009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding, bundled apps, and AXP-class product surface docs/scripts.
2026-10-05 10:42:00 +02:00
1 parent fd793b9471
commit deaaf42caa
@@ -0,0 +1,89 @@
+# 009 signing / AVB (userspace Gate G)
+
+Clone AXP/GOLDEN posture: **`user` + `release-keys`**, device **unlocked**
+(`orange`). Not IOdes locked-bootloader.
+
+Full checklist: `docs/009-hardening-signing-checklist.md`.
+
+## Stages
+
+| Stage | What |
+|-------|------|
+| US-S1 | Generate keys → `/srv/rom/secrets/android-certs/` |
+| US-S2 | Wire `PRODUCT_DEFAULT_DEV_CERTIFICATE` into bacon |
+| US-S3 | Project AVB key (`AVB_CUSTOM_KEY_PATH`); decide `WITH_AVB` |
+| US-S4+ | Userspace harden / CVE — separate patches |
+
+## Generate (rom-dev01 only)
+
+```bash
+# from synced repo copy or laptop scp of scripts/
+sudo -u android-build bash /srv/rom/src/lineage/vendor/sunfish-a16/../../../../\
+  # prefer:
+bash /path/to/AXP_Resurection/scripts/009-generate-release-keys.sh
+```
+
+Script writes under `/srv/rom/secrets/android-certs/` when that parent is
+writable, otherwise `$HOME/.android-certs` (Lineage default). On rom-dev01
+(2026-09-29) secrets/ is root-owned without group write → keys live in
+`/home/android-build/.android-certs/`. Refuses overwrite. Reminds about
+encrypted offline backup before first signed ship bacon.
+
+## Wire (US-S2 — after keys exist)
+
+In the bacon environment (not committed secrets):
+
+```bash
+export PRODUCT_DEFAULT_DEV_CERTIFICATE=$HOME/.android-certs/releasekey
+# after root relocate: /srv/rom/secrets/android-certs/releasekey
+# lunch lineage_sunfish-userdebug   # first signed build
+# later: lineage_sunfish-user
+```
+
+`009-bacon-axp-stage1-combo4.sh` auto-exports when `$HOME/.android-certs/releasekey.pk8` exists.
+## AVB (US-S3)
+
+Default tree falls back to AOSP `external/avb/test/data/testkey_rsa2048.pem`
+(and LAB has been observed with `testkey_rsa4096`) plus
+`BOARD_AVB_MAKE_VBMETA_IMAGE_ARGS += --flags 3` unless `WITH_AVB=true`
+(`device/google/sunfish/BoardConfigLineage.mk`).
+
+Project key generation is in `009-generate-release-keys.sh`
+(`avb.pem` + `avb_pkmd.bin`). **Wire in tree** (soong-safe path), not only env:
+
+`vendor/sunfish-a16/BoardConfig.mk` sets `BOARD_AVB_KEY_PATH` /
+`BOARD_AVB_ALGORITHM=SHA256_RSA4096` when `certs/avb.pem` exists. Keep
+`WITH_AVB` unset → vbmeta **flags 3** =
+`HASHTREE_DISABLED|VERIFICATION_DISABLED` (libavb) → Magisk preroot on
+unlocked/orange. That is **signing infrastructure**, not runtime AVB harden.
+
+Validate after bacon (script fail-closed) on **target_files `IMAGES/`** (the
+OTA pair). Do not use `out/target/product/$DEVICE/{boot,vbmeta}.img` alone —
+those make images can be stock and disagree with the Magisk payload in the zip.
+Gates: pubkey sha1 == `avb_pkmd.bin` (not AOSP testkey); flags 3;
+`verify_image --key` + `--expected_chain_partition vbmeta_system:1:avb_pkmd.bin`;
+`magiskboot cpio test` ≠ 0; LAB stays `flash.locked=0` + Magisk works.
+
+**OEM unlocking:** leave enabled as a best-effort escape hatch (not a recovery
+guarantee). Do not relock the bootloader on this Magisk track.
+
+## Branding
+
+`TARGET_UNOFFICIAL_BUILD_ID=AXP-Resurection-Pro` is set at the **top** of
+`device/google/sunfish/lineage_sunfish.mk` (before inheriting
+`vendor/lineage` → `version.mk`). Helper:
+`apply_009_unofficial_build_id.py`. **Pro** = full Magisk resurrection track
+(not a future slim/minimal variant). Mirrors GOLDEN’s `…-sunfish-pro` /
+releasetype `PRO` intent without patching `vendor/lineage/config/version.mk`.
+
+`branding.mk` adds `ro.axp.resurection.track=pro`. Ship scripts also publish
+`AXP-Resurection-Pro-<ver>-<date>-sunfish.zip` as a hardlink/copy of the
+Lineage `bacon` zip (no rebuild solely to rename).
+
+
+## Never
+
+- Commit `*.pk8`, private `*.pem`, or pass files.
+- Relock LAB/GOLDEN as a project requirement (OEM unlock-always-on does not
+  make Magisk+relock safe).
+- Flash old `kh-cve` / `kh-full` zips from 2026-09-18.