
||||
if [ "${ALLOW_FORTIFY_BUG_STUBS:-0}" = 1 ]; then
|
||||
case " $* " in *" CONFIG_FORTIFY_SOURCE "*)
|
||||
echo 'WARN: injecting BUG() fortify stubs (ALLOW_FORTIFY_BUG_STUBS=1)'
|
||||
python3 - <<'PY2'
|
||||
from pathlib import Path
|
||||
import re
|
||||
p = Path("kernel/google/msm-4.14/lib/string.c")
|
||||
t = p.read_text()
|
||||
if "EXPORT_SYMBOL(__read_overflow)" not in t:
|
||||
m = re.search(r"void fortify_panic\(const char \*name\).*?EXPORT_SYMBOL\(fortify_panic\);", t, re.S)
|
||||
assert m, 'fortify_panic marker missing'
|
||||
stub = m.group(0) + """
|
||||
|
||||
void __read_overflow(void) { BUG(); }
|
||||
EXPORT_SYMBOL(__read_overflow);
|
||||
void __read_overflow2(void) { BUG(); }
|
||||
EXPORT_SYMBOL(__read_overflow2);
|
||||
void __read_overflow3(void) { BUG(); }
|
||||
EXPORT_SYMBOL(__read_overflow3);
|
||||
void __write_overflow(void) { BUG(); }
|
||||
EXPORT_SYMBOL(__write_overflow);
|
||||
"""
|
||||
p.write_text(t[:m.start()] + stub + t[m.end():])
|
||||
PY2
|
||||
;; esac
|
||||
fi
|
||||
|
||||
set +u; source build/envsetup.sh; set -e
|
||||
breakfast sunfish userdebug
|
||||
echo "TARGET_RELEASE=${TARGET_RELEASE:-unset}"
|
||||
test "${TARGET_RELEASE:-}" = "bp4a"
|
||||
|
||||
rm -f out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image.lz4
|
||||
rm -f out/target/product/sunfish/boot.img
|
||||
mka bootimage -j8
|
||||
|
||||
PROD=/srv/rom/src/lineage/out/target/product/sunfish
|
||||
BID=$(date -u +%Y%m%dT%H%M%SZ)
|
||||
DEST=/srv/rom/artifacts/009-axp-los23-port/${BID}-bisect-ksync-${NAME}
|
||||
mkdir -p "$DEST"
|
||||
cp -v "$PROD/boot.img" "$DEST/boot-make-native.img"
|
||||
|
||||
WORK=$DEST/work
|
||||
rm -rf "$WORK"; mkdir -p "$WORK/good" "$WORK/new" "$WORK/check"
|
||||
(cd "$WORK/good" && "$MB" unpack "$GOOD")
|
||||
(cd "$WORK/new" && "$MB" unpack "$PROD/boot.img")
|
||||
cp -f "$WORK/new/kernel" "$WORK/good/kernel"
|
||||
(cd "$WORK/good" && "$MB" repack "$GOOD" "$DEST/boot-make.img")
|
||||
(cd "$WORK/check" && "$MB" unpack "$DEST/boot-make.img" >/dev/null && "$MB" cpio ramdisk.cpio extract)
|
||||
echo "=== VERIFY $NAME ==="
|
||||
grep -E 'security_patch|sdk_full' "$WORK/check/prop.default" | sort -u
|
||||
# Prefer header from first successful unpack (WORK/check); do not ||true a SIGILL unpack.
|
||||
if [[ -f "$WORK/check/kernel" ]]; then
|
||||
"$MB" unpack "$DEST/boot-make.img" >"$DEST/unpack-hdr.txt" 2>&1 || \
|
||||
echo "WARN: magiskboot header unpack failed (host SIGILL?); kernel already verified via WORK/check" | tee -a "$DEST/unpack-hdr.txt"
|
||||
else
|
||||
"$MB" unpack "$DEST/boot-make.img" >"$DEST/unpack-hdr.txt" 2>&1
|
||||
fi
|
||||
grep -E 'OS_PATCH|KERNEL_SZ|KERNEL_FMT' "$DEST/unpack-hdr.txt" || true
|
||||
# ikconfig spot-check
|
||||
/srv/rom/src/lineage/kernel/google/msm-4.14/scripts/extract-ikconfig "$WORK/check/kernel" 2>/dev/null \
|
||||
| grep -E 'CONFIG_(SECURITY_DMESG_RESTRICT|SLAB_FREELIST_HARDENED|FORTIFY_SOURCE|INIT_ON_ALLOC)=' || true
|
||||
sha256sum "$DEST/boot-make.img" "$DEST/boot-make-native.img" | tee "$DEST/SHA256SUMS"
|
||||
printf '%s\n' "ksync bisect: $NAME" "configs: $*" "Flash boot-make.img only (GOODMAKE ramdisk)." > "$DEST/README.txt"
|
||||
echo "=== DONE $DEST $(date -Is) ==="
|
||||
Executable
+13
@@ -0,0 +1,13 @@
|
||||
#!/bin/bash
|
||||
# Channel-proof build (no FORTIFY): diag v4 early_ioremap + ioremap after mm_init.
|
||||
# Validate (docs/009-fortify-diag-capture-plan.md v4 — mid/late only):
|
||||
# 0) Wipe first 4K of access-ramoops or fresh attempt id
|
||||
# 1) Flash boot-make.img, boot, adb root
|
||||
# 2) Milestone: strings | grep AXPDIAG0 (early_map / perm_map / mm_init)
|
||||
# 3) ONLY SysRq-c (no SysRq-x)
|
||||
# 4) Recover combo4 — complete AXPDIAG1,C,<attempt>,0x...,sysrq-c
|
||||
# Does NOT prove pre-early_map FORTIFY coverage. Do not flash v3.
|
||||
set -euo pipefail
|
||||
export PSTORE_ALT_PLAIN=1
|
||||
exec /srv/rom/artifacts/009-axp-los23-port/scripts/009-bisect-ksync-one.sh \
|
||||
pstore-alt-plain
|
||||
@@ -0,0 +1,76 @@
|
||||
#!/usr/bin/env bash
|
||||
# Server-only diagnostic build. Uses its own sources/output; never resets LIVE.
|
||||
# Usage: bash this-script ROOT <family>
|
||||
# family: see 009-fortify-select-family.py GROUPS
|
||||
set -euo pipefail
|
||||
RUN=${1:?isolated root required}
|
||||
FAMILY=${2:?family required}
|
||||
case "$FAMILY" in
|
||||
full|memory|strings|strings-copy|strings-len|\
|
||||
strings-strcpy-strlen|strings-copy-strlen|strings-copy-strnlen|\
|
||||
strings-strlen-restcopy|strings-strlen-ncopy|strings-strlen-cat|\
|
||||
strings-strlen-strncpy|strings-strlen-strlcpy) ;;
|
||||
*) echo "bad family: $FAMILY" >&2; exit 2;;
|
||||
esac
|
||||
test -d "$RUN/inputs"
|
||||
# Subdir name matches family (strings-copy → strings-copy/)
|
||||
test ! -e "$RUN/$FAMILY"
|
||||
TOP=/srv/rom/src/lineage
|
||||
LIVE=$TOP/kernel/google/msm-4.14
|
||||
PIN=28f9290ae067d3e7857126eb6312720dbe9c7c80
|
||||
CLANG=$TOP/prebuilts/clang/host/linux-x86/clang-r563880c
|
||||
BASE=$RUN/$FAMILY
|
||||
SRC=$BASE/src
|
||||
OUT=$BASE/out
|
||||
mkdir -p "$SRC" "$OUT"
|
||||
git -C "$LIVE" archive "$PIN" | tar -x -C "$SRC"
|
||||
python3 "$RUN/inputs/apply_fortify_clang.py" "$SRC"
|
||||
patch -p1 --batch -d "$SRC" < "$RUN/inputs/0001-driver-bounds-rtac-fils.patch"
|
||||
python3 "$RUN/inputs/009-fortify-select-family.py" "$SRC" "$FAMILY"
|
||||
cp "$RUN/inputs/failed-full.config" "$OUT/.config"
|
||||
cp "$OUT/.config" "$BASE/input.config"
|
||||
export PATH="$TOP/prebuilts/tools-lineage/linux-x86/bin:$TOP/prebuilts/build-tools/linux-x86/bin:$CLANG/bin:$TOP/out/host/linux-x86/bin:/usr/bin:/bin"
|
||||
export HIP_PATH=none
|
||||
export PERL5LIB="$TOP/prebuilts/tools-lineage/common/perl-base"
|
||||
export BISON_PKGDATADIR="$TOP/prebuilts/build-tools/common/bison"
|
||||
export KBUILD_BUILD_USER=nobody KBUILD_BUILD_HOST=android-build
|
||||
# An archived patched tree needs the same release suffix as installed modules.
|
||||
export LOCALVERSION=-g28f9290ae067-dirty
|
||||
MAKE=("$TOP/prebuilts/build-tools/linux-x86/bin/make" -j8
|
||||
"HOSTCFLAGS=--sysroot=$TOP/prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.17-4.8/sysroot -I$TOP/prebuilts/kernel-build-tools/linux-x86/include"
|
||||
"HOSTLDFLAGS=--sysroot=$TOP/prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.17-4.8/sysroot -Wl,-rpath,$TOP/prebuilts/kernel-build-tools/linux-x86/lib64 -L $TOP/prebuilts/kernel-build-tools/linux-x86/lib64 -fuse-ld=lld --rtlib=compiler-rt"
|
||||
LLVM=1 LLVM_IAS=1 "LZ4=$TOP/prebuilts/kernel-build-tools/linux-x86/bin/lz4"
|
||||
"LEX=$TOP/prebuilts/build-tools/linux-x86/bin/flex"
|
||||
"YACC=$TOP/prebuilts/build-tools/linux-x86/bin/bison"
|
||||
"M4=$TOP/prebuilts/build-tools/linux-x86/bin/m4"
|
||||
"PAHOLE=$TOP/prebuilts/kernel-build-tools/linux-x86/bin/pahole"
|
||||
"LIBCLANG_PATH=$CLANG/lib" "DTC_EXT=$TOP/out/host/linux-x86/bin/dtc"
|
||||
-C "$SRC" "O=$OUT" ARCH=arm64 CC=clang LD=ld.lld)
|
||||
"${MAKE[@]}" olddefconfig
|
||||
diff -u "$BASE/input.config" "$OUT/.config" > "$BASE/config.diff" || {
|
||||
cat "$BASE/config.diff"
|
||||
echo 'STOP: unexpected configuration drift' >&2
|
||||
exit 3
|
||||
}
|
||||
"$CLANG/bin/clang" --version > "$BASE/toolchain.txt"
|
||||
printf '%s\n' "$PIN" > "$BASE/source-commit.txt"
|
||||
printf '%q ' "${MAKE[@]}" > "$BASE/make-command.txt"
|
||||
"${MAKE[@]}" Image.lz4 modules
|
||||
cp "$OUT/.config" "$BASE/final.config"
|
||||
test "$(cat "$OUT/include/config/kernel.release")" = '4.14.357-openela-g28f9290ae067-dirty'
|
||||
if "$CLANG/bin/llvm-nm" "$OUT/vmlinux" | grep -Eq ' [Tt] __((read_overflow[23]?)|(write_overflow))$'; then
|
||||
echo 'STOP: forbidden overflow stubs' >&2
|
||||
exit 4
|
||||
fi
|
||||
mkdir "$BASE/pack"
|
||||
cd "$BASE/pack"
|
||||
MB=$(find /srv/rom/prebuilts/magisk -type f -name magiskboot -print -quit)
|
||||
test -n "$MB"
|
||||
GOOD=/srv/rom/artifacts/009-axp-los23-port/20260918T143547Z-axp-full/boot-make.img
|
||||
"$MB" unpack "$GOOD" > "$BASE/good-header.txt" 2>&1
|
||||
sha256sum ramdisk.cpio > "$BASE/ramdisk.sha256"
|
||||
cp "$OUT/arch/arm64/boot/Image" kernel
|
||||
"$MB" repack "$GOOD" "$BASE/boot-make.img"
|
||||
sha256sum "$BASE/boot-make.img" "$OUT/arch/arm64/boot/Image" "$OUT/vmlinux" > "$BASE/SHA256SUMS"
|
||||
printf 'DIAGNOSTIC ONLY: %s family; not full FORTIFY. Requires local unpack/header/kernel verification before LAB use.\n' "$FAMILY" > "$BASE/README.txt"
|
||||
echo "BUILD COMPLETE: $BASE/boot-make.img"
|
||||
Executable
+41
@@ -0,0 +1,41 @@
|
||||
#!/usr/bin/env bash
|
||||
# After hi-batch3 BOOT_OK: launch release-keys bacon (US-S2) on rom-dev01.
|
||||
# Does not flash RK zip (needs recovery sideload); only starts bacon + status poll helper.
|
||||
set -euo pipefail
|
||||
SSHCFG="${SSHCFG:-/home/aventura/Workspaces/AXP_Resurection/docs/ssh/config}"
|
||||
BATCH3_LOG="${BATCH3_LOG:-/tmp/009-wait-flash-cve-hi-batch3.log}"
|
||||
LOG="${LOG:-/tmp/009-chain-hi3-to-releasekeys.log}"
|
||||
exec > >(tee -a "$LOG") 2>&1
|
||||
|
||||
echo "CHAIN start $(date -Is) wait HI_BATCH3_BOOT_OK"
|
||||
for i in $(seq 1 200); do
|
||||
if grep -q 'HI_BATCH3_BOOT_OK' "$BATCH3_LOG" 2>/dev/null; then
|
||||
echo "seen HI_BATCH3_BOOT_OK"
|
||||
break
|
||||
fi
|
||||
if grep -qE 'BACON_FAILED|NOT_BOOTED|BOOT_TIMEOUT|TIMEOUT' "$BATCH3_LOG" 2>/dev/null; then
|
||||
# allow exit=141 path that still boots — only abort on clear fail without OK
|
||||
if ! grep -q 'HI_BATCH3_BOOT_OK' "$BATCH3_LOG" 2>/dev/null; then
|
||||
if grep -qE 'BACON_FAILED|NOT_BOOTED|BOOT_TIMEOUT' "$BATCH3_LOG" 2>/dev/null; then
|
||||
echo CHAIN_ABORT_BATCH3_FAIL
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
sleep 30
|
||||
done
|
||||
grep -q 'HI_BATCH3_BOOT_OK' "$BATCH3_LOG" || { echo CHAIN_TIMEOUT; exit 1; }
|
||||
|
||||
echo "=== launch release-keys bacon $(date -Is) ==="
|
||||
ssh -F "$SSHCFG" -o BatchMode=yes rom-dev01 '
|
||||
test -f /home/android-build/.android-certs/releasekey.pk8
|
||||
install -m 0755 /tmp/009-bacon-axp-stage1-combo4-cve-hi-releasekeys.sh \
|
||||
/srv/rom/artifacts/009-axp-los23-port/scripts/ 2>/dev/null || true
|
||||
# script must already be on host
|
||||
test -x /srv/rom/artifacts/009-axp-los23-port/scripts/009-bacon-axp-stage1-combo4-cve-hi-releasekeys.sh
|
||||
/srv/rom/artifacts/bin/rom-detach 009-bacon-cve-hi-releasekeys -- \
|
||||
bash /srv/rom/artifacts/009-axp-los23-port/scripts/009-bacon-axp-stage1-combo4-cve-hi-releasekeys.sh
|
||||
sleep 2
|
||||
cat /srv/rom/artifacts/detach-009-bacon-cve-hi-releasekeys.status
|
||||
'
|
||||
echo CHAIN_RK_STARTED
|
||||
@@ -0,0 +1,78 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Diagnostic-only split of the existing Clang FORTIFY port; never a ship patch.
|
||||
|
||||
Apply after apply_fortify_clang.py. Omitted wrappers resolve to the existing
|
||||
unfortified declarations. No overflow stubs or changes to fortify_panic.
|
||||
"""
|
||||
import argparse
|
||||
import re
|
||||
from pathlib import Path
|
||||
|
||||
STRINGS = {"strncpy", "strcat", "strlen", "strnlen", "strlcpy", "strncat", "strcpy"}
|
||||
MEMORY = {"memset", "memcpy", "memmove", "memscan", "memcmp", "memchr", "memchr_inv", "kmemdup"}
|
||||
STRINGS_COPY = {"strcpy", "strncpy", "strlcpy", "strcat", "strncat"}
|
||||
STRINGS_LEN = {"strlen", "strnlen"}
|
||||
|
||||
GROUPS = {
|
||||
"full": STRINGS | MEMORY,
|
||||
"strings": STRINGS,
|
||||
"memory": MEMORY,
|
||||
# Split of failing strings family (2026-09-27 LAB):
|
||||
"strings-copy": STRINGS_COPY,
|
||||
"strings-len": STRINGS_LEN,
|
||||
# Cross products (copy boots, len boots, both fail → interaction):
|
||||
"strings-strcpy-strlen": {"strcpy", "strlen"},
|
||||
"strings-copy-strlen": STRINGS_COPY | {"strlen"},
|
||||
"strings-copy-strnlen": STRINGS_COPY | {"strnlen"},
|
||||
# copy-strlen fails, strcpy-strlen boots → rest of copy + strlen:
|
||||
"strings-strlen-restcopy": {"strlen", "strncpy", "strlcpy", "strcat", "strncat"},
|
||||
"strings-strlen-ncopy": {"strlen", "strncpy", "strlcpy"},
|
||||
"strings-strlen-cat": {"strlen", "strcat", "strncat"},
|
||||
"strings-strlen-strncpy": {"strlen", "strncpy"},
|
||||
"strings-strlen-strlcpy": {"strlen", "strlcpy"},
|
||||
}
|
||||
|
||||
def select(text, family):
|
||||
if "AXP_FORTIFY_DIAGNOSTIC_FAMILY" in text:
|
||||
raise ValueError("Already selected: start from a fresh fully ported header")
|
||||
if "__pass_object_size" not in text or "__overloadable" not in text:
|
||||
raise ValueError("Apply the Clang FORTIFY port first")
|
||||
pattern = re.compile(r"^__FORTIFY_INLINE[^\n]*?\b(\w+)\([^\n]*\)\n\{", re.M)
|
||||
matches = list(pattern.finditer(text))
|
||||
expected = STRINGS | MEMORY
|
||||
names = [m.group(1) for m in matches]
|
||||
if len(names) != len(expected) or set(names) != expected:
|
||||
raise ValueError(f"Unexpected wrapper inventory: {names}")
|
||||
enabled = GROUPS[family]
|
||||
for match in reversed(matches):
|
||||
name = match.group(1)
|
||||
if name in enabled:
|
||||
continue
|
||||
start = match.end() - 1
|
||||
depth = 1
|
||||
end = start + 1
|
||||
while depth:
|
||||
depth += (text[end] == "{") - (text[end] == "}")
|
||||
end += 1
|
||||
text = (
|
||||
text[: match.start()]
|
||||
+ "#if 0 /* diagnostic: other FORTIFY family */\n"
|
||||
+ text[match.start() : end]
|
||||
+ "\n#endif\n"
|
||||
+ text[end:]
|
||||
)
|
||||
return f"/* AXP_FORTIFY_DIAGNOSTIC_FAMILY={family}; NOT FOR SHIP */\n" + text
|
||||
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser(description=__doc__)
|
||||
parser.add_argument("kernel", type=Path)
|
||||
parser.add_argument("family", choices=sorted(GROUPS))
|
||||
args = parser.parse_args()
|
||||
path = args.kernel / "include/linux/string.h"
|
||||
path.write_text(select(path.read_text(), args.family))
|
||||
print(f"DIAGNOSTIC ONLY: FORTIFY family={args.family}; panic behavior unchanged")
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
raise SystemExit(main())
|
||||
Executable
+101
@@ -0,0 +1,101 @@
|
||||
#!/usr/bin/env bash
|
||||
# Generate project Android + AVB signing keys on rom-dev01 only.
|
||||
# Never run this to a path inside a Git working tree that gets committed.
|
||||
set -euo pipefail
|
||||
|
||||
OUT="${ANDROID_CERTS_DIR:-}"
|
||||
if [[ -z "$OUT" ]]; then
|
||||
if [[ -d /srv/rom/secrets && -w /srv/rom/secrets ]]; then
|
||||
OUT=/srv/rom/secrets/android-certs
|
||||
else
|
||||
# Lineage convention; /srv/rom/secrets is often root-owned (750, no group write).
|
||||
OUT="${HOME}/.android-certs"
|
||||
fi
|
||||
fi
|
||||
LINEAGE_TOP="${LINEAGE_TOP:-/srv/rom/src/lineage}"
|
||||
MAKE_KEY="${LINEAGE_TOP}/development/tools/make_key"
|
||||
|
||||
# Distinct from AOSP testkey DN (android@android.com).
|
||||
SUBJECT="${ANDROID_CERT_SUBJECT:-/C=DE/ST=NA/L=NA/O=AXP-Resurection/OU=sunfish-a16/CN=release}"
|
||||
|
||||
KEYS=(releasekey platform shared media networkstack sdk_sandbox bluetooth nfc)
|
||||
|
||||
if [[ ! -x "$MAKE_KEY" && ! -f "$MAKE_KEY" ]]; then
|
||||
echo "ERROR: make_key not found at $MAKE_KEY" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ "$(id -u)" -eq 0 ]]; then
|
||||
echo "ERROR: refuse to generate keys as root; run as android-build" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
mkdir -p "$OUT"
|
||||
chmod 700 "$OUT"
|
||||
|
||||
existing=0
|
||||
for k in "${KEYS[@]}"; do
|
||||
if [[ -e "$OUT/$k.pk8" || -e "$OUT/$k.x509.pem" ]]; then
|
||||
echo "EXISTS: $OUT/$k.*"
|
||||
existing=1
|
||||
fi
|
||||
done
|
||||
if [[ -e "$OUT/avb.pem" ]]; then
|
||||
echo "EXISTS: $OUT/avb.pem"
|
||||
existing=1
|
||||
fi
|
||||
if [[ "$existing" -eq 1 ]]; then
|
||||
echo "ERROR: refusing to overwrite. Delete specifically if you truly mean to rotate." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "=== Generating APK/OTA keys in $OUT ==="
|
||||
echo "subject=$SUBJECT"
|
||||
for k in "${KEYS[@]}"; do
|
||||
# make_key always exits 1 because of its EXIT trap — ignore status; check files.
|
||||
# Blank password (Lineage/build-server norm); protect via directory mode 700.
|
||||
printf '\n' | bash "$MAKE_KEY" "$OUT/$k" "$SUBJECT" || true
|
||||
if [[ ! -f "$OUT/$k.pk8" || ! -f "$OUT/$k.x509.pem" ]]; then
|
||||
echo "ERROR: failed to create $k" >&2
|
||||
exit 1
|
||||
fi
|
||||
chmod 600 "$OUT/$k.pk8"
|
||||
chmod 644 "$OUT/$k.x509.pem"
|
||||
echo "OK $k"
|
||||
done
|
||||
|
||||
echo "=== Generating AVB RSA-4096 key ==="
|
||||
openssl genrsa -out "$OUT/avb.pem" 4096
|
||||
chmod 600 "$OUT/avb.pem"
|
||||
# Public key metadata for avbtool / optional custom key flash (not used for lock ship)
|
||||
if [[ -x "$LINEAGE_TOP/external/avb/avbtool.py" ]]; then
|
||||
python3 "$LINEAGE_TOP/external/avb/avbtool.py" extract_public_key \
|
||||
--key "$OUT/avb.pem" --output "$OUT/avb_pkmd.bin"
|
||||
chmod 644 "$OUT/avb_pkmd.bin"
|
||||
elif command -v avbtool >/dev/null 2>&1; then
|
||||
avbtool extract_public_key --key "$OUT/avb.pem" --output "$OUT/avb_pkmd.bin"
|
||||
chmod 644 "$OUT/avb_pkmd.bin"
|
||||
else
|
||||
echo "WARN: avbtool not found; skipped avb_pkmd.bin (openssl key still OK)"
|
||||
fi
|
||||
|
||||
{
|
||||
echo "# generated $(date -Is) on $(hostname)"
|
||||
echo "subject=$SUBJECT"
|
||||
echo "dir=$OUT"
|
||||
echo "keys=${KEYS[*]} avb.pem"
|
||||
} >"$OUT/GENERATED.txt"
|
||||
chmod 644 "$OUT/GENERATED.txt"
|
||||
|
||||
echo
|
||||
echo "=== DONE ==="
|
||||
echo "Public releasekey subject:"
|
||||
openssl x509 -in "$OUT/releasekey.x509.pem" -noout -subject
|
||||
echo
|
||||
echo "NEXT (mandatory before first signed ship bacon):"
|
||||
echo " 1. Encrypted offline backup of $OUT"
|
||||
echo " 2. If keys are under \$HOME/.android-certs, have root install -d"
|
||||
echo " /srv/rom/secrets/android-certs and move/copy there (preferred long-term)."
|
||||
echo " 3. Record backup location/date in docs/009-hardening-signing-checklist.md"
|
||||
echo " 4. US-S2: export PRODUCT_DEFAULT_DEV_CERTIFICATE=$OUT/releasekey"
|
||||
echo " 5. Never copy .pk8 / avb.pem into Git"
|
||||
Executable
+73
@@ -0,0 +1,73 @@
|
||||
#!/usr/bin/env bash
|
||||
# Wait for CVE-clean bacon on rom-dev01, then one-shot fastboot flash boot + one reboot.
|
||||
# No recovery loops. No auto-recover. Exits if not booted in ~4 min.
|
||||
set -euo pipefail
|
||||
SSHCFG="${SSHCFG:-/home/aventura/Workspaces/AXP_Resurection/docs/ssh/config}"
|
||||
SERIAL="${SERIAL:-11231JEC207477}"
|
||||
LOCAL="${LOCAL:-/home/aventura/Workspaces/AXP_Resurection/.local-artifacts/009-flash-cve-clean}"
|
||||
STATUS=detach-009-bacon-cve-clean.status
|
||||
LOG="${LOG:-/tmp/009-wait-flash-cve-clean.log}"
|
||||
mkdir -p "$LOCAL"
|
||||
exec > >(tee -a "$LOG") 2>&1
|
||||
|
||||
echo "WAIT start $(date -Is)"
|
||||
st=""
|
||||
for i in $(seq 1 180); do
|
||||
st=$(ssh -F "$SSHCFG" -o BatchMode=yes -o ConnectTimeout=20 rom-dev01 \
|
||||
"cat /srv/rom/artifacts/$STATUS" 2>/dev/null || echo status_unreadable)
|
||||
echo "poll $i: $st"
|
||||
if echo "$st" | grep -q '^exit=0'; then
|
||||
break
|
||||
fi
|
||||
if echo "$st" | grep -qE '^exit=[1-9]|^exit=killed'; then
|
||||
echo BACON_FAILED
|
||||
exit 1
|
||||
fi
|
||||
sleep 60
|
||||
done
|
||||
echo "$st" | grep -q '^exit=0' || { echo TIMEOUT; exit 1; }
|
||||
|
||||
ART=$(ssh -F "$SSHCFG" -o BatchMode=yes rom-dev01 \
|
||||
'ls -dt /srv/rom/artifacts/009-axp-los23-port/*-axp-stage1-combo4-cve-clean 2>/dev/null | head -1')
|
||||
echo "ART=$ART"
|
||||
test -n "$ART"
|
||||
|
||||
rsync -avP -e "ssh -F $SSHCFG -o BatchMode=yes" \
|
||||
"rom-dev01:$ART/boot.img" "rom-dev01:$ART/README.txt" "rom-dev01:$ART/SHA256SUMS" "$LOCAL/"
|
||||
cd "$LOCAL"
|
||||
grep ' boot.img$' SHA256SUMS | sha256sum -c -
|
||||
|
||||
adb start-server >/dev/null 2>&1 || true
|
||||
cur=$(adb -s "$SERIAL" get-state 2>/dev/null || true)
|
||||
if [[ "$cur" == "device" ]]; then
|
||||
echo "adb reboot bootloader once"
|
||||
adb -s "$SERIAL" reboot bootloader
|
||||
fi
|
||||
for j in $(seq 1 40); do
|
||||
fastboot devices 2>/dev/null | grep -q "$SERIAL" && break
|
||||
sleep 2
|
||||
done
|
||||
fastboot devices | grep -q "$SERIAL" || { echo NO_FASTBOOT; exit 1; }
|
||||
|
||||
echo "fastboot flash boot (cve-clean) once"
|
||||
fastboot -s "$SERIAL" flash boot "$LOCAL/boot.img"
|
||||
echo "fastboot reboot once"
|
||||
fastboot -s "$SERIAL" reboot
|
||||
|
||||
for j in $(seq 1 60); do
|
||||
sleep 5
|
||||
cur=$(adb devices | awk -v s="$SERIAL" '$1==s{print $2}')
|
||||
boot=$(adb -s "$SERIAL" shell getprop sys.boot_completed 2>/dev/null | tr -d '\r' || true)
|
||||
echo "t=$((j*5))s adb=$cur boot=$boot"
|
||||
if [[ "$cur" == "device" && "$boot" == "1" ]]; then
|
||||
adb -s "$SERIAL" shell 'uname -a; getprop ro.boot.slot_suffix; pidof magiskd || true'
|
||||
echo CLEAN_BOOT_OK
|
||||
exit 0
|
||||
fi
|
||||
if [[ "$j" -eq 48 ]]; then
|
||||
echo NOT_BOOTED_4min leave_alone
|
||||
exit 2
|
||||
fi
|
||||
done
|
||||
echo BOOT_TIMEOUT
|
||||
exit 2
|
||||
Executable
+77
@@ -0,0 +1,77 @@
|
||||
#!/usr/bin/env bash
|
||||
# Wait for hi-batch1 bacon on rom-dev01, then one-shot fastboot flash boot + reboot.
|
||||
# Serial-pinned. No recovery loops. Exit if not booted in ~4 min.
|
||||
set -euo pipefail
|
||||
SSHCFG="${SSHCFG:-/home/aventura/Workspaces/AXP_Resurection/docs/ssh/config}"
|
||||
SERIAL="${SERIAL:-11231JEC207477}"
|
||||
LOCAL="${LOCAL:-/home/aventura/Workspaces/AXP_Resurection/.local-artifacts/009-flash-cve-hi-batch1}"
|
||||
STATUS=detach-009-bacon-cve-hi-batch1.status
|
||||
LOG="${LOG:-/tmp/009-wait-flash-cve-hi-batch1.log}"
|
||||
mkdir -p "$LOCAL"
|
||||
exec > >(tee -a "$LOG") 2>&1
|
||||
|
||||
echo "WAIT hi-batch1 start $(date -Is)"
|
||||
st=""
|
||||
for i in $(seq 1 180); do
|
||||
st=$(ssh -F "$SSHCFG" -o BatchMode=yes -o ConnectTimeout=20 rom-dev01 \
|
||||
"cat /srv/rom/artifacts/$STATUS" 2>/dev/null || echo status_unreadable)
|
||||
echo "poll $i: $st"
|
||||
# exit=141 = SIGPIPE from tee after successful bacon (false fail)
|
||||
if echo "$st" | grep -qE '^exit=0|^exit=141'; then
|
||||
break
|
||||
fi
|
||||
if echo "$st" | grep -qE '^exit=[1-9]|^exit=killed'; then
|
||||
if echo "$st" | grep -q '^exit=141'; then
|
||||
break
|
||||
fi
|
||||
echo BACON_FAILED
|
||||
exit 1
|
||||
fi
|
||||
sleep 60
|
||||
done
|
||||
echo "$st" | grep -qE '^exit=0|^exit=141' || { echo TIMEOUT; exit 1; }
|
||||
|
||||
ART=$(ssh -F "$SSHCFG" -o BatchMode=yes rom-dev01 \
|
||||
'ls -dt /srv/rom/artifacts/009-axp-los23-port/*-axp-stage1-combo4-cve-hi-batch1 2>/dev/null | head -1')
|
||||
echo "ART=$ART"
|
||||
test -n "$ART"
|
||||
|
||||
rsync -avP -e "ssh -F $SSHCFG -o BatchMode=yes" \
|
||||
"rom-dev01:$ART/boot.img" "rom-dev01:$ART/README.txt" "rom-dev01:$ART/SHA256SUMS" "$LOCAL/"
|
||||
cd "$LOCAL"
|
||||
grep ' boot.img$' SHA256SUMS | sha256sum -c -
|
||||
|
||||
adb start-server >/dev/null 2>&1 || true
|
||||
cur=$(adb -s "$SERIAL" get-state 2>/dev/null || true)
|
||||
if [[ "$cur" == "device" ]]; then
|
||||
echo "adb reboot bootloader once"
|
||||
adb -s "$SERIAL" reboot bootloader
|
||||
fi
|
||||
for j in $(seq 1 40); do
|
||||
fastboot devices 2>/dev/null | grep -q "$SERIAL" && break
|
||||
sleep 2
|
||||
done
|
||||
fastboot devices | grep -q "$SERIAL" || { echo NO_FASTBOOT; exit 1; }
|
||||
|
||||
echo "fastboot flash boot (hi-batch1) once"
|
||||
fastboot -s "$SERIAL" flash boot "$LOCAL/boot.img"
|
||||
echo "fastboot reboot once"
|
||||
fastboot -s "$SERIAL" reboot
|
||||
|
||||
for j in $(seq 1 60); do
|
||||
sleep 5
|
||||
cur=$(adb devices | awk -v s="$SERIAL" '$1==s{print $2}')
|
||||
boot=$(adb -s "$SERIAL" shell getprop sys.boot_completed 2>/dev/null | tr -d '\r' || true)
|
||||
echo "t=$((j*5))s adb=$cur boot=$boot"
|
||||
if [[ "$cur" == "device" && "$boot" == "1" ]]; then
|
||||
adb -s "$SERIAL" shell 'uname -a; getprop ro.boot.slot_suffix; pidof magiskd || true'
|
||||
echo HI_BATCH1_BOOT_OK
|
||||
exit 0
|
||||
fi
|
||||
if [[ "$j" -eq 48 ]]; then
|
||||
echo NOT_BOOTED_4min leave_alone
|
||||
exit 2
|
||||
fi
|
||||
done
|
||||
echo BOOT_TIMEOUT
|
||||
exit 2
|
||||
Executable
+81
@@ -0,0 +1,81 @@
|
||||
#!/usr/bin/env bash
|
||||
# Wait for hi-batch2 bacon on rom-dev01, then one-shot fastboot flash boot + reboot.
|
||||
# Serial-pinned. No recovery loops. Exit if not booted in ~4 min.
|
||||
set -euo pipefail
|
||||
SSHCFG="${SSHCFG:-/home/aventura/Workspaces/AXP_Resurection/docs/ssh/config}"
|
||||
SERIAL="${SERIAL:-11231JEC207477}"
|
||||
LOCAL="${LOCAL:-/home/aventura/Workspaces/AXP_Resurection/.local-artifacts/009-flash-cve-hi-batch2}"
|
||||
STATUS=detach-009-bacon-cve-hi-batch2.status
|
||||
LOG="${LOG:-/tmp/009-wait-flash-cve-hi-batch2.log}"
|
||||
mkdir -p "$LOCAL"
|
||||
exec > >(tee -a "$LOG") 2>&1
|
||||
|
||||
echo "WAIT hi-batch2 start $(date -Is)"
|
||||
st=""
|
||||
for i in $(seq 1 180); do
|
||||
st=$(ssh -F "$SSHCFG" -o BatchMode=yes -o ConnectTimeout=20 rom-dev01 \
|
||||
"cat /srv/rom/artifacts/$STATUS" 2>/dev/null || echo status_unreadable)
|
||||
echo "poll $i: $st"
|
||||
# exit=141 = SIGPIPE from tee after successful bacon (false fail)
|
||||
if echo "$st" | grep -qE '^exit=0|^exit=141'; then
|
||||
break
|
||||
fi
|
||||
if echo "$st" | grep -qE '^exit=[1-9]|^exit=killed'; then
|
||||
if echo "$st" | grep -q '^exit=141'; then
|
||||
break
|
||||
fi
|
||||
echo BACON_FAILED
|
||||
exit 1
|
||||
fi
|
||||
sleep 60
|
||||
done
|
||||
echo "$st" | grep -qE '^exit=0|^exit=141' || { echo TIMEOUT; exit 1; }
|
||||
# Confirm artifact exists (guards real failures that somehow report 141)
|
||||
ART_PROBE=$(ssh -F "$SSHCFG" -o BatchMode=yes rom-dev01 \
|
||||
'ls -dt /srv/rom/artifacts/009-axp-los23-port/*-axp-stage1-combo4-cve-hi-batch2 2>/dev/null | head -1')
|
||||
test -n "$ART_PROBE" || { echo NO_ARTIFACT; exit 1; }
|
||||
|
||||
ART=$(ssh -F "$SSHCFG" -o BatchMode=yes rom-dev01 \
|
||||
'ls -dt /srv/rom/artifacts/009-axp-los23-port/*-axp-stage1-combo4-cve-hi-batch2 2>/dev/null | head -1')
|
||||
echo "ART=$ART"
|
||||
test -n "$ART"
|
||||
|
||||
rsync -avP -e "ssh -F $SSHCFG -o BatchMode=yes" \
|
||||
"rom-dev01:$ART/boot.img" "rom-dev01:$ART/README.txt" "rom-dev01:$ART/SHA256SUMS" "$LOCAL/"
|
||||
cd "$LOCAL"
|
||||
grep ' boot.img$' SHA256SUMS | sha256sum -c -
|
||||
|
||||
adb start-server >/dev/null 2>&1 || true
|
||||
cur=$(adb -s "$SERIAL" get-state 2>/dev/null || true)
|
||||
if [[ "$cur" == "device" ]]; then
|
||||
echo "adb reboot bootloader once"
|
||||
adb -s "$SERIAL" reboot bootloader
|
||||
fi
|
||||
for j in $(seq 1 40); do
|
||||
fastboot devices 2>/dev/null | grep -q "$SERIAL" && break
|
||||
sleep 2
|
||||
done
|
||||
fastboot devices | grep -q "$SERIAL" || { echo NO_FASTBOOT; exit 1; }
|
||||
|
||||
echo "fastboot flash boot (hi-batch2) once"
|
||||
fastboot -s "$SERIAL" flash boot "$LOCAL/boot.img"
|
||||
echo "fastboot reboot once"
|
||||
fastboot -s "$SERIAL" reboot
|
||||
|
||||
for j in $(seq 1 60); do
|
||||
sleep 5
|
||||
cur=$(adb devices | awk -v s="$SERIAL" '$1==s{print $2}')
|
||||
boot=$(adb -s "$SERIAL" shell getprop sys.boot_completed 2>/dev/null | tr -d '\r' || true)
|
||||
echo "t=$((j*5))s adb=$cur boot=$boot"
|
||||
if [[ "$cur" == "device" && "$boot" == "1" ]]; then
|
||||
adb -s "$SERIAL" shell 'uname -a; getprop ro.boot.slot_suffix; pidof magiskd || true'
|
||||
echo HI_BATCH2_BOOT_OK
|
||||
exit 0
|
||||
fi
|
||||
if [[ "$j" -eq 48 ]]; then
|
||||
echo NOT_BOOTED_4min leave_alone
|
||||
exit 2
|
||||
fi
|
||||
done
|
||||
echo BOOT_TIMEOUT
|
||||
exit 2
|
||||
Executable
+76
@@ -0,0 +1,76 @@
|
||||
#!/usr/bin/env bash
|
||||
# Wait for hi-batch3 bacon on rom-dev01, then one-shot fastboot flash boot + reboot.
|
||||
# Treats exit=141 (tee SIGPIPE) as OK when artifact exists.
|
||||
set -euo pipefail
|
||||
SSHCFG="${SSHCFG:-/home/aventura/Workspaces/AXP_Resurection/docs/ssh/config}"
|
||||
SERIAL="${SERIAL:-11231JEC207477}"
|
||||
LOCAL="${LOCAL:-/home/aventura/Workspaces/AXP_Resurection/.local-artifacts/009-flash-cve-hi-batch3}"
|
||||
STATUS=detach-009-bacon-cve-hi-batch3.status
|
||||
LOG="${LOG:-/tmp/009-wait-flash-cve-hi-batch3.log}"
|
||||
mkdir -p "$LOCAL"
|
||||
exec > >(tee -a "$LOG") 2>&1
|
||||
|
||||
echo "WAIT hi-batch3 start $(date -Is)"
|
||||
st=""
|
||||
for i in $(seq 1 180); do
|
||||
st=$(ssh -F "$SSHCFG" -o BatchMode=yes -o ConnectTimeout=20 rom-dev01 \
|
||||
"cat /srv/rom/artifacts/$STATUS" 2>/dev/null || echo status_unreadable)
|
||||
echo "poll $i: $st"
|
||||
if echo "$st" | grep -qE '^exit=0|^exit=141'; then
|
||||
break
|
||||
fi
|
||||
if echo "$st" | grep -qE '^exit=[1-9]|^exit=killed'; then
|
||||
echo BACON_FAILED
|
||||
exit 1
|
||||
fi
|
||||
sleep 60
|
||||
done
|
||||
echo "$st" | grep -qE '^exit=0|^exit=141' || { echo TIMEOUT; exit 1; }
|
||||
|
||||
ART=$(ssh -F "$SSHCFG" -o BatchMode=yes rom-dev01 \
|
||||
'ls -dt /srv/rom/artifacts/009-axp-los23-port/*-axp-stage1-combo4-cve-hi-batch3 2>/dev/null | head -1')
|
||||
echo "ART=$ART"
|
||||
test -n "$ART"
|
||||
# ensure SHA256SUMS exists (tee may have truncated post-bacon)
|
||||
ssh -F "$SSHCFG" -o BatchMode=yes rom-dev01 \
|
||||
"test -f $ART/SHA256SUMS || (cd $ART && sha256sum boot.img boot-make.img lineage-*-UNOFFICIAL-sunfish.zip 2>/dev/null | tee SHA256SUMS)"
|
||||
|
||||
rsync -avP -e "ssh -F $SSHCFG -o BatchMode=yes" \
|
||||
"rom-dev01:$ART/boot.img" "rom-dev01:$ART/README.txt" "rom-dev01:$ART/SHA256SUMS" "$LOCAL/"
|
||||
cd "$LOCAL"
|
||||
grep ' boot.img$' SHA256SUMS | sha256sum -c -
|
||||
|
||||
adb start-server >/dev/null 2>&1 || true
|
||||
cur=$(adb -s "$SERIAL" get-state 2>/dev/null || true)
|
||||
if [[ "$cur" == "device" ]]; then
|
||||
echo "adb reboot bootloader once"
|
||||
adb -s "$SERIAL" reboot bootloader
|
||||
fi
|
||||
for j in $(seq 1 40); do
|
||||
fastboot devices 2>/dev/null | grep -q "$SERIAL" && break
|
||||
sleep 2
|
||||
done
|
||||
fastboot devices | grep -q "$SERIAL" || { echo NO_FASTBOOT; exit 1; }
|
||||
|
||||
echo "fastboot flash boot (hi-batch3) once"
|
||||
fastboot -s "$SERIAL" flash boot "$LOCAL/boot.img"
|
||||
echo "fastboot reboot once"
|
||||
fastboot -s "$SERIAL" reboot
|
||||
|
||||
for j in $(seq 1 60); do
|
||||
sleep 5
|
||||
cur=$(adb devices | awk -v s="$SERIAL" '$1==s{print $2}')
|
||||
boot=$(adb -s "$SERIAL" shell getprop sys.boot_completed 2>/dev/null | tr -d '\r' || true)
|
||||
echo "t=$((j*5))s adb=$cur boot=$boot"
|
||||
if [[ "$cur" == "device" && "$boot" == "1" ]]; then
|
||||
adb -s "$SERIAL" shell 'uname -a; getprop ro.boot.slot_suffix; pidof magiskd || true'
|
||||
echo HI_BATCH3_BOOT_OK
|
||||
exit 0
|
||||
fi
|
||||
if [[ "$j" -eq 48 ]]; then
|
||||
echo NOT_BOOTED_4min leave_alone
|
||||
exit 2
|
||||
fi
|
||||
done
|
||||
echo BOOT_TIMEOUT
|
||||
exit 2
|
||||
@@ -0,0 +1,54 @@
|
||||
#!/bin/bash
|
||||
# Wait for release-keys bacon to finish, then start Stage1+combo4+CVE bacon.
|
||||
set -euo pipefail
|
||||
RK_STATUS=/srv/rom/artifacts/detach-009-bacon-axp-stage1-combo4-rk.status
|
||||
CVE_NAME=009-bacon-axp-stage1-combo4-cve
|
||||
CVE_SCRIPT=/srv/rom/artifacts/bin/009-bacon-axp-stage1-combo4-cve.sh
|
||||
DETACH=/srv/rom/artifacts/bin/rom-detach
|
||||
|
||||
echo "watcher: waiting for RK bacon to leave 'running' ($(date -Is))"
|
||||
while true; do
|
||||
if [[ -f "$RK_STATUS" ]]; then
|
||||
if grep -q '^exit=' "$RK_STATUS" 2>/dev/null; then
|
||||
break
|
||||
fi
|
||||
if ! grep -q '^running ' "$RK_STATUS" 2>/dev/null; then
|
||||
break
|
||||
fi
|
||||
else
|
||||
# no status → assume free
|
||||
break
|
||||
fi
|
||||
# still building?
|
||||
if ! pgrep -f 'm bacon -j' >/dev/null 2>&1 \
|
||||
&& ! pgrep -f 'combined-lineage_sunfish.ninja' >/dev/null 2>&1; then
|
||||
# status stale?
|
||||
sleep 30
|
||||
if ! pgrep -f 'm bacon -j' >/dev/null 2>&1; then
|
||||
echo "watcher: no mka/ninja; treating RK as done ($(date -Is))"
|
||||
break
|
||||
fi
|
||||
fi
|
||||
sleep 60
|
||||
done
|
||||
|
||||
echo "watcher: RK status now:"
|
||||
cat "$RK_STATUS" 2>/dev/null || true
|
||||
|
||||
if grep -q '^exit=0' "$RK_STATUS" 2>/dev/null; then
|
||||
echo "watcher: RK bacon OK"
|
||||
elif grep -q '^exit=' "$RK_STATUS" 2>/dev/null; then
|
||||
echo "watcher: RK bacon FAILED — still launching CVE (kernel will reset)"
|
||||
else
|
||||
echo "watcher: RK status unclear — launching CVE after short settle"
|
||||
sleep 15
|
||||
fi
|
||||
|
||||
# Ensure scripts synced into lineage vendor
|
||||
KH=/srv/rom/src/lineage/vendor/sunfish-a16/patches/009-kernel-hardening
|
||||
test -x "$CVE_SCRIPT"
|
||||
test -f "$KH/cve-strict.list"
|
||||
test -x "$KH/apply_stage1_combo4_cve.sh"
|
||||
|
||||
"$DETACH" "$CVE_NAME" -- bash "$CVE_SCRIPT"
|
||||
echo "watcher: CVE bacon detached ($(date -Is))"
|
||||
Reference in new issue
Block a user