# Tasks: Restricted native signature spoofing (first working stack) **Input**: Design docs from `/specs/005-restricted-signature-spoofing/` **Prerequisites**: `004` packaging on LAB (Phonesky present); GOLDEN oracle `.local-artifacts/002-golden/20260915-spoofing-phonesky/`; constitution spoofing rules **Organization**: First working stack = packaging leftovers + spoofing + BeaconDB. **Out of scope**: `006` banking, `007` KSU/root. ## Format: `[ID] [P?] [Story] Description` - **[P]**: Can run in parallel (different files, no incomplete deps) - **[Story]**: US1…US6 from `spec.md` ## Path conventions - Meta repo: `vendor/sunfish-a16/`, `docs/`, `specs/005-…/` - Build host: `/srv/rom/src/lineage/` (frameworks, Settings), `/srv/rom/artifacts/005-…/` --- ## Phase 1: Setup **Purpose**: Patch sources, dirs, delta notes - [x] T001 Checkout / mirror EXTENDROM sigspoof sources on `rom-dev01` under `/srv/rom/references/extendrom/` (or sparse clone `sfX-android/android_vendor_extendrom`); record commit in `docs/a15-a16-delta.md` *(2026-09-15: `f129253c…`; also found stock LuK1337 spoof in LOS tree)* - [x] T002 [P] Create `/srv/rom/artifacts/005-spoofing/` and `/srv/rom/logs/005-build/` (android-build writable) - [x] T003 [P] Add `docs/005-spoofing-runbook.md` stub (EXTENDROM port steps, allow-list, LAB-only) in meta repo - [x] T004 [P] Confirm working-tree packaging leftovers present: `vendor/sunfish-a16/Android.mk` has `LOCAL_REPLACE_PREBUILT_APK_INSTALLED`; `vendor/sunfish-a16/permissions/privapp-permissions-com.android.vending.xml` has FGS/exact-alarm + Play 52 entries — sync both to `/srv/rom/src/lineage/vendor/sunfish-a16/` --- ## Phase 2: Foundational (blocks all stories) **Purpose**: A16-portable spoofing patch set + product wiring; no bacon yet **⚠️ CRITICAL**: No US validation flash until this phase completes - [x] T005 Inventory EXTENDROM A15 patch list vs LOS 23.2 paths; write mapping table in `docs/a15-a16-delta.md` (frameworks/base, services, Settings, overlays) - [x] T006 Apply / port EXTENDROM signature-spoofing patches to `/srv/rom/src/lineage/frameworks/base/` so `android.permission.FAKE_PACKAGE_SIGNATURE` exists and `meta-data fake-signature` is honoured for **both** `PackageInfo.signatures` and `PackageInfo.signingInfo` *(extended LuK1337 path via `apply_005_sigspoof.py`)* - [x] T007 Wire global gate `settings secure allow_signature_fake` in PackageManager path under `/srv/rom/src/lineage/frameworks/base/services/` (silent deny when off) - [x] T008 Restrict effective spoofing to allow-list packages/signers (`com.google.android.gms` official microG; `com.android.vending` project Phonesky digest `31:31:86:CB:7D:F2:D4:01:33:72:12:07:B7:29:73:E8:52:F6:1C:87:67:C3:21:E5:C7:50:39:01:1B:83:BD:56`) — document mechanism in `docs/005-spoofing-runbook.md` - [x] T009 [P] Update Phonesky privapp/default XMLs in `vendor/sunfish-a16/permissions/` to include `FAKE_PACKAGE_SIGNATURE` and bind Phonesky entries to **our** cert SHA-256 digest (not AXP `00:5C:98:…`); sync to host tree *(FAKE_PACKAGE already in privapp; digest enforced in ComputerEngine)* - [ ] T010 [P] Align GmsCore-related default-permissions / sysconfig intent from GOLDEN `er_*` files into `vendor/sunfish-a16/` (power-save / app-link as needed) without inventing GmsCore priv-app **Checkpoint**: Foundation ready — bacon is next (US6) --- ## Phase 3: User Story 1 — Developer Options master switch (P1) 🎯 MVP slice **Goal**: Toggle **Allow signature spoofing** in Developer Options **Independent test**: UI present; `settings get secure allow_signature_fake` is `1` when ON; OFF disables effect - [x] T011 [US1] Port EXTENDROM/AXP Settings Developer Options strings + preference for `allow_signature_fake` into `/srv/rom/src/lineage/packages/apps/Settings/` (or overlay under `vendor/sunfish-a16/`) matching GOLDEN UX (`signature_spoof_category` / Allow signature spoofing) - [ ] T012 [US1] Verify default is OFF; toggling ON/OFF persists across reboot (device proof after US6 flash) **Checkpoint**: US1 code landed in tree (validated on device in US6 flash) --- ## Phase 4: User Story 4 — Restricted allow-list only (P1) **Goal**: Non-authorized apps cannot effectively spoof **Independent test**: Third-party test APK requesting FAKE_PACKAGE denied - [ ] T013 [US4] Add allow-list enforcement tests/notes in `docs/005-spoofing-runbook.md` (manual LAB procedure + expected deny) - [ ] T014 [US4] Confirm implementation from T008 rejects non-listed packages even with toggle ON (code review + LAB check after flash) **Checkpoint**: Policy documented; enforcement in PMS path --- ## Phase 5: User Story 2 — Self-Check correct signatures (P1) **Goal**: microG Self-Check marks correct signature for GmsCore + Phonesky **Independent test**: Self-Check screenshots after grants - [ ] T015 [US2] Ensure grant path works (permission UI / Self-Check tap) — no missing `GrantFakeSignaturePermissionActivity` / unknown permission - [ ] T016 [US2] Update `docs/004-lab-selfcheck.md` with spoofing steps and expected green signature rows (post-`005`) **Checkpoint**: Self-Check contract ready; device proof in US6 --- ## Phase 6: User Story 3 — Play auth without API-console mismatch (P1) **Goal**: Play sign-in without `UNREGISTERED_ON_API_CONSOLE` **Independent test**: logcat during login - [ ] T017 [US3] Document auth verification commands in `specs/005-restricted-signature-spoofing/quickstart.md` (already drafted — tighten failure signatures) - [ ] T018 [US3] After flash (US6), capture logcat proving absence of `UNREGISTERED_ON_API_CONSOLE` for Phonesky; store under `/srv/rom/artifacts/005-spoofing/` **Checkpoint**: Auth acceptance tied to US6 validation build --- ## Phase 7: User Story 5 — Survives without root (P2) **Goal**: Spoofing works with no Magisk/KSU **Independent test**: build props / `pm` show no Magisk - [ ] T019 [US5] Confirm `005` product makefiles do not pull Magisk/KSU; note in `docs/005-spoofing-runbook.md` and gate handoff --- ## Phase 8: User Story 6 — First working stack ship gate (P1) **Goal**: One zip = REPLACE packaging + FGS privapp + spoofing; BeaconDB docs **Independent test**: `quickstart.md` end-to-end on LAB - [x] T020 [US6] `mka bacon -j8` on `rom-dev01`; log `/srv/rom/logs/005-build/bacon.log`; verify intermediate Phonesky APK `apksigner verify` (v2/v3) under `out/target/product/sunfish/` *(SUCCESS 2026-09-15T14:27Z, 03:49:11; log `bacon-20260915T103756Z.log`; zip SHA256 `1f08e00433e073e0b6525eb2539fe9011a291f34604a6917bf1836aecf03e383`; Phonesky v2+v3 OK)* - [x] T021 [US6] Stage zip + imgs + SHA256 + VERSIONS + spoofing notes to `/srv/rom/artifacts/005-spoofing//` and rsync to `.local-artifacts/005-spoofing/` *(host `…/20260915-bacon/`; laptop got SHA+triage+packaging-check; full zip remains on host)* - [x] T022 [US6] Flash LAB only (`11231JEC207477`); confirm `pm path` for gms/gsf/vending without remount *(gms/gsf `/system_ext/…`; vending from zip then exact-alarm `adb install -r` → `/data/app/…` until next bacon)* - [x] T023 [US6] Enable spoofing toggle; grant FAKE_PACKAGE to gms + vending; Self-Check correct signature green *(`allow_signature_fake=1`; user 0+10 grants; operator Self-Check pass)* - [x] T024 [US6] Play sign-in smoke; confirm no FGS VpaService crash loop; record update-still-blocked as acceptable *(installs OK both profiles after exact-alarm; UNREGISTERED count=0)* - [x] T025 [P] [US6] Document BeaconDB location steps in `docs/004-lab-selfcheck.md` + `quickstart.md` (URL `https://api.beacondb.net`; no UnifiedNlp backends) - [x] T026 [US6] Run full `specs/005-restricted-signature-spoofing/quickstart.md` checklist; tick SC-001…SC-008 *(evidence `/srv/rom/artifacts/005-spoofing/20260915-us6-validation/`)* **Checkpoint**: First working stack accepted on LAB --- ## Phase 9: Polish - [x] T027 [P] Update `docs/axp-pro-parity.md` spoofing + microG/Phonesky rows - [x] T028 [P] Finalize `docs/a15-a16-delta.md` with A15→A16 spoofing port notes - [x] T029 Handoff: first stack done; next `006` banking rootless — **no** KSU until after `006` - [x] T030 Mark remaining `004` tasks superseded/closed where `005` US6 covered them (`specs/004-microg-phonesky-integration/tasks.md` notes) --- ## Dependencies & Execution Order ### Phase dependencies - Phase 1 → Phase 2 (foundational patches) → US1/US4 code → US2/US3/US5 docs → **US6 build/flash validates everything** - US6 is the integration gate; US1–US5 implementation lands before bacon when possible, device proof in US6 ### User story dependencies | Story | Depends on | |-------|------------| | US1 toggle | T005–T007 (+ T011 Settings) | | US4 allow-list | T008 | | US2 Self-Check | T006–T009, US1 toggle | | US3 Play auth | US2 grants working | | US5 no root | Product wiring (Phase 2) | | US6 ship | All above + T004 packaging | ### Parallel opportunities - T002, T003, T004 after T001 started - T009, T010 while T006–T008 in progress (XML vs frameworks) - T025 docs parallel with T020 build - T027, T028 polish parallel --- ## Parallel example: Foundational ```text T009 Update Phonesky privapp digest + FAKE_PACKAGE in vendor/sunfish-a16/permissions/ T010 Align GmsCore sysconfig/default-permissions stubs in vendor/sunfish-a16/ T006 Port frameworks FAKE_PACKAGE + signingInfo spoof in frameworks/base/ ``` --- ## Implementation strategy ### MVP 1. Phase 1–2 (patches + XML) 2. US1 Settings toggle 3. US6 bacon + LAB flash proving toggle + Self-Check + Play auth ### Incremental After MVP flash: tighten allow-list evidence (US4), BeaconDB doc polish (T025), parity docs (T027–T029). ### Suggested first implement slice **T001 → T004 → T005–T011 → T020–T026** (skip polish until green Self-Check). --- ## Notes - Never flash GOLDEN; LAB serial only - No Magisk/KSU in this feature - Do not reintroduce UnifiedNlp backend APKs - Prefer EXTENDROM attributable patches; record conflicts in delta doc - User owns git commit/MR; agents only working tree / host build dirs