sunfish-admin
12d2179c20
Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.
130 lines
7.2 KiB
Markdown
130 lines
7.2 KiB
Markdown
# Android 15 (AXP GOLDEN) → Android 16 (LOS 23.2) — developer delta
|
||
|
||
Living notes for porting **AXP / GrapheneOS ideas** onto our base without
|
||
blind copy. Non-normative until a row is promoted into a feature `spec.md`.
|
||
|
||
| Ours (LAB target) | GOLDEN (oracle) |
|
||
|-------------------|-----------------|
|
||
| LineageOS **23.2** / Android **16** | AXP Pro / LOS-derived **22.2** / Android **15** |
|
||
| `BUILD_ID=BP4A.251205.006`, SDK **36** tree | SDK **35**, `ro.build.version.release=15` |
|
||
| Device: sunfish (same silicon) | sunfish |
|
||
|
||
**Working rule (owner):** prefer AXP A15 scheme when still valid; if A16 is
|
||
easier, use it; if harder, redesign the *path* to the **same end state**.
|
||
|
||
---
|
||
|
||
## 1. Already measured on this project
|
||
|
||
| Area | A15 / AXP behaviour | A16 / LOS 23.2 reality | Adaptation |
|
||
|------|---------------------|------------------------|------------|
|
||
| Phonesky on `/system/priv-app` | Works on GOLDEN | `artifact_path_requirements` / `generic_system.mk` rejects device-specific `system/` installs unless allow-listed | Keep AXP path; `PRODUCT_ARTIFACT_PATH_REQUIREMENT_ALLOWED_LIST` (`004`) — do **not** move to `product` only to silence the check |
|
||
| GmsCore / Gsf on `system_ext` app | GOLDEN layout | Builds clean (no artifact hit) | Keep |
|
||
| Priv-app XML for GmsCore | GOLDEN: not priv-app | Inventing `privapp-permissions-microg` diverges | Removed; add only if Self-Check proves need |
|
||
| Super partition headroom | AXP fuller image fits their budgets | Vanilla LOS ERROR_LIMIT too tight for fat microG+Play | Modest `BOARD_SUPER_PARTITION_ERROR_LIMIT` bump — not ABI-strip of official microG |
|
||
| Play targetSdk / apktool | Older Play on GOLDEN (50.x) | Latest Play ~52.x needs apktool 2.12 + `ANDROIDSDK=35+`, zipalign-before-sign | Documented in `004` runbook |
|
||
| PRESIGNED prebuilt APKs | AXP ships Play/microG with intact v2/v3 | `BUILD_PREBUILT` uncompresses JNI / realigns → strips APK Sig v2/v3; PM skips Phonesky (`pm path` empty) | `LOCAL_REPLACE_PREBUILT_APK_INSTALLED` for GmsCore/Gsf/Phonesky (`004`, measured 2026-09-15) |
|
||
| Phonesky privapp allowlist | AXP XML for older Play | Play 52.x on A16 requests `HIDE_STATUS_BAR_NOTIFICATION` + `READ_SYSTEM_GRAMMATICAL_GENDER`; missing → boot abort on userdebug | Extend `privapp-permissions-com.android.vending.xml` |
|
||
| Signature spoofing | EXTENDROM: `allow_signature_fake` + `FAKE_PACKAGE_SIGNATURE` + Settings toggle; grants on gms+vending; A15 STABLE | LOS 23.2 **already** has LuK1337 allow-list spoof (`ComputerEngine` `23c0a5c`): userdebug + microG signer + Google fake-sig + `signingInfo`. Missing vs AXP: no `FAKE_PACKAGE` perm/UI; **rejects project-signed Phonesky** | Feature **`005`**: extend signer allow-list for our Phonesky JKS; port EXTENDROM toggle + `FAKE_PACKAGE_SIGNATURE`; see `docs/005-spoofing-runbook.md` |
|
||
|
||
---
|
||
|
||
## 2. Partition / packaging (porter mindset)
|
||
|
||
- AOSP has been tightening **system vs system_ext vs product** for years; A16
|
||
builds (especially with `generic_system.mk`) make “drop OEM APKs on system”
|
||
a **build-time** problem, not only a policy preference.
|
||
- **Privapp-permissions must live on the same partition as the priv-app**
|
||
(AOSP rule since product partition work). Moving Phonesky later ⇒ move XMLs
|
||
with it.
|
||
- `system_ext` remains the natural home for ROM Google-compat substitutes
|
||
(AXP: microG, F-Droid, Aurora base) — still valid on A16.
|
||
- Prefer **allow-list exception** or **system_ext/product** over rewriting the
|
||
whole AXP layout when GSI rules bite.
|
||
|
||
---
|
||
|
||
## 3. Compatibility stack (microG / Play / spoofing)
|
||
|
||
| Topic | Note for A16 |
|
||
|-------|----------------|
|
||
| microG | Use **current** upstream; do not pin GOLDEN 0.3.15. Keep official signer for F-Droid. |
|
||
| Phonesky | Still patch via AXP `patch-playstore`; newer Play = newer apktool/SDK framework. |
|
||
| Signature spoofing | **Done in `005`:** extend LuK1337 allow-list for project Phonesky JKS; port EXTENDROM toggle + `FAKE_PACKAGE_SIGNATURE`. LAB US6 green 2026-09-15. |
|
||
| Phonesky FGS / exact-alarm | A16 `systemExempted` needs manifest `USE_EXACT_ALARM` (or SCHEDULE / VPN), not only privapp XML. Fixed in Phonesky rebuild; vendor prebuilt updated. |
|
||
| FakeStore | Still forbidden next to real Phonesky. |
|
||
|
||
---
|
||
|
||
## 4. Attestation / KeyMint / banking (`006`/`007`)
|
||
|
||
- GOLDEN already shows **KeyMint / RKP / TEE** stress with Yuh on **A15**.
|
||
- A16 does not remove that class of problem; RKP and attestation surfaces
|
||
continue to evolve — treat GrapheneOS/AOSP docs as *what* to measure, LOS+LAB
|
||
as *where* to measure.
|
||
- Magisk DenyList on GOLDEN ≠ our root plan. Production root = **KSU-Next +
|
||
SusFS** (`007`). Do not port Magisk-shaped packaging into `004`.
|
||
|
||
---
|
||
|
||
## 5. GrapheneOS on Android 16 (reference, not base)
|
||
|
||
- GOS ported features to A16; publicly noted **harder** device-support work
|
||
because AOSP dropped much Pixel board/userspace publishing with 16.
|
||
- For **sunfish** we stay on **LOS 23.2 device trees**, not GOS device bringup.
|
||
- Use modern GOS as reference for **hardening / privacy behaviour** patches
|
||
(`013`, hardening backlog) — classify each patch: direct / port / obsolete /
|
||
A16-incompatible (same discipline as `reference-sources.md`).
|
||
- Never treat historical GOS **A13 sunfish** kernel as A16 base.
|
||
|
||
---
|
||
|
||
## 6. Call recording / FLAG_SECURE / UX (`008`+)
|
||
|
||
- AXP overlays and older XML toggles often **break or no-op** across major
|
||
releases. On A16: re-find Dialer/Telecom/framework hooks in LOS 23.2 first;
|
||
then decide AXP vs EXTENDROM vs iodé vs native LOS.
|
||
- Screenshot / sensitive-content APIs continue to tighten — verify before
|
||
porting FLAG_SECURE bypasses.
|
||
|
||
---
|
||
|
||
## 7. Checklist before applying an AXP or GOS change on A16
|
||
|
||
1. What problem does it solve on GOLDEN / in GOS docs?
|
||
2. Does LOS 23.2 already provide an equivalent?
|
||
3. Partition + artifact-path impact?
|
||
4. Same-signer / update path impact (microG, Phonesky)?
|
||
5. Kernel 4.14 / sunfish EOL constraints?
|
||
6. If blocked: document blocker; redesign route; **same end state**.
|
||
|
||
---
|
||
|
||
## 8. Open follow-ups (fill as we hit them)
|
||
|
||
- [x] Exact LOS 23.2 spoofing surface for `005` — stock LuK1337 path + our
|
||
`SUNFISH_A16_005_SIGSPOOF` extension (2026-09-15); runbook
|
||
`docs/005-spoofing-runbook.md`
|
||
- [ ] Whether A16 needs any microG permission XML AXP ships outside privapp
|
||
- [ ] RKP/KeyMint behaviour on LAB after `004` (compare to `002` Yuh logs)
|
||
- [ ] Call-recording hook locations on LOS 23.2 Dialer
|
||
- [ ] Which GOS A16 hardening patches are realistic on sunfish 4.14
|
||
|
||
## 9. EXTENDROM A15 → A16 mapping (`005`)
|
||
|
||
| EXTENDROM A15 patch | LOS 23.2 action |
|
||
|---------------------|-----------------|
|
||
| `02`/`06` ComputerEngine FAKE + gate | **Adapt** existing LuK1337 `generateFakeSignature`; add toggle + permission + Phonesky signer |
|
||
| `01`/`12` api current + lint | Applied |
|
||
| `07` AndroidManifest permission | Applied |
|
||
| `03` PermissionMapping | Applied (`.kt` path) |
|
||
| `04` Activity requestPermissions | Applied (A16 short-circuit path context) |
|
||
| `05` Settings.Secure.ALLOW_SIGNATURE_FAKE | Applied |
|
||
| `08`–`11` Settings Developer Options | Applied (controllers + XML + strings) |
|
||
| Overlay strings | Inlined into frameworks/Settings `strings.xml` |
|
||
|
||
Source checkout: `/srv/rom/references/extendrom` @ `f129253c07e735a373441254457cf75efac11d04`.
|
||
|
||
Update this file when a delta is **measured** (build error, Self-Check, adb),
|
||
not from blog speculation alone.
|