sunfish-admin
12d2179c20
Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.
4.3 KiB
Research: 005 restricted signature spoofing
Decision: First working stack = 004 leftovers + spoofing + modern location
Decision: Ship one LAB validation build that includes (1) unfinished 004
packaging fixes, (2) restricted spoofing, (3) BeaconDB location docs — and
exclude 006 banking and 007 root.
Rationale: Owner: first phase that must work is microG + patched Play + spoofing. Banking/root are later regressions.
Alternatives considered: Separate tiny 004b rebuild only — rejected;
wastes a flash cycle before spoofing lands. Pulling 006 early — rejected;
blocks focus.
Decision: Spoofing implementation source = EXTENDROM / AXP (port to A16)
Decision: Use EXTENDROM_SIGNATURE_SPOOFING
as the attributable primary source (matches GOLDEN behaviour:
allow_signature_fake, Developer Options, per-app FAKE_PACKAGE_SIGNATURE).
Port patches from the closest supported Android line (A15 is STABLE/tested;
GOLDEN is A15) onto A16 / LOS 23.2.
Rationale: Stock LOS 23.2 tree on rom-dev01 has no
FAKE_PACKAGE_SIGNATURE / allow_signature_fake (inventory 2026-09-15). AXP
GOLDEN proves the UX and setting key. Old android_signature_spoofing repo is
obsolete per upstream.
Alternatives considered:
| Option | Why not |
|---|---|
| lineageos4microg unrestricted spoof | Constitution forbids open spoofing |
| Magisk / LSPosed FakeGApps | Forbidden; rootless Compatibility MVP |
| Wait for LOS to grow A16 EXTENDROM dir | Blocks first stack; we port ourselves |
A16 note: EXTENDROM wiki table lists A15, not A16. Expect conflict resolution
(repo diff / split patches) per EXTENDROM porting guide. Record deltas in
docs/a15-a16-delta.md.
Decision: Must spoof signingInfo, not only signatures[]
Decision: Implementation MUST spoof both legacy PackageInfo.signatures and
modern PackageInfo.signingInfo (GET_SIGNING_CERTIFICATES).
Rationale: microG #2680 / EXTENDROM #48 — Google/Play check signingInfo on
modern Android; Self-Check “correct signature” fails if only legacy arrays are
faked. LOS Gerrit has A13–A15 fixes; ensure A16 port includes equivalent.
Decision: Allow-list = microG GmsCore + project Phonesky
Decision: Effective spoofing limited to:
com.google.android.gms— official microG signer (73aaa390…short on GOLDEN)com.android.vending— project Phonesky JKS
SHA-256 digest
31:31:86:CB:7D:F2:D4:01:33:72:12:07:B7:29:73:E8:52:F6:1C:87:67:C3:21:E5:C7:50:39:01:1B:83:BD:56
Privapp/default XMLs that bind by cert digest MUST use our digest (not
AXP’s 00:5C:98:05:…).
Rationale: Constitution + GOLDEN grants; AXP er_* XMLs bind Phonesky by
digest.
Decision: Global toggle default OFF
Decision: allow_signature_fake defaults to disabled; user enables in
Developer Options (AXP setup guide).
Rationale: Matches oracle docs and reduces surprise attack surface.
Decision: 004 packaging leftovers are a 005 ship gate
Decision: Before declaring 005 done, the flashable zip MUST include:
LOCAL_REPLACE_PREBUILT_APK_INSTALLEDfor GmsCore/Gsf/Phonesky (already in working-treevendor/sunfish-a16/Android.mk)- Phonesky privapp extras for Play 52 / A16 FGS:
FOREGROUND_SERVICE_SYSTEM_EXEMPTED,SCHEDULE_EXACT_ALARM/USE_EXACT_ALARM, plus prior grammatical/status-bar entries
Rationale: Measured LAB failures — PRESIGNED strip → no pm path; missing
FGS allowlist → VpaService/DownloadService crash. Remount pushes are not the
shipped artifact.
Decision: Modern location = BeaconDB (not UnifiedNlp backends)
Decision: Document configuring microG Location to use an Ichnaea-compatible
URL (https://api.beacondb.net or documented successor). Do not package
Déjà Vu / Nominatim NLP / MLS apps.
Rationale: microG 0.3.x dropped UnifiedNlp backends; MLS retired (2025); GOLDEN also has no NLP backend packages. Owner wants modern stack.
Alternatives considered: Ship UnifiedNlp backends — rejected (obsolete for 0.3.x primary path).
Decision: Out of scope remains 006/007
Decision: No Insular/banking hard-gates; no KSU/SusFS in this feature’s acceptance.
Rationale: Owner confirmation 2026-09-15 — first phase is microG + Play + spoofing only.