sunfish-admin
12d2179c20
Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.
265 lines
10 KiB
Markdown
265 lines
10 KiB
Markdown
# Tasks: Restricted native signature spoofing (first working stack)
|
||
|
||
**Input**: Design docs from `/specs/005-restricted-signature-spoofing/`
|
||
**Prerequisites**: `004` packaging on LAB (Phonesky present); GOLDEN oracle
|
||
`.local-artifacts/002-golden/20260915-spoofing-phonesky/`; constitution spoofing rules
|
||
|
||
**Organization**: First working stack = packaging leftovers + spoofing + BeaconDB.
|
||
**Out of scope**: `006` banking, `007` KSU/root.
|
||
|
||
## Format: `[ID] [P?] [Story] Description`
|
||
|
||
- **[P]**: Can run in parallel (different files, no incomplete deps)
|
||
- **[Story]**: US1…US6 from `spec.md`
|
||
|
||
## Path conventions
|
||
|
||
- Meta repo: `vendor/sunfish-a16/`, `docs/`, `specs/005-…/`
|
||
- Build host: `/srv/rom/src/lineage/` (frameworks, Settings), `/srv/rom/artifacts/005-…/`
|
||
|
||
---
|
||
|
||
## Phase 1: Setup
|
||
|
||
**Purpose**: Patch sources, dirs, delta notes
|
||
|
||
- [x] T001 Checkout / mirror EXTENDROM sigspoof sources on `rom-dev01` under
|
||
`/srv/rom/references/extendrom/` (or sparse clone
|
||
`sfX-android/android_vendor_extendrom`); record commit in
|
||
`docs/a15-a16-delta.md`
|
||
*(2026-09-15: `f129253c…`; also found stock LuK1337 spoof in LOS tree)*
|
||
- [x] T002 [P] Create `/srv/rom/artifacts/005-spoofing/` and
|
||
`/srv/rom/logs/005-build/` (android-build writable)
|
||
- [x] T003 [P] Add `docs/005-spoofing-runbook.md` stub (EXTENDROM port steps,
|
||
allow-list, LAB-only) in meta repo
|
||
- [x] T004 [P] Confirm working-tree packaging leftovers present:
|
||
`vendor/sunfish-a16/Android.mk` has `LOCAL_REPLACE_PREBUILT_APK_INSTALLED`;
|
||
`vendor/sunfish-a16/permissions/privapp-permissions-com.android.vending.xml`
|
||
has FGS/exact-alarm + Play 52 entries — sync both to
|
||
`/srv/rom/src/lineage/vendor/sunfish-a16/`
|
||
|
||
---
|
||
|
||
## Phase 2: Foundational (blocks all stories)
|
||
|
||
**Purpose**: A16-portable spoofing patch set + product wiring; no bacon yet
|
||
|
||
**⚠️ CRITICAL**: No US validation flash until this phase completes
|
||
|
||
- [x] T005 Inventory EXTENDROM A15 patch list vs LOS 23.2 paths; write mapping
|
||
table in `docs/a15-a16-delta.md` (frameworks/base, services, Settings,
|
||
overlays)
|
||
- [x] T006 Apply / port EXTENDROM signature-spoofing patches to
|
||
`/srv/rom/src/lineage/frameworks/base/` so
|
||
`android.permission.FAKE_PACKAGE_SIGNATURE` exists and
|
||
`meta-data fake-signature` is honoured for **both**
|
||
`PackageInfo.signatures` and `PackageInfo.signingInfo`
|
||
*(extended LuK1337 path via `apply_005_sigspoof.py`)*
|
||
- [x] T007 Wire global gate `settings secure allow_signature_fake` in
|
||
PackageManager path under
|
||
`/srv/rom/src/lineage/frameworks/base/services/` (silent deny when off)
|
||
- [x] T008 Restrict effective spoofing to allow-list packages/signers
|
||
(`com.google.android.gms` official microG; `com.android.vending` project
|
||
Phonesky digest
|
||
`31:31:86:CB:7D:F2:D4:01:33:72:12:07:B7:29:73:E8:52:F6:1C:87:67:C3:21:E5:C7:50:39:01:1B:83:BD:56`)
|
||
— document mechanism in `docs/005-spoofing-runbook.md`
|
||
- [x] T009 [P] Update Phonesky privapp/default XMLs in
|
||
`vendor/sunfish-a16/permissions/` to include `FAKE_PACKAGE_SIGNATURE` and
|
||
bind Phonesky entries to **our** cert SHA-256 digest (not AXP
|
||
`00:5C:98:…`); sync to host tree
|
||
*(FAKE_PACKAGE already in privapp; digest enforced in ComputerEngine)*
|
||
- [ ] T010 [P] Align GmsCore-related default-permissions / sysconfig intent from
|
||
GOLDEN `er_*` files into `vendor/sunfish-a16/` (power-save / app-link as
|
||
needed) without inventing GmsCore priv-app
|
||
|
||
**Checkpoint**: Foundation ready — bacon is next (US6)
|
||
|
||
---
|
||
|
||
## Phase 3: User Story 1 — Developer Options master switch (P1) 🎯 MVP slice
|
||
|
||
**Goal**: Toggle **Allow signature spoofing** in Developer Options
|
||
**Independent test**: UI present; `settings get secure allow_signature_fake` is
|
||
`1` when ON; OFF disables effect
|
||
|
||
- [x] T011 [US1] Port EXTENDROM/AXP Settings Developer Options strings +
|
||
preference for `allow_signature_fake` into
|
||
`/srv/rom/src/lineage/packages/apps/Settings/` (or overlay under
|
||
`vendor/sunfish-a16/`) matching GOLDEN UX
|
||
(`signature_spoof_category` / Allow signature spoofing)
|
||
- [ ] T012 [US1] Verify default is OFF; toggling ON/OFF persists across reboot
|
||
(device proof after US6 flash)
|
||
|
||
**Checkpoint**: US1 code landed in tree (validated on device in US6 flash)
|
||
|
||
---
|
||
|
||
## Phase 4: User Story 4 — Restricted allow-list only (P1)
|
||
|
||
**Goal**: Non-authorized apps cannot effectively spoof
|
||
**Independent test**: Third-party test APK requesting FAKE_PACKAGE denied
|
||
|
||
- [ ] T013 [US4] Add allow-list enforcement tests/notes in
|
||
`docs/005-spoofing-runbook.md` (manual LAB procedure + expected deny)
|
||
- [ ] T014 [US4] Confirm implementation from T008 rejects non-listed packages
|
||
even with toggle ON (code review + LAB check after flash)
|
||
|
||
**Checkpoint**: Policy documented; enforcement in PMS path
|
||
|
||
---
|
||
|
||
## Phase 5: User Story 2 — Self-Check correct signatures (P1)
|
||
|
||
**Goal**: microG Self-Check marks correct signature for GmsCore + Phonesky
|
||
**Independent test**: Self-Check screenshots after grants
|
||
|
||
- [ ] T015 [US2] Ensure grant path works (permission UI / Self-Check tap) —
|
||
no missing `GrantFakeSignaturePermissionActivity` / unknown permission
|
||
- [ ] T016 [US2] Update `docs/004-lab-selfcheck.md` with spoofing steps and
|
||
expected green signature rows (post-`005`)
|
||
|
||
**Checkpoint**: Self-Check contract ready; device proof in US6
|
||
|
||
---
|
||
|
||
## Phase 6: User Story 3 — Play auth without API-console mismatch (P1)
|
||
|
||
**Goal**: Play sign-in without `UNREGISTERED_ON_API_CONSOLE`
|
||
**Independent test**: logcat during login
|
||
|
||
- [ ] T017 [US3] Document auth verification commands in
|
||
`specs/005-restricted-signature-spoofing/quickstart.md` (already drafted —
|
||
tighten failure signatures)
|
||
- [ ] T018 [US3] After flash (US6), capture logcat proving absence of
|
||
`UNREGISTERED_ON_API_CONSOLE` for Phonesky; store under
|
||
`/srv/rom/artifacts/005-spoofing/`
|
||
|
||
**Checkpoint**: Auth acceptance tied to US6 validation build
|
||
|
||
---
|
||
|
||
## Phase 7: User Story 5 — Survives without root (P2)
|
||
|
||
**Goal**: Spoofing works with no Magisk/KSU
|
||
**Independent test**: build props / `pm` show no Magisk
|
||
|
||
- [ ] T019 [US5] Confirm `005` product makefiles do not pull Magisk/KSU; note in
|
||
`docs/005-spoofing-runbook.md` and gate handoff
|
||
|
||
---
|
||
|
||
## Phase 8: User Story 6 — First working stack ship gate (P1)
|
||
|
||
**Goal**: One zip = REPLACE packaging + FGS privapp + spoofing; BeaconDB docs
|
||
**Independent test**: `quickstart.md` end-to-end on LAB
|
||
|
||
- [x] T020 [US6] `mka bacon -j8` on `rom-dev01`; log
|
||
`/srv/rom/logs/005-build/bacon.log`; verify intermediate Phonesky APK
|
||
`apksigner verify` (v2/v3) under `out/target/product/sunfish/`
|
||
*(SUCCESS 2026-09-15T14:27Z, 03:49:11; log
|
||
`bacon-20260915T103756Z.log`; zip SHA256
|
||
`1f08e00433e073e0b6525eb2539fe9011a291f34604a6917bf1836aecf03e383`;
|
||
Phonesky v2+v3 OK)*
|
||
- [x] T021 [US6] Stage zip + imgs + SHA256 + VERSIONS + spoofing notes to
|
||
`/srv/rom/artifacts/005-spoofing/<date>/` and rsync to
|
||
`.local-artifacts/005-spoofing/`
|
||
*(host `…/20260915-bacon/`; laptop got SHA+triage+packaging-check;
|
||
full zip remains on host)*
|
||
- [x] T022 [US6] Flash LAB only (`11231JEC207477`); confirm
|
||
`pm path` for gms/gsf/vending without remount
|
||
*(gms/gsf `/system_ext/…`; vending from zip then exact-alarm
|
||
`adb install -r` → `/data/app/…` until next bacon)*
|
||
- [x] T023 [US6] Enable spoofing toggle; grant FAKE_PACKAGE to gms + vending;
|
||
Self-Check correct signature green
|
||
*(`allow_signature_fake=1`; user 0+10 grants; operator Self-Check pass)*
|
||
- [x] T024 [US6] Play sign-in smoke; confirm no FGS VpaService crash loop; record
|
||
update-still-blocked as acceptable
|
||
*(installs OK both profiles after exact-alarm; UNREGISTERED count=0)*
|
||
- [x] T025 [P] [US6] Document BeaconDB location steps in
|
||
`docs/004-lab-selfcheck.md` + `quickstart.md` (URL
|
||
`https://api.beacondb.net`; no UnifiedNlp backends)
|
||
- [x] T026 [US6] Run full `specs/005-restricted-signature-spoofing/quickstart.md`
|
||
checklist; tick SC-001…SC-008
|
||
*(evidence `/srv/rom/artifacts/005-spoofing/20260915-us6-validation/`)*
|
||
|
||
**Checkpoint**: First working stack accepted on LAB
|
||
|
||
---
|
||
|
||
## Phase 9: Polish
|
||
|
||
- [x] T027 [P] Update `docs/axp-pro-parity.md` spoofing + microG/Phonesky rows
|
||
- [x] T028 [P] Finalize `docs/a15-a16-delta.md` with A15→A16 spoofing port notes
|
||
- [x] T029 Handoff: first stack done; next `006` banking rootless — **no** KSU
|
||
until after `006`
|
||
- [x] T030 Mark remaining `004` tasks superseded/closed where `005` US6 covered
|
||
them (`specs/004-microg-phonesky-integration/tasks.md` notes)
|
||
|
||
---
|
||
|
||
## Dependencies & Execution Order
|
||
|
||
### Phase dependencies
|
||
|
||
- Phase 1 → Phase 2 (foundational patches) → US1/US4 code → US2/US3/US5 docs →
|
||
**US6 build/flash validates everything**
|
||
- US6 is the integration gate; US1–US5 implementation lands before bacon when
|
||
possible, device proof in US6
|
||
|
||
### User story dependencies
|
||
|
||
| Story | Depends on |
|
||
|-------|------------|
|
||
| US1 toggle | T005–T007 (+ T011 Settings) |
|
||
| US4 allow-list | T008 |
|
||
| US2 Self-Check | T006–T009, US1 toggle |
|
||
| US3 Play auth | US2 grants working |
|
||
| US5 no root | Product wiring (Phase 2) |
|
||
| US6 ship | All above + T004 packaging |
|
||
|
||
### Parallel opportunities
|
||
|
||
- T002, T003, T004 after T001 started
|
||
- T009, T010 while T006–T008 in progress (XML vs frameworks)
|
||
- T025 docs parallel with T020 build
|
||
- T027, T028 polish parallel
|
||
|
||
---
|
||
|
||
## Parallel example: Foundational
|
||
|
||
```text
|
||
T009 Update Phonesky privapp digest + FAKE_PACKAGE in vendor/sunfish-a16/permissions/
|
||
T010 Align GmsCore sysconfig/default-permissions stubs in vendor/sunfish-a16/
|
||
T006 Port frameworks FAKE_PACKAGE + signingInfo spoof in frameworks/base/
|
||
```
|
||
|
||
---
|
||
|
||
## Implementation strategy
|
||
|
||
### MVP
|
||
|
||
1. Phase 1–2 (patches + XML)
|
||
2. US1 Settings toggle
|
||
3. US6 bacon + LAB flash proving toggle + Self-Check + Play auth
|
||
|
||
### Incremental
|
||
|
||
After MVP flash: tighten allow-list evidence (US4), BeaconDB doc polish (T025),
|
||
parity docs (T027–T029).
|
||
|
||
### Suggested first implement slice
|
||
|
||
**T001 → T004 → T005–T011 → T020–T026** (skip polish until green Self-Check).
|
||
|
||
---
|
||
|
||
## Notes
|
||
|
||
- Never flash GOLDEN; LAB serial only
|
||
- No Magisk/KSU in this feature
|
||
- Do not reintroduce UnifiedNlp backend APKs
|
||
- Prefer EXTENDROM attributable patches; record conflicts in delta doc
|
||
- User owns git commit/MR; agents only working tree / host build dirs
|