0 Fork 0

Files

T

sunfish-adminandCursor 2d145c2878 009: Polish bacon fixes, OTA host scripts, and migration docs.

Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding
and rebuild/sync helpers; document device roles, laptop migration, and Gitea.

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-10-16 21:06:45 +02:00

3.5 KiB

Raw Blame History

009 AXP LOS23 port — patch / packaging README

Track: Magisk AXP resurrection on LOS 23.2 sunfish (AXP_Resurection).
Not ship: KernelSU / SusFS (007 standby / optional recycle only).

Apply order (host tree under `/srv/rom/src/lineage/`)

Google stack — vendor/sunfish-a16/gms.mk + Android.mk (microG, GSF, Phonesky). Host APKs: /srv/rom/prebuilts/{microg,phonesky}/ (never Git).
Signature spoofing — vendor/sunfish-a16/patches/005-sigspoof/ (apply_005_sigspoof.py). Attribute: LOS restricted spoofing + AXP/005.
Call recording unlock — vendor/sunfish-a16/patches/008-call-rec-flag-secure/ (extendrom_call_recording). Attribute: EXTENDROM F_CALLREC.
Magisk preroot — EXTENDROM-class boot/init_boot patch using Magisk APK from /srv/rom/prebuilts/magisk/ (see docs/009-magisk-preinstall-runbook.md). Stub: vendor/sunfish-a16/magisk.mk. Attribute: Magisk upstream + sfX extendrom Magisk patcher. Shipped on LAB (2026-10): Magisk 30.7 preroot via host EXTENDROM at /srv/rom/references/extendrom/ (wired by the ship bacon). Do not treat the old “blocked on T011” note as current.
Bundled apps — /srv/rom/prebuilts/axp-apps/ + apps.mk (Aurora, Droidify, Fossify Gallery). Symlink APKs into vendor/sunfish-a16/prebuilt/.
Private DNS presets — apply_009_private_dns_providers.py (GOLDEN list).
Internet connectivity check — apply_009_connectivity_check.py (GOLDEN list minus AXP.OS / axpos.org).
Disable for user apps — apply_009_disable_user_apps.py (SPA gate).
Userspace hardening / signing — staged: see signing/README.md, hardening/README.md (US-S4-1 OpenSSH trim), and docs/009-hardening-signing-checklist.md (US-S1 keys → US-S2 wire → US-S3 AVB → US-S4+ harden). Bootloader lock = wont.
Kernel hardening — LOS23 msm-4.14 + map in docs/009-kernel-hardening-map.md (FR-017). Stage 1: vendor/sunfish-a16/patches/009-kernel-hardening/apply_stage1.sh (AXP Graphene/AH allowlist). Priority: AXP → LOS → Iodé → optional Graphene; no Divest hunt; no extra location lockdown.
2026-10-16 polish (ship bacon) — apply_009_euicc_disabler_guard.py, apply_009_thermal_cdev_log.py; wave4 apply_009_drop_lab_only_commands.py must keep/restore disable_configstore. Details: docs/009-lab-polish-20261016.md.

Product includes

Wire Magisk-resurrection product from vendor/sunfish-a16/ into lineage_sunfish (same pattern as 004/005). Keep Phonesky priv-app path. No FakeStore. No KernelSU product packages.

Deferred

Banking Gate E / Island validation (owner future).
Localization AXP-vs-LOS compare (docs/009-localization-axp-vs-los.md stub).

Host paths (rom-dev01)

What	Path
Magisk APK	`/srv/rom/prebuilts/magisk/Magisk-v30.7.apk`
EXTENDROM Magisk patcher	`/srv/rom/references/extendrom/config/magisk/`
Kernel source	`/srv/rom/src/lineage/kernel/google/msm-4.14`
Product include (gms)	`device/google/sunfish/lineage_sunfish.mk` → `vendor/sunfish-a16/gms.mk`
Vanilla baseline	`/srv/rom/artifacts/003-vanilla/20260914-lineage-23.2-sunfish/`
Optional KSU boots	`/srv/rom/artifacts/007-kernelsu/` (non-ship)

Host wiring (current): EXTENDROM Magisk patcher lives under /srv/rom/references/extendrom/ and is invoked by scripts/009-bacon-axp-stage1-combo4-cve-hi-releasekeys.sh. Magisk APK pin: /srv/rom/prebuilts/magisk/Magisk-v30.7.apk.

3.5 KiB Raw Blame History