sunfish-adminandCursor
3f941e8451
Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path, and adds deblob appliers plus tests; docs capture Swissquote fix and parity. Co-authored-by: Cursor <cursoragent@cursor.com>
94 lines
3.9 KiB
Markdown
94 lines
3.9 KiB
Markdown
# 005 — Restricted signature spoofing runbook
|
|
|
|
**Feature**: `005-restricted-signature-spoofing`
|
|
**LAB only**: serial `11231JEC207477` — never GOLDEN
|
|
**Host**: `rom-dev01` under `/srv/rom/`
|
|
|
|
## What we discovered (2026-09-15)
|
|
|
|
LineageOS 23.2 **already** ships restricted microG spoofing
|
|
(`frameworks/base` commit `23c0a5c19844`, LuK1337):
|
|
|
|
| Gate | Stock LOS behaviour |
|
|
|------|---------------------|
|
|
| Build | `userdebug`/`eng` only (`isDebuggable()` JNI) |
|
|
| Packages | `com.google.android.gms`, `com.android.vending` only |
|
|
| Signer | Must match **microG release** cert (`MICROG_REAL_SIGNATURE`) |
|
|
| Fake value | Must equal platform Google cert (`MICROG_FAKE_SIGNATURE`) |
|
|
| Surfaces | Spoofs both `PackageInfo.signatures` and `signingInfo` |
|
|
|
|
Gaps vs our stack / AXP UX:
|
|
|
|
1. **Our Phonesky** is signed with the **project JKS**, not microG — stock
|
|
gate rejected it → Play `UNREGISTERED_ON_API_CONSOLE`.
|
|
2. No `FAKE_PACKAGE_SIGNATURE` permission → microG Self-Check permission rows
|
|
empty.
|
|
3. No Developer Options master switch (`allow_signature_fake`).
|
|
|
|
## What we applied
|
|
|
|
Script (idempotent, marker `SUNFISH_A16_005_SIGSPOOF`):
|
|
|
|
- Meta: `vendor/sunfish-a16/patches/005-sigspoof/apply_005_sigspoof.py`
|
|
- Host copy: `/srv/rom/src/lineage/vendor/sunfish-a16/patches/005-sigspoof/`
|
|
- References: `/srv/rom/references/extendrom` @ `f129253c…`
|
|
- Cert hex: `/srv/rom/artifacts/005-spoofing/phonesky-cert.hex`
|
|
(SHA-256 `31:31:86:CB:…:BD:56`)
|
|
|
|
Changes on the LOS tree:
|
|
|
|
1. Extend `isMicrogSigned()` to accept **project Phonesky** signer for
|
|
`com.android.vending`. Do **not** keep LOS `isDebuggable()` — AXP/GOLDEN
|
|
is `user` (`ro.debuggable=0`) and still spoofs via the toggle + grant.
|
|
2. Gate spoofing on `Settings.Secure.allow_signature_fake` (default **0**).
|
|
3. Require grant of `android.permission.FAKE_PACKAGE_SIGNATURE`.
|
|
4. Port EXTENDROM permission + Settings Developer Options toggle + strings.
|
|
5. Keep packaging leftovers: `LOCAL_REPLACE_PREBUILT_APK_INSTALLED` + Play FGS
|
|
privapp XML (already in `vendor/sunfish-a16/`).
|
|
|
|
**LAB 2026-09-15 post-flash:** Self-Check / spoofing / no
|
|
`UNREGISTERED_ON_API_CONSOLE` OK. Play install failures / ANR: `DownloadService`
|
|
/`VpaService` FGS `systemExempted` needs **any of** `SCHEDULE_EXACT_ALARM` /
|
|
`USE_EXACT_ALARM` / VPN — privapp alone is not enough if the APK does not
|
|
**request** those permissions.
|
|
|
|
**Fix (2026-09-15):** Phonesky rebuild adds `USE_EXACT_ALARM` +
|
|
`SCHEDULE_EXACT_ALARM` to the manifest; artifact
|
|
`/srv/rom/artifacts/005-spoofing/Phonesky_exact-alarm.apk`; pushed to LAB via
|
|
`adb install -r` (same project JKS); vendor prebuilt updated under
|
|
`/srv/rom/src/lineage/vendor/sunfish-a16/prebuilt/Phonesky.apk` for next bacon.
|
|
`USE_EXACT_ALARM: granted=true` on LAB after upgrade.
|
|
|
|
Re-apply after `repo sync` that resets frameworks/Settings:
|
|
|
|
```bash
|
|
python3 /srv/rom/src/lineage/vendor/sunfish-a16/patches/005-sigspoof/apply_005_sigspoof.py
|
|
```
|
|
|
|
Backups: `/srv/rom/artifacts/005-spoofing/bak-snapshots/` (never leave
|
|
`*.005.bak` under `res/` — aapt2 will fail).
|
|
|
|
## LAB validation (US6 — 2026-09-15)
|
|
|
|
Accepted on LAB `11231JEC207477` / build `23.2-20260915-UNOFFICIAL-sunfish`.
|
|
Evidence: `/srv/rom/artifacts/005-spoofing/20260915-us6-validation/LAB-US6.txt`.
|
|
|
|
1. ~~Flash LAB; `pm path` gms / gsf / vending~~ — pass
|
|
2. ~~Allow signature spoofing~~ — `allow_signature_fake=1`
|
|
3. ~~Self-Check correct signature~~ — pass (grant on user 0 + Island 10)
|
|
4. ~~Play sign-in / installs~~ — pass after exact-alarm Phonesky; no `UNREGISTERED_ON_API_CONSOLE`
|
|
5. Location: configure BeaconDB `https://api.beacondb.net` (no UnifiedNlp) — steps in
|
|
`docs/004-lab-selfcheck.md` + `quickstart.md`
|
|
|
|
```bash
|
|
adb -s 11231JEC207477 shell settings get secure allow_signature_fake
|
|
# expect 1 when enabled
|
|
```
|
|
|
|
**Handoff:** first stack done → next feature **`006` banking rootless**. Do **not**
|
|
add KernelSU/`007` until after `006`.
|
|
|
|
## Out of scope
|
|
|
|
- Banking apps (`006`), KSU/root (`007`), Magisk/LSPosed.
|