AXP-Resurection/docs/005-spoofing-runbook.md

005 — Restricted signature spoofing runbook

Feature: 005-restricted-signature-spoofing
LAB only: serial 11231JEC207477 — never GOLDEN
Host: rom-dev01 under /srv/rom/

What we discovered (2026-09-15)

LineageOS 23.2 already ships restricted microG spoofing (frameworks/base commit 23c0a5c19844, LuK1337):

Gate	Stock LOS behaviour
Build	userdebug/eng only (isDebuggable() JNI)
Packages	com.google.android.gms, com.android.vending only
Signer	Must match microG release cert (MICROG_REAL_SIGNATURE)
Fake value	Must equal platform Google cert (MICROG_FAKE_SIGNATURE)
Surfaces	Spoofs both PackageInfo.signatures and signingInfo

Gaps vs our stack / AXP UX:

1. Our Phonesky is signed with the project JKS, not microG — stock gate rejected it → Play UNREGISTERED_ON_API_CONSOLE.
2. No FAKE_PACKAGE_SIGNATURE permission → microG Self-Check permission rows empty.
3. No Developer Options master switch (allow_signature_fake).

What we applied

Script (idempotent, marker SUNFISH_A16_005_SIGSPOOF):

• Meta: vendor/sunfish-a16/patches/005-sigspoof/apply_005_sigspoof.py
• Host copy: /srv/rom/src/lineage/vendor/sunfish-a16/patches/005-sigspoof/
• References: /srv/rom/references/extendrom @ f129253c…
• Cert hex: /srv/rom/artifacts/005-spoofing/phonesky-cert.hex (SHA-256 31:31:86:CB:…:BD:56)

Changes on the LOS tree:

1. Extend isMicrogSigned() to accept project Phonesky signer for com.android.vending.
2. Gate spoofing on Settings.Secure.allow_signature_fake (default 0).
3. Require grant of android.permission.FAKE_PACKAGE_SIGNATURE.
4. Port EXTENDROM permission + Settings Developer Options toggle + strings.
5. Keep packaging leftovers: LOCAL_REPLACE_PREBUILT_APK_INSTALLED + Play FGS privapp XML (already in vendor/sunfish-a16/).

LAB 2026-09-15 post-flash: Self-Check / spoofing / no UNREGISTERED_ON_API_CONSOLE OK. Play install failures / ANR: DownloadService /VpaService FGS systemExempted needs any of SCHEDULE_EXACT_ALARM / USE_EXACT_ALARM / VPN — privapp alone is not enough if the APK does not request those permissions.

Fix (2026-09-15): Phonesky rebuild adds USE_EXACT_ALARM + SCHEDULE_EXACT_ALARM to the manifest; artifact /srv/rom/artifacts/005-spoofing/Phonesky_exact-alarm.apk; pushed to LAB via adb install -r (same project JKS); vendor prebuilt updated under /srv/rom/src/lineage/vendor/sunfish-a16/prebuilt/Phonesky.apk for next bacon. USE_EXACT_ALARM: granted=true on LAB after upgrade.

Re-apply after repo sync that resets frameworks/Settings:

python3 /srv/rom/src/lineage/vendor/sunfish-a16/patches/005-sigspoof/apply_005_sigspoof.py

Backups: /srv/rom/artifacts/005-spoofing/bak-snapshots/ (never leave *.005.bak under res/ — aapt2 will fail).

LAB validation (US6 — 2026-09-15)

Accepted on LAB 11231JEC207477 / build 23.2-20260915-UNOFFICIAL-sunfish. Evidence: /srv/rom/artifacts/005-spoofing/20260915-us6-validation/LAB-US6.txt.

1. Flash LAB; pm path gms / gsf / vending — pass
2. Allow signature spoofing — allow_signature_fake=1
3. Self-Check correct signature — pass (grant on user 0 + Island 10)
4. Play sign-in / installs — pass after exact-alarm Phonesky; no UNREGISTERED_ON_API_CONSOLE
5. Location: configure BeaconDB https://api.beacondb.net (no UnifiedNlp) — steps in docs/004-lab-selfcheck.md + quickstart.md

adb -s 11231JEC207477 shell settings get secure allow_signature_fake
# expect 1 when enabled

Handoff: first stack done → next feature 006 banking rootless. Do not add KernelSU/007 until after 006.

Out of scope

• Banking apps (006), KSU/root (007), Magisk/LSPosed.