# 005 — Restricted signature spoofing runbook

**Feature**: `005-restricted-signature-spoofing`  
**LAB only**: serial `11231JEC207477` — never GOLDEN  
**Host**: `rom-dev01` under `/srv/rom/`

## What we discovered (2026-09-15)

LineageOS 23.2 **already** ships restricted microG spoofing
(`frameworks/base` commit `23c0a5c19844`, LuK1337):

| Gate | Stock LOS behaviour |
|------|---------------------|
| Build | `userdebug`/`eng` only (`isDebuggable()` JNI) |
| Packages | `com.google.android.gms`, `com.android.vending` only |
| Signer | Must match **microG release** cert (`MICROG_REAL_SIGNATURE`) |
| Fake value | Must equal platform Google cert (`MICROG_FAKE_SIGNATURE`) |
| Surfaces | Spoofs both `PackageInfo.signatures` and `signingInfo` |

Gaps vs our stack / AXP UX:

1. **Our Phonesky** is signed with the **project JKS**, not microG — stock
   gate rejected it → Play `UNREGISTERED_ON_API_CONSOLE`.
2. No `FAKE_PACKAGE_SIGNATURE` permission → microG Self-Check permission rows
   empty.
3. No Developer Options master switch (`allow_signature_fake`).

## What we applied

Script (idempotent, marker `SUNFISH_A16_005_SIGSPOOF`):

- Meta: `vendor/sunfish-a16/patches/005-sigspoof/apply_005_sigspoof.py`
- Host copy: `/srv/rom/src/lineage/vendor/sunfish-a16/patches/005-sigspoof/`
- References: `/srv/rom/references/extendrom` @ `f129253c…`
- Cert hex: `/srv/rom/artifacts/005-spoofing/phonesky-cert.hex`
  (SHA-256 `31:31:86:CB:…:BD:56`)

Changes on the LOS tree:

1. Extend `isMicrogSigned()` to accept **project Phonesky** signer for
   `com.android.vending`.
2. Gate spoofing on `Settings.Secure.allow_signature_fake` (default **0**).
3. Require grant of `android.permission.FAKE_PACKAGE_SIGNATURE`.
4. Port EXTENDROM permission + Settings Developer Options toggle + strings.
5. Keep packaging leftovers: `LOCAL_REPLACE_PREBUILT_APK_INSTALLED` + Play FGS
   privapp XML (already in `vendor/sunfish-a16/`).

**LAB 2026-09-15 post-flash:** Self-Check / spoofing / no
`UNREGISTERED_ON_API_CONSOLE` OK. Play install failures / ANR: `DownloadService`
/`VpaService` FGS `systemExempted` needs **any of** `SCHEDULE_EXACT_ALARM` /
`USE_EXACT_ALARM` / VPN — privapp alone is not enough if the APK does not
**request** those permissions.

**Fix (2026-09-15):** Phonesky rebuild adds `USE_EXACT_ALARM` +
`SCHEDULE_EXACT_ALARM` to the manifest; artifact
`/srv/rom/artifacts/005-spoofing/Phonesky_exact-alarm.apk`; pushed to LAB via
`adb install -r` (same project JKS); vendor prebuilt updated under
`/srv/rom/src/lineage/vendor/sunfish-a16/prebuilt/Phonesky.apk` for next bacon.
`USE_EXACT_ALARM: granted=true` on LAB after upgrade.

Re-apply after `repo sync` that resets frameworks/Settings:

```bash
python3 /srv/rom/src/lineage/vendor/sunfish-a16/patches/005-sigspoof/apply_005_sigspoof.py
```

Backups: `/srv/rom/artifacts/005-spoofing/bak-snapshots/` (never leave
`*.005.bak` under `res/` — aapt2 will fail).

## LAB validation (US6 — 2026-09-15)

Accepted on LAB `11231JEC207477` / build `23.2-20260915-UNOFFICIAL-sunfish`.
Evidence: `/srv/rom/artifacts/005-spoofing/20260915-us6-validation/LAB-US6.txt`.

1. ~~Flash LAB; `pm path` gms / gsf / vending~~ — pass  
2. ~~Allow signature spoofing~~ — `allow_signature_fake=1`  
3. ~~Self-Check correct signature~~ — pass (grant on user 0 + Island 10)  
4. ~~Play sign-in / installs~~ — pass after exact-alarm Phonesky; no `UNREGISTERED_ON_API_CONSOLE`  
5. Location: configure BeaconDB `https://api.beacondb.net` (no UnifiedNlp) — steps in
   `docs/004-lab-selfcheck.md` + `quickstart.md`

```bash
adb -s 11231JEC207477 shell settings get secure allow_signature_fake
# expect 1 when enabled
```

**Handoff:** first stack done → next feature **`006` banking rootless**. Do **not**
add KernelSU/`007` until after `006`.

## Out of scope

- Banking apps (`006`), KSU/root (`007`), Magisk/LSPosed.