AXP-Resurection/specs/005-restricted-signature-spoofing/contracts/spoofing-surface.md

Contract: Spoofing surface (LAB / user-visible)

Settings

Interface	Contract
Secure setting	allow_signature_fake ∈ {null/0, 1}
Readback	adb shell settings get secure allow_signature_fake
UI	Developer Options exposes enable/disable; OFF disables effect of grants

Permission

Interface	Contract
Permission name	android.permission.FAKE_PACKAGE_SIGNATURE
pm list permissions	Permission is listed (not “Unknown permission”)
Grant	Visible in dumpsys package <pkg> for authorized packages when user granted

PackageManager behaviour

When toggle ON and package has grant and has meta-data fake-signature (or microG’s equivalent spoof path):

• Callers using legacy signature APIs and signing-certificate APIs MUST observe the faked Google identity for that package (sufficient for microG Self-Check “correct signature” and Play OAuth registration checks).

When toggle OFF:

• Effective spoofing MUST NOT occur (silent deny).

Allow-list

Package	Required
com.google.android.gms	yes
com.android.vending	yes
Other packages	denied unless explicitly added later under project policy

First-stack package registration

Package	pm path expectation
com.google.android.gms	system_ext app path
com.google.android.gsf	system_ext app path
com.android.vending	system priv-app Phonesky path

PRESIGNED APKs in the shipped image MUST verify with APK Signature Scheme v2/v3 (no post-sign strip).

Location (documentation contract)

Quickstart MUST specify:

1. Open microG → Location
2. Enable network/Wi-Fi location as required by UI
3. Set service URL to BeaconDB (or documented successor), not MLS

No requirement to install UnifiedNlp backend packages.