sunfish-admin
12d2179c20
Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.
60 lines
1.9 KiB
Markdown
60 lines
1.9 KiB
Markdown
# Contract: Spoofing surface (LAB / user-visible)
|
||
|
||
## Settings
|
||
|
||
| Interface | Contract |
|
||
|-----------|----------|
|
||
| Secure setting | `allow_signature_fake` ∈ {`null`/`0`, `1`} |
|
||
| Readback | `adb shell settings get secure allow_signature_fake` |
|
||
| UI | Developer Options exposes enable/disable; OFF disables effect of grants |
|
||
|
||
## Permission
|
||
|
||
| Interface | Contract |
|
||
|-----------|----------|
|
||
| Permission name | `android.permission.FAKE_PACKAGE_SIGNATURE` |
|
||
| `pm list permissions` | Permission is listed (not “Unknown permission”) |
|
||
| Grant | Visible in `dumpsys package <pkg>` for authorized packages when user granted |
|
||
|
||
## PackageManager behaviour
|
||
|
||
When **toggle ON** and package **has grant** and **has** `meta-data fake-signature`
|
||
(or microG’s equivalent spoof path):
|
||
|
||
- Callers using legacy signature APIs and signing-certificate APIs MUST observe
|
||
the faked Google identity for that package (sufficient for microG Self-Check
|
||
“correct signature” and Play OAuth registration checks).
|
||
|
||
When **toggle OFF**:
|
||
|
||
- Effective spoofing MUST NOT occur (silent deny).
|
||
|
||
## Allow-list
|
||
|
||
| Package | Required |
|
||
|---------|----------|
|
||
| `com.google.android.gms` | yes |
|
||
| `com.android.vending` | yes |
|
||
| Other packages | denied unless explicitly added later under project policy |
|
||
|
||
## First-stack package registration
|
||
|
||
| Package | `pm path` expectation |
|
||
|---------|----------------------|
|
||
| `com.google.android.gms` | system_ext app path |
|
||
| `com.google.android.gsf` | system_ext app path |
|
||
| `com.android.vending` | system priv-app Phonesky path |
|
||
|
||
PRESIGNED APKs in the shipped image MUST verify with APK Signature Scheme v2/v3
|
||
(no post-sign strip).
|
||
|
||
## Location (documentation contract)
|
||
|
||
Quickstart MUST specify:
|
||
|
||
1. Open microG → Location
|
||
2. Enable network/Wi-Fi location as required by UI
|
||
3. Set service URL to BeaconDB (or documented successor), not MLS
|
||
|
||
No requirement to install UnifiedNlp backend packages.
|