009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding, bundled apps, and AXP-class product surface docs/scripts.
2026-10-05 10:42:00 +02:00
1 parent fd793b9471
commit deaaf42caa
@@ -0,0 +1,113 @@
+#!/bin/bash
+# Usage: 009-bisect-ksync-one.sh <name> [CONFIG_FOO] ...
+# Rebuilds kernel with optional CONFIG_=y extras, injects into GOODMAKE.
+set -eo pipefail
+NAME=${1:?name}; shift
+cd /srv/rom/src/lineage
+export HOME=/home/android-build CCACHE_DIR=/srv/rom/ccache USE_CCACHE=1
+export PATH=/home/android-build/bin:/usr/local/bin:/usr/bin:/bin:$PATH
+export ANDROID_BUILD_TOP=/srv/rom/src/lineage
+unset OUT_DIR || true
+LIVE=kernel/google/msm-4.14
+DEF=$LIVE/arch/arm64/configs/sunfish_defconfig
+GOOD=/srv/rom/artifacts/009-axp-los23-port/20260918T143547Z-axp-full/boot-make.img
+MB=$(find /srv/rom/prebuilts/magisk -name magiskboot | head -1)
+
+echo "=== ksync-$NAME START $(date -Is) configs=[$*] ==="
+git -C "$LIVE" reset --hard 28f9290ae067
+git -C "$LIVE" clean -fd
+sed -i '/CONFIG_KSU/d' "$DEF"
+echo '# CONFIG_KSU is not set' >> "$DEF"
+for k in FORTIFY_SOURCE INIT_ON_ALLOC_DEFAULT_ON INIT_ON_FREE_DEFAULT_ON SECURITY_DMESG_RESTRICT SLAB_FREELIST_HARDENED SLAB_HARDENED; do
+  sed -i "/CONFIG_${k}/d" "$DEF"
+done
+for cfg in "$@"; do
+  echo "${cfg}=y" >> "$DEF"
+  echo "enable $cfg"
+done
+
+# Clang FORTIFY port (no BUG stubs). See docs/009-fortify-clang-port.md
+case " $* " in
+  *" CONFIG_FORTIFY_SOURCE "*)
+    python3 /srv/rom/artifacts/009-axp-los23-port/scripts/apply_fortify_clang.py "$LIVE"
+    # Driver bounds for Clang/LTO fortify false-path link (docs/009-fortify-pos0-link-failure-20260927.md)
+    patch -p1 --forward --batch -d "$LIVE"       < /srv/rom/artifacts/009-axp-los23-port/scripts/0001-driver-bounds-rtac-fils.patch
+    if [ "${FORTIFY_DIAG:-0}" = 1 ]; then
+      python3 /srv/rom/artifacts/009-axp-los23-port/scripts/apply_fortify_diag.py "$LIVE"
+    fi
+    ;;
+esac
+
+# Plaintext panic mirror into alt ramoops (no FORTIFY). See docs/009-fortify-diag-capture-plan.md
+# Also applied via FORTIFY_DIAG above when building fortify-diag.
+if [ "${PSTORE_ALT_PLAIN:-0}" = 1 ]; then
+  python3 /srv/rom/artifacts/009-axp-los23-port/scripts/apply_fortify_diag.py "$LIVE"
+fi
+
+# FORTIFY stubs DISABLED by default (see docs/009-fortify-clang-port.md).
+# Set ALLOW_FORTIFY_BUG_STUBS=1 only for archaeology — not a valid port.
+if [ "${ALLOW_FORTIFY_BUG_STUBS:-0}" = 1 ]; then
+  case " $* " in *" CONFIG_FORTIFY_SOURCE "*)
+    echo 'WARN: injecting BUG() fortify stubs (ALLOW_FORTIFY_BUG_STUBS=1)'
+    python3 - <<'PY2'
+from pathlib import Path
+import re
+p = Path("kernel/google/msm-4.14/lib/string.c")
+t = p.read_text()
+if "EXPORT_SYMBOL(__read_overflow)" not in t:
+    m = re.search(r"void fortify_panic\(const char \*name\).*?EXPORT_SYMBOL\(fortify_panic\);", t, re.S)
+    assert m, 'fortify_panic marker missing'
+    stub = m.group(0) + """
+
+void __read_overflow(void) { BUG(); }
+EXPORT_SYMBOL(__read_overflow);
+void __read_overflow2(void) { BUG(); }
+EXPORT_SYMBOL(__read_overflow2);
+void __read_overflow3(void) { BUG(); }
+EXPORT_SYMBOL(__read_overflow3);
+void __write_overflow(void) { BUG(); }
+EXPORT_SYMBOL(__write_overflow);
+"""
+    p.write_text(t[:m.start()] + stub + t[m.end():])
+PY2
+  ;; esac
+fi
+
+set +u; source build/envsetup.sh; set -e
+breakfast sunfish userdebug
+echo "TARGET_RELEASE=${TARGET_RELEASE:-unset}"
+test "${TARGET_RELEASE:-}" = "bp4a"
+
+rm -f out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image.lz4
+rm -f out/target/product/sunfish/boot.img
+mka bootimage -j8
+
+PROD=/srv/rom/src/lineage/out/target/product/sunfish
+BID=$(date -u +%Y%m%dT%H%M%SZ)
+DEST=/srv/rom/artifacts/009-axp-los23-port/${BID}-bisect-ksync-${NAME}
+mkdir -p "$DEST"
+cp -v "$PROD/boot.img" "$DEST/boot-make-native.img"
+
+WORK=$DEST/work
+rm -rf "$WORK"; mkdir -p "$WORK/good" "$WORK/new" "$WORK/check"
+(cd "$WORK/good" && "$MB" unpack "$GOOD")
+(cd "$WORK/new" && "$MB" unpack "$PROD/boot.img")
+cp -f "$WORK/new/kernel" "$WORK/good/kernel"
+(cd "$WORK/good" && "$MB" repack "$GOOD" "$DEST/boot-make.img")
+(cd "$WORK/check" && "$MB" unpack "$DEST/boot-make.img" >/dev/null && "$MB" cpio ramdisk.cpio extract)
+echo "=== VERIFY $NAME ==="
+grep -E 'security_patch|sdk_full' "$WORK/check/prop.default" | sort -u
+# Prefer header from first successful unpack (WORK/check); do not ||true a SIGILL unpack.
+if [[ -f "$WORK/check/kernel" ]]; then
+  "$MB" unpack "$DEST/boot-make.img" >"$DEST/unpack-hdr.txt" 2>&1 || \
+    echo "WARN: magiskboot header unpack failed (host SIGILL?); kernel already verified via WORK/check" | tee -a "$DEST/unpack-hdr.txt"
+else
+  "$MB" unpack "$DEST/boot-make.img" >"$DEST/unpack-hdr.txt" 2>&1
+fi
+grep -E 'OS_PATCH|KERNEL_SZ|KERNEL_FMT' "$DEST/unpack-hdr.txt" || true
+# ikconfig spot-check
+/srv/rom/src/lineage/kernel/google/msm-4.14/scripts/extract-ikconfig "$WORK/check/kernel" 2>/dev/null \
+  | grep -E 'CONFIG_(SECURITY_DMESG_RESTRICT|SLAB_FREELIST_HARDENED|FORTIFY_SOURCE|INIT_ON_ALLOC)=' || true
+sha256sum "$DEST/boot-make.img" "$DEST/boot-make-native.img" | tee "$DEST/SHA256SUMS"
+printf '%s\n' "ksync bisect: $NAME" "configs: $*" "Flash boot-make.img only (GOODMAKE ramdisk)." > "$DEST/README.txt"
+echo "=== DONE $DEST $(date -Is) ==="