sunfish-admin/AXP-Resurection
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
009-axp-los23-port
AXP-Resurection/docs/009-ota-rebuild-checklist.md
T
sunfish-adminandCursor 2d145c2878 009: Polish bacon fixes, OTA host scripts, and migration docs. 
Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding
and rebuild/sync helpers; document device roles, laptop migration, and Gitea.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-16 21:06:45 +02:00

5.8 KiB
Raw Permalink Blame History

009 — OTA rebuild checklist (re-read before every bacon009ota launch)

Target (current): lineage-23.2-20261008-nightly-sunfish manifest pin.
Zip name: AXP-Resurection-Pro-23.2-20261008-sunfish.zip (LOS_DATE=20261008).
Host: rom-dev01 only, detached: /srv/rom/artifacts/bin/rom-detach.

A. Upstream pin (not the LOS signed zip)

  • LOS_MANIFEST = official build-manifest.xml (SHA256 recorded in docs/009-version-pins.md).
  • First time or after long drift: LOS_SYNC=1 + repo sync --force-sync + pin all projects to manifest.
  • Re-run without sync: LOS_SYNC=0 (tree already pinned).
  • Post-sync: repo manifest -r diff vs nightly → 0 revision diffs on common projects.
  • Do not sync to “tip of lineage-23.2” only; pin exact nightly.

B. Staged sources on host (laptop → rom-dev01)

AXP_PROJECT_SOURCE must carry both:

  • vendor/sunfish-a16/ (patches, magisk, hardening.mk, BoardConfig.mk, …)
  • scripts/009-*.sh used by rebuild (entry: 009-rebuild-from-los.sh)

009-rebuild-from-los.sh rsyncs only vendor/sunfish-a16 into the tree; bacon runs from $STAGE/scripts/ — keep them in sync.

C. Mandatory ship flags (OTA path)

  • AXP_DEBLOB_WAVE4=1 (wave 4 deblob)
  • 012 hardened_malloc (via 009-bacon-hardened-malloc.sh)
  • AXP_AVB_FLAGS=0 / WITH_AVB=true
  • LINEAGE_BUILDTYPE=PRO, lunch lineage_sunfish-user, TARGET_RELEASE=bp4a
  • Release keys: /srv/rom/secrets/android-certs → never in git

D. LOS device wiring (lost on repo forall reset — re-apply every bacon)

apply_009_product_includes.py must run before breakfast:

  • lineage_sunfish.mk: gms.mk + magisk.mk + apps.mk (sunfish-a16-009-product-includes)
  • magisk.mk also inherit-products apps.mk (belt-and-suspenders if product block drifts)
  • BoardConfigLineage.mk: -include vendor/sunfish-a16/BoardConfig.mk (sunfish-a16-009-board-config) — AVB + super size

E. Secrets / signing (host only)

apply_009_axp_identity.py after wiring:

  • Copy release keys → vendor/lineage-priv/keys/
  • Copy avb.pem + avb_pkmd.bin → vendor/sunfish-a16/certs/
  • ANDROID_CERTS_DIR=/srv/rom/secrets/android-certs
  • Pre-breakfast guards: avb.pem, releasekey.pk8 exist
  • Post-breakfast: MAINLINE_BLUETOOTH_SEPOLICY_DEV_CERTIFICATES → vendor/lineage-priv/keys
  • Post-breakfast: BOARD_AVB_KEY_PATH → vendor/sunfish-a16/certs/avb.pem

F. Kernel pack (same msm-4.14 SHA as nightly manifest)

  • Reset kernel to git rev-parse HEAD of pinned kernel/google/msm-4.14 (not a stale laptop SHA).
  • Stage1 + combo4 + FORTIFY + CVE clean + hi-batch1–3 + lock-scope USB
  • US-S5-1: CONFIG_SECURITY_YAMA unset (like GOLDEN); SLAB_FREELIST_RANDOM=y; USERFAULTFD off
  • KSYM_NAME_LEN=192; no KernelSU in defconfig

G. Userspace applies (AXP ports on A16 / LOS 23 tree)

Naming: apply_009_a15_* = patches sourced from legacy AXP product, ported to Android 16 — not SDK 35.

  • 005 sigspoof, 008 call rec / FLAG_SECURE
  • 009 disable-app, DNS, connectivity, SUPL, branding, identity, cmdline, yama (inert without Yama built)
  • AXP reboot/Wi‑Fi/BT timeouts (apply_009_a15_reboot_timeouts.py, apply_009_a15_settings_timeouts.py) — no .rej, fail-closed
  • apply_009_a15_small.py
  • Wave4: apply_009_drop_lab_only_commands.py when AXP_DEBLOB_WAVE4=1
  • OpenSSH / carrier / euicc / lineage-tools drops

H. Product surface (match current LAB bacon)

  • Jelly on product (postflight US-S4-2: Jelly.apk)
  • AuroraStore, Droidify, FossifyGallery on system_ext/app/… (postflight US-S4-3; absent from product) — 009-bundled-apps-axp-parity.md
  • Pre-mka guard: GmsCore/GsfProxy/Phonesky + AuroraStore/Droidify/FossifyGallery/OpenEUICC in PRODUCT_PACKAGES
  • Prebuilts symlinked: /srv/rom/prebuilts/axp-apps/*.apk → vendor/sunfish-a16/prebuilt/
  • No Gallery2 / Glimpse on product (hardening.mk filter-out; Fossify replaces gallery UX)
  • hardening.mk: PRODUCT_PACKAGES += Jelly
  • microG + Phonesky prebuilts + GmsCore JNI extract
  • Magisk 30.7 preroot, out/.magisk/READY

I. Vendor SPL / identity

  • VENDOR_SECURITY_PATCH = 2023-09-05 (no rollback to 2023-08-05 on upgrade)
  • LINEAGE_BUILD_DATE = LOS_DATE when set (.axp-los-date)

J. Post-build (LAB only)

  • Sideload full zip; Magisk boot/dtbo/vbmeta reinforce if needed
  • Smoke: boot, Magisk, Island, Wallapop work profile, radio
  • Record artifact SHA256 + repo manifest -r under 009-axp-los23-port/

Known failure modes (2026-10-10)

Symptom Cause Fix
LAB has microG but no Aurora/Droidify/Fossify apps.mk never inherited (OTA before 2026-10-10 fix) Rebacon with staged WT; postflight US-S4-3
Maps brown / microG broken, JNI OK on host push only GmsCore .so not in image Rebacon; postflight must see system_ext/app/GmsCore/lib/arm64/libconscrypt_gmscore_jni.so
BT sepolicy not lineage-priv/keys gms.mk/magisk.mk not inherited apply_009_product_includes.py
Postflight US-S4-2 Gallery2 Old gate expected Gallery2 on product Current ship: Jelly only (Fossify is US-S4-3)
Bacon exit=1 as root after mka OK git safe.directory on hardened_malloc tree sudo -u android-build + apply_012 safe.directory
AVB key empty / wrong path BoardConfig.mk not included board include in same script
missing vendor/sunfish-a16/certs identity not copying from secrets ANDROID_CERTS_DIR + identity.py
repo sync hook errors project object-store drift --force-sync after forall clean
patch_incomplete AXP patch drift on A16 fail-closed + marker grep (not silent continue)
Reference in new issue View Git Blame Copy Permalink