# 009 signing / AVB (userspace Gate G)

Clone AXP/GOLDEN posture: **`user` + `release-keys`**, device **unlocked**
(`orange`). Not IOdes locked-bootloader.

Full checklist: `docs/009-hardening-signing-checklist.md`.

## Stages

| Stage | What |
|-------|------|
| US-S1 | Generate keys → `/srv/rom/secrets/android-certs/` |
| US-S2 | Wire `PRODUCT_DEFAULT_DEV_CERTIFICATE` into bacon |
| US-S3 | Project AVB key (`AVB_CUSTOM_KEY_PATH`); decide `WITH_AVB` |
| US-S4+ | Userspace harden / CVE — separate patches |

## Generate (rom-dev01 only)

```bash
# from synced repo copy or laptop scp of scripts/
sudo -u android-build bash /srv/rom/src/lineage/vendor/sunfish-a16/../../../../\
  # prefer:
bash /path/to/AXP_Resurection/scripts/009-generate-release-keys.sh
```

Script writes under `/srv/rom/secrets/android-certs/` when that parent is
writable, otherwise `$HOME/.android-certs` (Lineage default). On rom-dev01
(2026-09-29) secrets/ is root-owned without group write → keys live in
`/home/android-build/.android-certs/`. Refuses overwrite. Reminds about
encrypted offline backup before first signed ship bacon.

## Wire (US-S2 — after keys exist)

In the bacon environment (not committed secrets):

```bash
export PRODUCT_DEFAULT_DEV_CERTIFICATE=$HOME/.android-certs/releasekey
# after root relocate: /srv/rom/secrets/android-certs/releasekey
# lunch lineage_sunfish-userdebug   # first signed build
# later: lineage_sunfish-user
```

`009-bacon-axp-stage1-combo4.sh` auto-exports when `$HOME/.android-certs/releasekey.pk8` exists.
## AVB (US-S3)

Default tree falls back to AOSP `external/avb/test/data/testkey_rsa2048.pem`
(and LAB has been observed with `testkey_rsa4096`) plus
`BOARD_AVB_MAKE_VBMETA_IMAGE_ARGS += --flags 3` unless `WITH_AVB=true`
(`device/google/sunfish/BoardConfigLineage.mk`).

Project key generation is in `009-generate-release-keys.sh`
(`avb.pem` + `avb_pkmd.bin`). **Wire in tree** (soong-safe path), not only env:

`vendor/sunfish-a16/BoardConfig.mk` sets `BOARD_AVB_KEY_PATH` /
`BOARD_AVB_ALGORITHM=SHA256_RSA4096` when `certs/avb.pem` exists. Keep
`WITH_AVB` unset → vbmeta **flags 3** =
`HASHTREE_DISABLED|VERIFICATION_DISABLED` (libavb) → Magisk preroot on
unlocked/orange. That is **signing infrastructure**, not runtime AVB harden.

Validate after bacon (script fail-closed) on **target_files `IMAGES/`** (the
OTA pair). Do not use `out/target/product/$DEVICE/{boot,vbmeta}.img` alone —
those make images can be stock and disagree with the Magisk payload in the zip.
Gates: pubkey sha1 == `avb_pkmd.bin` (not AOSP testkey); flags 3;
`verify_image --key` + `--expected_chain_partition vbmeta_system:1:avb_pkmd.bin`;
`magiskboot cpio test` ≠ 0; LAB stays `flash.locked=0` + Magisk works.

**OEM unlocking:** leave enabled as a best-effort escape hatch (not a recovery
guarantee). Do not relock the bootloader on this Magisk track.

## Branding

Ship identity follows AXP/GOLDEN, not Lineage's unofficial channel.
GOLDEN (`22.2-2026.003-sunfish-pro`) reports `ro.lineage.releasetype=PRO`,
`ro.build.tags=release-keys`, and a version ending in `sunfish-pro`.
`TARGET_UNOFFICIAL_BUILD_ID` forces Lineage `UNOFFICIAL` and is not that
scheme. The next bacon sets `PRO` + `release-keys` + `…-sunfish-pro`.
**Pro** remains the full Magisk track (AXP PRO, not SLIM).

`branding.mk` adds `ro.axp.resurection.track=pro`. Ship scripts also publish
`AXP-Resurection-Pro-<ver>-<date>-sunfish.zip` as a hardlink/copy of the
Lineage `bacon` zip (no rebuild solely to rename).


## Never

- Commit `*.pk8`, private `*.pem`, or pass files.
- Relock LAB/GOLDEN as a project requirement (OEM unlock-always-on does not
  make Magisk+relock safe).
- Flash old `kh-cve` / `kh-full` zips from 2026-09-18.