009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

scripts/009-build-fortify-family-isolated.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+# Server-only diagnostic build. Uses its own sources/output; never resets LIVE.
+# Usage: bash this-script ROOT <family>
+# family: see 009-fortify-select-family.py GROUPS
+set -euo pipefail
+RUN=${1:?isolated root required}
+FAMILY=${2:?family required}
+case "$FAMILY" in
+  full|memory|strings|strings-copy|strings-len|\
+  strings-strcpy-strlen|strings-copy-strlen|strings-copy-strnlen|\
+  strings-strlen-restcopy|strings-strlen-ncopy|strings-strlen-cat|\
+  strings-strlen-strncpy|strings-strlen-strlcpy) ;;
+  *) echo "bad family: $FAMILY" >&2; exit 2;;
+esac
+test -d "$RUN/inputs"
+# Subdir name matches family (strings-copy → strings-copy/)
+test ! -e "$RUN/$FAMILY"
+TOP=/srv/rom/src/lineage
+LIVE=$TOP/kernel/google/msm-4.14
+PIN=28f9290ae067d3e7857126eb6312720dbe9c7c80
+CLANG=$TOP/prebuilts/clang/host/linux-x86/clang-r563880c
+BASE=$RUN/$FAMILY
+SRC=$BASE/src
+OUT=$BASE/out
+mkdir -p "$SRC" "$OUT"
+git -C "$LIVE" archive "$PIN" | tar -x -C "$SRC"
+python3 "$RUN/inputs/apply_fortify_clang.py" "$SRC"
+patch -p1 --batch -d "$SRC" < "$RUN/inputs/0001-driver-bounds-rtac-fils.patch"
+python3 "$RUN/inputs/009-fortify-select-family.py" "$SRC" "$FAMILY"
+cp "$RUN/inputs/failed-full.config" "$OUT/.config"
+cp "$OUT/.config" "$BASE/input.config"
+export PATH="$TOP/prebuilts/tools-lineage/linux-x86/bin:$TOP/prebuilts/build-tools/linux-x86/bin:$CLANG/bin:$TOP/out/host/linux-x86/bin:/usr/bin:/bin"
+export HIP_PATH=none
+export PERL5LIB="$TOP/prebuilts/tools-lineage/common/perl-base"
+export BISON_PKGDATADIR="$TOP/prebuilts/build-tools/common/bison"
+export KBUILD_BUILD_USER=nobody KBUILD_BUILD_HOST=android-build
+# An archived patched tree needs the same release suffix as installed modules.
+export LOCALVERSION=-g28f9290ae067-dirty
+MAKE=("$TOP/prebuilts/build-tools/linux-x86/bin/make" -j8
+    "HOSTCFLAGS=--sysroot=$TOP/prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.17-4.8/sysroot -I$TOP/prebuilts/kernel-build-tools/linux-x86/include"
+    "HOSTLDFLAGS=--sysroot=$TOP/prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.17-4.8/sysroot -Wl,-rpath,$TOP/prebuilts/kernel-build-tools/linux-x86/lib64 -L $TOP/prebuilts/kernel-build-tools/linux-x86/lib64 -fuse-ld=lld --rtlib=compiler-rt"
+    LLVM=1 LLVM_IAS=1 "LZ4=$TOP/prebuilts/kernel-build-tools/linux-x86/bin/lz4"
+    "LEX=$TOP/prebuilts/build-tools/linux-x86/bin/flex"
+    "YACC=$TOP/prebuilts/build-tools/linux-x86/bin/bison"
+    "M4=$TOP/prebuilts/build-tools/linux-x86/bin/m4"
+    "PAHOLE=$TOP/prebuilts/kernel-build-tools/linux-x86/bin/pahole"
+    "LIBCLANG_PATH=$CLANG/lib" "DTC_EXT=$TOP/out/host/linux-x86/bin/dtc"
+    -C "$SRC" "O=$OUT" ARCH=arm64 CC=clang LD=ld.lld)
+"${MAKE[@]}" olddefconfig
+diff -u "$BASE/input.config" "$OUT/.config" > "$BASE/config.diff" || {
+    cat "$BASE/config.diff"
+    echo 'STOP: unexpected configuration drift' >&2
+    exit 3
+}
+"$CLANG/bin/clang" --version > "$BASE/toolchain.txt"
+printf '%s\n' "$PIN" > "$BASE/source-commit.txt"
+printf '%q ' "${MAKE[@]}" > "$BASE/make-command.txt"
+"${MAKE[@]}" Image.lz4 modules
+cp "$OUT/.config" "$BASE/final.config"
+test "$(cat "$OUT/include/config/kernel.release")" = '4.14.357-openela-g28f9290ae067-dirty'
+if "$CLANG/bin/llvm-nm" "$OUT/vmlinux" | grep -Eq ' [Tt] __((read_overflow[23]?)|(write_overflow))$'; then
+    echo 'STOP: forbidden overflow stubs' >&2
+    exit 4
+fi
+mkdir "$BASE/pack"
+cd "$BASE/pack"
+MB=$(find /srv/rom/prebuilts/magisk -type f -name magiskboot -print -quit)
+test -n "$MB"
+GOOD=/srv/rom/artifacts/009-axp-los23-port/20260918T143547Z-axp-full/boot-make.img
+"$MB" unpack "$GOOD" > "$BASE/good-header.txt" 2>&1
+sha256sum ramdisk.cpio > "$BASE/ramdisk.sha256"
+cp "$OUT/arch/arm64/boot/Image" kernel
+"$MB" repack "$GOOD" "$BASE/boot-make.img"
+sha256sum "$BASE/boot-make.img" "$OUT/arch/arm64/boot/Image" "$OUT/vmlinux" > "$BASE/SHA256SUMS"
+printf 'DIAGNOSTIC ONLY: %s family; not full FORTIFY. Requires local unpack/header/kernel verification before LAB use.\n' "$FAMILY" > "$BASE/README.txt"
+echo "BUILD COMPLETE: $BASE/boot-make.img"