sunfish-adminandCursor
3f941e8451
Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path, and adds deblob appliers plus tests; docs capture Swissquote fix and parity. Co-authored-by: Cursor <cursoragent@cursor.com>
31 lines
926 B
Makefile
31 lines
926 B
Makefile
# US-S4 — userspace hardening (AXP Resurection Pro).
|
|
# Match AXP.OS PRO sunfish product surface (see hardening/README.md +
|
|
# docs/009-axp-pro-product-apps-20260324.md).
|
|
#
|
|
# Real strips:
|
|
# US-S4-1 apply_009_drop_openssh_packages.py (common.mk)
|
|
# US-S4-2 Jelly stays (owner 2026-10-07). LOS 23 does not put it in
|
|
# common_mobile.mk, so it is added here. Gallery is FossifyGallery,
|
|
# not Gallery2 or Glimpse. Do not put Gallery2 back.
|
|
# PRODUCT_PACKAGES filter-out via inherit alone has failed before — keep as
|
|
# belt-and-suspenders only.
|
|
|
|
PRODUCT_PACKAGES := $(filter-out \
|
|
scp \
|
|
sftp \
|
|
ssh \
|
|
sshd \
|
|
sshd_config \
|
|
ssh-keygen \
|
|
start-ssh \
|
|
rsync \
|
|
Gallery2 \
|
|
Glimpse \
|
|
,$(PRODUCT_PACKAGES))
|
|
|
|
PRODUCT_PACKAGES += Jelly
|
|
|
|
PRODUCT_PACKAGES_DEBUG := $(filter-out procmem,$(PRODUCT_PACKAGES_DEBUG))
|
|
|
|
# Keep init.openssh.rc — AXP PRO still ships it (mkdir /data/ssh* only).
|