# Research: 005 restricted signature spoofing

## Decision: First working stack = `004` leftovers + spoofing + modern location

**Decision**: Ship one LAB validation build that includes (1) unfinished `004`
packaging fixes, (2) restricted spoofing, (3) BeaconDB location docs — and
**exclude** `006` banking and `007` root.

**Rationale**: Owner: first phase that must work is microG + patched Play +
spoofing. Banking/root are later regressions.

**Alternatives considered**: Separate tiny `004b` rebuild only — rejected;
wastes a flash cycle before spoofing lands. Pulling `006` early — rejected;
blocks focus.

## Decision: Spoofing implementation source = EXTENDROM / AXP (port to A16)

**Decision**: Use [EXTENDROM_SIGNATURE_SPOOFING](https://github.com/sfX-android/android_vendor_extendrom/wiki/EXTENDROM_SIGNATURE_SPOOFING)
as the attributable primary source (matches GOLDEN behaviour:
`allow_signature_fake`, Developer Options, per-app `FAKE_PACKAGE_SIGNATURE`).
Port patches from the closest supported Android line (**A15** is STABLE/tested;
GOLDEN is A15) onto **A16 / LOS 23.2**.

**Rationale**: Stock LOS 23.2 tree on `rom-dev01` has **no**
`FAKE_PACKAGE_SIGNATURE` / `allow_signature_fake` (inventory 2026-09-15). AXP
GOLDEN proves the UX and setting key. Old `android_signature_spoofing` repo is
obsolete per upstream.

**Alternatives considered**:

| Option | Why not |
|--------|---------|
| lineageos4microg unrestricted spoof | Constitution forbids open spoofing |
| Magisk / LSPosed FakeGApps | Forbidden; rootless Compatibility MVP |
| Wait for LOS to grow A16 EXTENDROM dir | Blocks first stack; we port ourselves |

**A16 note**: EXTENDROM wiki table lists A15, not A16. Expect conflict resolution
(`repo diff` / split patches) per EXTENDROM porting guide. Record deltas in
`docs/a15-a16-delta.md`.

## Decision: Must spoof `signingInfo`, not only `signatures[]`

**Decision**: Implementation MUST spoof both legacy `PackageInfo.signatures` and
modern `PackageInfo.signingInfo` (GET_SIGNING_CERTIFICATES).

**Rationale**: microG #2680 / EXTENDROM #48 — Google/Play check `signingInfo` on
modern Android; Self-Check “correct signature” fails if only legacy arrays are
faked. LOS Gerrit has A13–A15 fixes; ensure A16 port includes equivalent.

## Decision: Allow-list = microG GmsCore + project Phonesky

**Decision**: Effective spoofing limited to:

- `com.google.android.gms` — official microG signer (`73aaa390…` short on GOLDEN)
- `com.android.vending` — project Phonesky JKS  
  SHA-256 digest  
  `31:31:86:CB:7D:F2:D4:01:33:72:12:07:B7:29:73:E8:52:F6:1C:87:67:C3:21:E5:C7:50:39:01:1B:83:BD:56`

Privapp/default XMLs that bind by cert digest MUST use **our** digest (not
AXP’s `00:5C:98:05:…`).

**Rationale**: Constitution + GOLDEN grants; AXP `er_*` XMLs bind Phonesky by
digest.

## Decision: Global toggle default OFF

**Decision**: `allow_signature_fake` defaults to disabled; user enables in
Developer Options (AXP setup guide).

**Rationale**: Matches oracle docs and reduces surprise attack surface.

## Decision: `004` packaging leftovers are a `005` ship gate

**Decision**: Before declaring `005` done, the flashable zip MUST include:

1. `LOCAL_REPLACE_PREBUILT_APK_INSTALLED` for GmsCore/Gsf/Phonesky (already in
   working-tree `vendor/sunfish-a16/Android.mk`)
2. Phonesky privapp extras for Play 52 / A16 FGS:
   `FOREGROUND_SERVICE_SYSTEM_EXEMPTED`, `SCHEDULE_EXACT_ALARM` /
   `USE_EXACT_ALARM`, plus prior grammatical/status-bar entries

**Rationale**: Measured LAB failures — PRESIGNED strip → no `pm path`; missing
FGS allowlist → VpaService/DownloadService crash. Remount pushes are not the
shipped artifact.

## Decision: Modern location = BeaconDB (not UnifiedNlp backends)

**Decision**: Document configuring microG Location to use an Ichnaea-compatible
URL (`https://api.beacondb.net` or documented successor). Do **not** package
Déjà Vu / Nominatim NLP / MLS apps.

**Rationale**: microG 0.3.x dropped UnifiedNlp backends; MLS retired (2025);
GOLDEN also has no NLP backend packages. Owner wants modern stack.

**Alternatives considered**: Ship UnifiedNlp backends — rejected (obsolete for
0.3.x primary path).

## Decision: Out of scope remains `006`/`007`

**Decision**: No Insular/banking hard-gates; no KSU/SusFS in this feature’s
acceptance.

**Rationale**: Owner confirmation 2026-09-15 — first phase is microG + Play +
spoofing only.