009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding, bundled apps, and AXP-class product surface docs/scripts.
2026-10-05 10:42:00 +02:00
1 parent fd793b9471
commit deaaf42caa
@@ -0,0 +1,152 @@
+#!/bin/bash
+# 009 bacon — AXP Magisk preroot + combo4+Clang-FORTIFY kernel (LAB-verified pack).
+# Does NOT apply Graphene Stage1 mega-pack (not boot-OK yet on LOS23/Clang).
+set -e
+cd /srv/rom/src/lineage
+export HOME=/home/android-build
+export CCACHE_DIR=/srv/rom/ccache
+export USE_CCACHE=1
+export PATH=/home/android-build/bin:/usr/local/bin:/usr/bin:/bin:$PATH
+export ANDROID_BUILD_TOP=/srv/rom/src/lineage
+unset OUT_DIR || true
+export SUNFISH_A16_MAGISK_PREROOT=1
+export MAGISK_APK=/srv/rom/prebuilts/magisk/Magisk-v30.7.apk
+
+LOGDIR=/srv/rom/logs/009-build
+mkdir -p "$LOGDIR"
+LOG=$LOGDIR/bacon-axp-combo4-fortify.log
+exec > >(tee -a "$LOG") 2>&1
+
+echo "=== START 009-bacon-axp-combo4-fortify $(date -Is) ==="
+
+LIVE=kernel/google/msm-4.14
+BASE=28f9290ae067
+test -d "$LIVE"
+
+echo "=== reset kernel @ $BASE ==="
+git -C "$LIVE" reset --hard "$BASE"
+git -C "$LIVE" clean -fdq
+
+APPLY=vendor/sunfish-a16/patches/009-kernel-hardening/apply_combo4_fortify.sh
+test -x "$APPLY" || chmod +x "$APPLY"
+bash "$APPLY" "$LIVE"
+
+DEF=$LIVE/arch/arm64/configs/sunfish_defconfig
+if grep -qE "^CONFIG_KSU.*=y" "$DEF"; then
+  echo "FAIL: $DEF still enables KernelSU" >&2
+  exit 1
+fi
+for k in FORTIFY_SOURCE INIT_ON_ALLOC_DEFAULT_ON INIT_ON_FREE_DEFAULT_ON \
+         SECURITY_DMESG_RESTRICT SLAB_FREELIST_HARDENED; do
+  if ! grep -q "^CONFIG_${k}=y" "$DEF"; then
+    echo "FAIL: missing CONFIG_${k}=y" >&2
+    exit 1
+  fi
+done
+grep -q "ret = __underlying_strlen(q);" "$LIVE/include/linux/string.h"
+echo "OK: combo4+FORTIFY markers + nested-strlen fix present"
+
+rm -f out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image.lz4 \
+      out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image \
+      out/target/product/sunfish/kernel
+echo "OK: cleared prior Image for kernel rebuild"
+
+# FLAG_SECURE + Settings UX (idempotent)
+python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_wms_disable_secure_debuggable_gate.py
+python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_disable_user_apps.py
+python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_private_dns_providers.py
+python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_connectivity_check.py
+
+PH=/srv/rom/src/lineage/vendor/sunfish-a16/prebuilt/Phonesky.apk
+test -e "$PH"
+AAPT=/srv/rom/src/lineage/prebuilts/sdk/tools/linux/bin/aapt
+if ! "$AAPT" dump permissions "$PH" 2>/dev/null | grep -q USE_EXACT_ALARM; then
+  echo "FAIL: Phonesky missing USE_EXACT_ALARM" >&2
+  exit 1
+fi
+echo "OK: Phonesky has USE_EXACT_ALARM"
+
+MAGISK_STAGE_DIR=/srv/rom/src/lineage/out/.magisk \
+  vendor/sunfish-a16/magisk/prepare_magisk.sh
+python3 vendor/sunfish-a16/magisk/apply_releasetools_hook.py --top "$ANDROID_BUILD_TOP" --force
+test -f out/.magisk/READY
+
+rm -rf out/soong/.intermediates/build/make/tools/releasetools/releasetools_common
+rm -rf out/soong/.intermediates/build/make/tools/releasetools/add_img_to_target_files
+rm -rf out/target/product/sunfish/obj/PACKAGING/target_files_intermediates
+rm -f out/target/product/sunfish/lineage-*.zip \
+      out/target/product/sunfish/boot.img \
+      out/target/product/sunfish/system/priv-app/Phonesky/Phonesky.apk
+touch frameworks/base/services/core/java/com/android/server/wm/WindowManagerService.java
+
+set +u
+# shellcheck disable=SC1091
+source build/envsetup.sh
+set -e
+breakfast sunfish userdebug
+test "${TARGET_RELEASE:-}" = "bp4a"
+
+echo "=== mka bacon $(date -Is) ==="
+set -o pipefail
+mka bacon -j8
+ec=${PIPESTATUS[0]}
+echo "bacon_exit=$ec $(date -Is)"
+[ "$ec" -eq 0 ] || exit "$ec"
+
+PROD=out/target/product/sunfish
+BID=$(date -u +%Y%m%dT%H%M%SZ)
+DEST=/srv/rom/artifacts/009-axp-los23-port/${BID}-axp-combo4-fortify
+mkdir -p "$DEST"
+
+TF_BOOT=$(find "$PROD/obj/PACKAGING/target_files_intermediates" -path "*/IMAGES/boot.img" 2>/dev/null | head -1)
+MAKE_BOOT=$PROD/boot.img
+if [ -n "${TF_BOOT:-}" ] && [ -f "$TF_BOOT" ]; then
+  cp -v "$TF_BOOT" "$DEST/boot.img"
+  cp -v "$MAKE_BOOT" "$DEST/boot-make.img" 2>/dev/null || true
+  echo "boot_source=target_files_IMAGES"
+else
+  cp -v "$MAKE_BOOT" "$DEST/boot.img"
+  echo "WARN: no TF IMAGES/boot.img — using Make boot"
+fi
+
+cp -v "$PROD"/lineage-*-UNOFFICIAL-sunfish.zip "$DEST/" 2>/dev/null || true
+for f in vbmeta.img dtbo.img; do
+  [ -f "$PROD/$f" ] && cp -v "$PROD/$f" "$DEST/"
+done
+
+# Magisk present, KernelSU absent
+MB=out/.magisk/magiskboot
+if [ -x "$MB" ]; then
+  rm -rf "$DEST/boot-check" && mkdir -p "$DEST/boot-check"
+  if "$MB" unpack "$DEST/boot.img" "$DEST/boot-check" >/dev/null 2>&1; then
+    if [ -f "$DEST/boot-check/ramdisk.cpio" ]; then
+      if "$MB" cpio "$DEST/boot-check/ramdisk.cpio" "exists overlay.d/sbin/magisk64.xz" \
+           || "$MB" cpio "$DEST/boot-check/ramdisk.cpio" "exists overlay.d/sbin/magisk.xz"; then
+        echo "OK: Magisk overlay in boot.img"
+      else
+        echo "WARN: Magisk overlay not detected in boot.img ramdisk"
+      fi
+    fi
+  else
+    echo "WARN: magiskboot unpack failed (host SIGILL flake possible); skip TF check"
+  fi
+fi
+if strings "$DEST/boot.img" | grep -qiE 'KernelSU|CONFIG_KSU_SUSFS'; then
+  echo "FAIL: KernelSU strings in boot.img" >&2
+  exit 1
+fi
+echo "OK: no KernelSU strings in boot.img"
+
+{
+  echo "artifact=$DEST"
+  echo "kernel_base=$BASE"
+  echo "hardening=combo4+clang-fortify (nested __underlying_strlen)"
+  echo "magisk=preroot EXTENDROM-class v30.7"
+  echo "stage1_graphene=NOT_INCLUDED (not boot-OK on LOS23 yet)"
+  date -u +"built=%Y-%m-%dT%H:%M:%SZ"
+} | tee "$DEST/README.txt"
+
+(cd "$DEST" && sha256sum boot.img boot-make.img lineage-*-UNOFFICIAL-sunfish.zip 2>/dev/null || true) \
+  | tee "$DEST/SHA256SUMS"
+
+echo "=== DONE $DEST $(date -Is) ==="