009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding, bundled apps, and AXP-class product surface docs/scripts.
2026-10-05 10:42:00 +02:00
1 parent fd793b9471
commit deaaf42caa
@@ -0,0 +1,58 @@
+# 009 AXP LOS23 port — patch / packaging README
+
+**Track**: Magisk AXP resurrection on LOS 23.2 sunfish (`AXP_Resurection`).  
+**Not ship**: KernelSU / SusFS (`007` standby / optional recycle only).
+
+## Apply order (host tree under `/srv/rom/src/lineage/`)
+
+1. **Google stack** — `vendor/sunfish-a16/gms.mk` + `Android.mk` (microG, GSF,
+   Phonesky). Host APKs: `/srv/rom/prebuilts/{microg,phonesky}/` (never Git).
+2. **Signature spoofing** — `vendor/sunfish-a16/patches/005-sigspoof/`
+   (`apply_005_sigspoof.py`). Attribute: LOS restricted spoofing + AXP/005.
+3. **Call recording unlock** — `vendor/sunfish-a16/patches/008-call-rec-flag-secure/`
+   (`extendrom_call_recording`). Attribute: EXTENDROM `F_CALLREC`.
+4. **Magisk preroot** — EXTENDROM-class boot/`init_boot` patch using Magisk APK
+   from `/srv/rom/prebuilts/magisk/` (see `docs/009-magisk-preinstall-runbook.md`).
+   Stub: `vendor/sunfish-a16/magisk.mk`. Attribute: Magisk upstream + sfX
+   extendrom Magisk patcher. **Host tree currently has no `vendor/extendrom`**
+   — must vendor minimal patcher or checkout extendrom before first Magisk bacon.
+5. **Bundled apps** — `/srv/rom/prebuilts/axp-apps/` + `apps.mk` (Aurora,
+   Droidify, Fossify Gallery). Symlink APKs into `vendor/sunfish-a16/prebuilt/`.
+6. **Private DNS presets** — `apply_009_private_dns_providers.py` (GOLDEN list).
+7. **Internet connectivity check** — `apply_009_connectivity_check.py` (GOLDEN
+   list **minus** AXP.OS / `axpos.org`).
+8. **Disable for user apps** — `apply_009_disable_user_apps.py` (SPA gate).
+9. **Userspace hardening / signing** — staged: see `signing/README.md`,
+   `hardening/README.md` (US-S4-1 OpenSSH trim), and
+   `docs/009-hardening-signing-checklist.md` (US-S1 keys → US-S2 wire →
+   US-S3 AVB → US-S4+ harden). Bootloader lock = wont.
+10. **Kernel hardening** — LOS23 `msm-4.14` + map in
+   `docs/009-kernel-hardening-map.md` (FR-017). Stage 1:
+   `vendor/sunfish-a16/patches/009-kernel-hardening/apply_stage1.sh`
+   (AXP Graphene/AH allowlist). Priority: AXP → LOS → Iodé → optional
+   Graphene; no Divest hunt; no extra location lockdown.
+
+## Product includes
+
+Wire Magisk-resurrection product from `vendor/sunfish-a16/` into
+`lineage_sunfish` (same pattern as `004`/`005`). Keep Phonesky priv-app path.
+**No FakeStore. No KernelSU product packages.**
+
+## Deferred
+
+- Banking Gate E / Island validation (owner future).
+- Localization AXP-vs-LOS compare (`docs/009-localization-axp-vs-los.md` stub).
+
+## Host paths (rom-dev01)
+
+| What | Path |
+|------|------|
+| Magisk APK | `/srv/rom/prebuilts/magisk/Magisk-v30.7.apk` |
+| EXTENDROM Magisk patcher | `/srv/rom/references/extendrom/config/magisk/` |
+| Kernel source | `/srv/rom/src/lineage/kernel/google/msm-4.14` |
+| Product include (gms) | `device/google/sunfish/lineage_sunfish.mk` → `vendor/sunfish-a16/gms.mk` |
+| Vanilla baseline | `/srv/rom/artifacts/003-vanilla/20260914-lineage-23.2-sunfish/` |
+| Optional KSU boots | `/srv/rom/artifacts/007-kernelsu/` (non-ship) |
+
+**Gap:** `vendor/extendrom` is **not** checked out in the lineage tree yet.
+Magisk bacon blocked on T011 (symlink/checkout + PREROOT or slim wire).