AXP-Resurection/specs/005-restricted-signature-spoofing/data-model.md

Data model: 005 spoofing + first-stack entities

GlobalSpoofingToggle

Field	Description
Setting key	settings secure allow_signature_fake (AXP/GOLDEN)
Values	0 / unset = OFF; 1 = ON
Default	OFF
UI	Developer Options → Signature spoofing support → Allow signature spoofing
Effect when OFF	Prior per-app grants ignored (silent deny)

SpoofingPermission

Field	Description
Name	android.permission.FAKE_PACKAGE_SIGNATURE
Protection	dangerous (user-grantable), as on GOLDEN
Grant state	Per package / per user; GOLDEN uses USER_SET for gms + vending
Revoke UI	App permissions → Spoof package signature (AXP strings)

AuthorizedPackage

Package	Signer identity	Notes
com.google.android.gms	Official microG PRESIGNED	System_ext app; F-Droid updates
com.android.vending	Project Phonesky JKS	System priv-app; fake-signature meta-data

Extension of this set requires constitution-aligned review (not open allow-all).

FakeSignatureMetadata

Field	Description
APK meta-data name	fake-signature
Value	Hex-encoded Google platform certificate (injected by AXP patch-playstore)
Consumer	PackageManager spoofing path when permission granted + toggle ON

PackagingArtifacts (first-stack ship)

Artifact	Rule
GmsCore / Gsf / Phonesky APKs	PRESIGNED install without zip-realign strip (REPLACE_PREBUILT)
Phonesky privapp XML	Includes FAKE_PACKAGE + A16 FGS / exact-alarm / Play 52 extras; digest = our cert
Default-permissions / sysconfig	Align with GOLDEN er_* intent (power-save, app-link) as needed

LocationConfig (validation, not a package)

Field	Description
Provider	microG built-in network location (0.3.x)
Endpoint	Ichnaea-compatible URL (BeaconDB: https://api.beacondb.net)
Non-goals	UnifiedNlp backend APKs; Mozilla MLS

State transitions

[Toggle OFF] --enable in Dev Options--> [Toggle ON]
     |                                      |
     v                                      v
 spoof denied                          prompts/grants for
 for all apps                          authorized packages
                                            |
                                            v
                               [Permission granted]
                                            |
                                            v
                         PackageInfo signatures + signingInfo
                         present Google identity to callers