sunfish-admin
12d2179c20
Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.
4.2 KiB
Implementation Plan: Restricted native signature spoofing
Branch: 005-restricted-signature-spoofing | Date: 2026-09-15 | Spec: spec.md
Input: Feature specification from /specs/005-restricted-signature-spoofing/spec.md
Summary
Deliver the first working Google-compat stack on LAB: finish 004 packaging
gates (PRESIGNED replace + Play FGS privapp), add AXP/EXTENDROM-style
restricted signature spoofing (Developer Options allow_signature_fake +
FAKE_PACKAGE_SIGNATURE + allow-list for microG + Phonesky), validate Play auth
/ Self-Check, and document modern microG location (BeaconDB). Do not
pull 006 banking or 007 root into this phase.
Primary technical approach: attribute patches from
EXTENDROM_SIGNATURE_SPOOFING
(A15 proven on GOLDEN) and port to Android 16 / LOS 23.2, ensuring both
legacy PackageInfo.signatures and modern signingInfo are spoofed.
Technical Context
Language/Version: Android frameworks Java/Kotlin patches; Settings overlays;
Android.mk / product makefiles; bash runbooks on rom-dev01
Primary Dependencies: LOS 23.2 tree; EXTENDROM/AXP sigspoof patches (A15 →
A16 port); microG 0.3.x; project-signed Phonesky; GOLDEN 2026-09-15 capture
Storage: Host /srv/rom/ prebuilts + secrets; meta-repo vendor/sunfish-a16/
Testing: LAB flash only; settings/pm/dumpsys; microG Self-Check;
Play login logcat; optional BeaconDB location smoke
Target Platform: Pixel 4a LAB 11231JEC207477; Android 16 / LOS 23.2
Project Type: Android ROM frameworks + Settings + packaging overlay
Performance Goals: N/A (correctness / compatibility)
Constraints: LAB only; no GOLDEN modify; no Magisk/KSU; restricted allow-list;
attributable patches; no proprietary APKs in Git
Scale/Scope: frameworks/base (+ services) spoofing; Settings Developer
Options; privapp/default/sysconfig XML updates; one bacon + LAB flash; docs
Constitution Check
GATE: Must pass before Phase 0 research. Re-check after Phase 1 design.
| Gate | Status |
|---|---|
| LAB only; never GOLDEN | pass |
| Spoofing native, restricted, auditable; no LSPosed | pass (FR-003/006) |
| Prefer package/signer allow-list over open fake-signature | pass |
| Works without optional root | pass (FR-006, US5) |
| Prefer AXP/EXTENDROM behaviour; A16 port if needed | pass |
| No proprietary APKs in Git | pass |
| Small attributable changes | pass (patch series from EXTENDROM/AXP) |
Do not invent 006/007 into this feature |
pass (spec Out of Scope) |
Post-design: unchanged — design stays spoofing + first-stack ship gates.
Project Structure
Documentation (this feature)
specs/005-restricted-signature-spoofing/
├── plan.md
├── research.md
├── data-model.md
├── quickstart.md
├── contracts/
│ └── spoofing-surface.md
└── tasks.md # via /speckit-tasks (not this command)
Host + tree
# Meta repo
vendor/sunfish-a16/ # packaging (REPLACE, privapp XML, gms.mk)
docs/a15-a16-delta.md
docs/004-*.md # packaging/selfcheck (update for BeaconDB)
.local-artifacts/002-golden/20260915-spoofing-phonesky/ # oracle
# rom-dev01
/srv/rom/src/lineage/frameworks/base/ # spoofing patches
/srv/rom/src/lineage/packages/apps/Settings/ # Developer Options toggle
/srv/rom/references/… or vendor/extendrom/ # patch source (checkout as needed)
/srv/rom/artifacts/005-…/ # validation zip + evidence
Structure Decision: Continue vendor/sunfish-a16 packaging overlay; apply
spoofing as attributable patch series under the LOS tree on rom-dev01 (not a
megapatch in Git). Meta-repo holds vendor stubs, docs, and specs only.
Complexity Tracking
| Violation | Why needed | Simpler alternative rejected because |
|---|---|---|
| Frameworks patches | LOS 23.2 has no FAKE_PACKAGE | Magisk/LSPosed forbidden by constitution |
Phase 0 / Phase 1
See research.md, data-model.md, contracts/spoofing-surface.md, quickstart.md.