AXP-Resurection/docs/reference-sources.md

Reference sources — LineageOS, AXP.OS, GrapheneOS (sunfish only)

Project documentation consolidating where sources live, what role they play, what is already archived locally, and what to execute later on rom-dev01.

Scope: Google Pixel 4a (sunfish) only. Do not plan or archive unrelated devices (other Pixels, OnePlus, Fairphone, Sony, …).

LineageOS 23.2 / Android 16     → AUTHORITATIVE CURRENT BASE (build from this)
AXP.OS 22.2 / Android 15        → GOLDEN / functional reference (live device + selective archive)
GrapheneOS Android 13 sunfish   → HISTORICAL hardening reference (selective archive)

Do not execute server archive/download/build commands from this file until rom-dev01 exists. Do not treat this as work on frozen feature 001.

Detailed AXP hosting probes, Tor/download URLs, and Forgejo inventory commands: axp-sunfish-preservation.md.

Device roles (GOLDEN vs LAB): device-roles.md.

---

Classification legend

Label	Meaning
AUTHORITATIVE CURRENT SOURCE	Use for builds / official current truth
HISTORICAL REFERENCE	Study/port only; not the build base
LOCAL ARCHIVE	Copy under /srv/rom/references/… or laptop path
UNAVAILABLE / PRIVATE	Do not scrape or bypass access controls
TO BE EXECUTED LATER ON rom-dev01	Commands/actions deferred until host is ready

---

Target layout on rom-dev01

/srv/rom/references/
├── axp/
│   ├── archive/          # see axp-sunfish-preservation.md
│   ├── manifests/        # sunfish A15 selection / versioning notes
│   └── README.md
├── lineage/
│   ├── manifests/        # repo manifest -r snapshots (reproducibility)
│   └── README.md
└── grapheneos/
    ├── mirrors/          # selective bare clones only
    ├── manifests/
    ├── metadata/
    └── README.md

Plus the normal build checkout (not an “archive”):

/srv/rom/src/lineage-23.2/    # full Lineage tree used to compile (feature 003+)

---

1. LineageOS 23.2 / Android 16 — BASE

Role

AUTHORITATIVE CURRENT SOURCE for the ROM. Compiling = syncing and building this tree for sunfish. No need for a redundant mass mirror of the entire LineageOS GitHub organization.

Authoritative URLs

Item	URL	Class
Android / repo umbrella	https://github.com/LineageOS/android	AUTHORITATIVE CURRENT
Device sunfish	https://github.com/LineageOS/android_device_google_sunfish	AUTHORITATIVE CURRENT
Kernel msm-4.14	https://github.com/LineageOS/android_kernel_google_msm-4.14	AUTHORITATIVE CURRENT
Wiki device page	https://wiki.lineageos.org/devices/sunfish/	AUTHORITATIVE CURRENT (verify against repos)

Note: Indexed/cached wiki install pages may still mention older branches (e.g. 22.2). For branch and source tree truth, trust current GitHub branches / official repo init, not a stale wiki cache. As of project research, android_device_google_sunfish and android_kernel_google_msm-4.14 expose lineage-23.2.

Official source init

repo init \
  -u https://github.com/LineageOS/android.git \
  -b lineage-23.2 \
  --git-lfs

repo sync

(Exact path on host: e.g. /srv/rom/src/lineage-23.2 — set during 003.)

What to preserve locally (not a full org archive)

TO BE EXECUTED LATER ON rom-dev01 after syncs/builds:

mkdir -p /srv/rom/references/lineage/manifests

cd /srv/rom/src/lineage-23.2   # or actual checkout path

# After first successful sync:
repo manifest -r \
  -o /srv/rom/references/lineage/manifests/lineage-23.2-initial.xml

# After first known-good vanilla sunfish boot/build:
repo manifest -r \
  -o /srv/rom/references/lineage/manifests/lineage-23.2-sunfish-vanilla-known-good.xml

Also keep short README under /srv/rom/references/lineage/README.md with:

• repo init command used
• date / host
• pointer to known-good images under /srv/rom/artifacts/ (hashes)

Explicitly out of scope for Lineage “archive”

• git clone --mirror of hundreds of LineageOS repos “just in case”
• Mirroring unrelated device trees

The build checkout is the working copy; revision-locked manifests are the reproducibility archive.

---

2. AXP.OS 22.2 / Android 15 — GOLDEN / functional reference

Role

HISTORICAL + FUNCTIONAL REFERENCE (and live GOLDEN device). Not the build base. Infrastructure risk is higher (self-hosted pieces may vanish) → selective archive matters more than for Lineage.

Full operational cookbook: axp-sunfish-preservation.md.

Source classes

Source	Class	Notes
GOLDEN phone (AXP 22.2 / A15)	AUTHORITATIVE CURRENT for behaviour	Live adb; do not flash
https://axpos.org (docs/news/devices)	AUTHORITATIVE CURRENT docs (while up)	Hosted via Codeberg
https://git.disroot.org/AXP.OS	AUTHORITATIVE CURRENT public git	Main public mirror (~225 repos; do not clone all)
https://codeberg.org/AXP-OS	HISTORICAL / PARTIAL	Website git + fewer repos after Jan 2026 removals
https://github.com/AXP-OS	AUTHORITATIVE for some APK/releases	Lower priority mirror
https://code.binbash.rocks/AXP.OS	UNAVAILABLE / PRIVATE anonymously	Alive; no anonymous repo list; do not bypass
https://download.axpos.org/…/sunfish/	AUTHORITATIVE downloads (when reachable)	Probe exact paths
Tor onion :8008	FALLBACK downloads	See preservation doc
leech.binbash.rocks	UNAVAILABLE (2026-08-09 probes)	Legacy

Sunfish-only archive criteria

Preserve/reference only:

• documentation/web useful to the project
• android_device_google_sunfish, android_kernel_google_msm-4.14
• manifests / axp_versioning needed to identify exact AXP sunfish revisions
• common repos only when they contain AXP changes applicable to sunfish (e.g. frameworks/base, Settings, build/config, microG/spoofing, Phonesky, callrec, FLAG_SECURE, hardening) — selected via sunfish A15 manifests, not by cloning the whole org
• sunfish Pro/Slim builds, recovery, factory, .prop, checksums, public keys where recoverable

Discarded: full Disroot “225 repos / ~48 GiB Git” org mirror as a project goal.

LOCAL ARCHIVE (laptop today)

~/Archives/AXP.OS/
  website-rendered/
  codeberg/                 # ~14 repos / ~38 GiB; LFS gaps in legacy_prebuilt_apps
  disroot-repositories.jsonl
  mirror-forgejo-org.sh
  …

TO BE EXECUTED LATER ON rom-dev01

1. rsync laptop archive → /srv/rom/references/axp/archive/
2. df preflight (must not steal LOS/out/ccache space)
3. Refresh website / selected Disroot mirrors via manifest-driven selection
4. Probe/download sunfish Pro/Slim artifacts if hosts allow
5. Never attempt private binbash access

See axp-sunfish-preservation.md for commands.

---

3. GrapheneOS — Android 13 sunfish (historical hardening)

Role

HISTORICAL REFERENCE for hardening techniques/patches that once ran on sunfish. Not the ROM base. Official project: sunfish unsupported; old trees moved toward GrapheneOS-Archive.

Confirms project rule: GrapheneOS sunfish = A13 history, never A16 base.

Authoritative / archive URLs

Item	URL	Class
Current GrapheneOS orgs	https://github.com/GrapheneOS	AUTHORITATIVE CURRENT (active devices)
Platform manifest (current)	https://github.com/GrapheneOS/platform_manifest	AUTHORITATIVE CURRENT
Official historical archive org	https://github.com/GrapheneOS-Archive	HISTORICAL REFERENCE
sunfish device (archived)	https://github.com/GrapheneOS-Archive/device_google_sunfish	HISTORICAL — archive/read-only (e.g. since 2025-12-04); branch 13
Releases / changelog	https://grapheneos.org/releases	AUTHORITATIVE for release history (A13 era mentions Pixel 4a)
FAQ	https://grapheneos.org/faq	AUTHORITATIVE docs
Example reorganized tree	GrapheneOS-Archive/platform_frameworks_base-old (read-only)	HISTORICAL — illustrates repo moves

Do not mirror all ~244 repos in GrapheneOS-Archive.

Selection rule (same spirit as AXP)

1. From last sunfish Android 13 GrapheneOS manifests/tags, list repos/commits that carried GrapheneOS deltas relevant to sunfish.
2. Mirror only those (plus device_google_sunfish + useful manifests).
3. Likely candidates after proof: frameworks, system/core, SELinux, malloc, kernel/configs, etc. — only if tied to sunfish A13 lineage.
4. Record provenance; port carefully to LOS 23.2 / 4.14 (see constitution / docs/hardening-backlog.md).

TO BE EXECUTED LATER ON rom-dev01 (minimum seed)

mkdir -p /srv/rom/references/grapheneos/{mirrors,manifests,metadata}

git clone --mirror \
  https://github.com/GrapheneOS-Archive/device_google_sunfish.git \
  /srv/rom/references/grapheneos/mirrors/device_google_sunfish.git

git clone --mirror \
  https://github.com/GrapheneOS/platform_manifest.git \
  /srv/rom/references/grapheneos/mirrors/platform_manifest.git

git --git-dir=/srv/rom/references/grapheneos/mirrors/device_google_sunfish.git fsck --full
git --git-dir=/srv/rom/references/grapheneos/mirrors/device_google_sunfish.git show-ref

Then expand selectively from A13 sunfish manifests/tags — not the whole Archive org.

LOCAL ARCHIVE

No complete GrapheneOS sunfish archive is assumed on the laptop yet (unlike AXP). Seed mirrors are TO BE EXECUTED LATER ON rom-dev01.

---

4. Conceptual comparison

	LineageOS	AXP.OS	GrapheneOS (sunfish)
Android	16 (23.2)	15 (22.2)	13 (last)
Role	BASE	GOLDEN / functional	Hardening history
Full tree checkout	Yes (to build)	No (selective)	No (selective)
Mass org mirror	No	No	No
Key local artifact	repo manifest -r XML	web + sunfish repos + images	device_sunfish + selected A13 repos
Urgency	Low (GitHub active)	Higher (self-host risk)	Medium (already moving to Archive)

---

5. Shared porting discipline

For any AXP or GrapheneOS candidate change:

1. Identify source repo + tag/branch/build (sunfish-relevant)
2. Identify corresponding LOS 23.2 / AOSP base
3. Inspect full diff
4. Classify: direct / port / obsolete / superseded / A16- or 4.14-incompatible
5. Deduplicate vs LOS / the other reference
6. One logical change; build; test on LAB only

---

6. Execution status checklist

Item	Status
Document Lineage URLs + manifest -r strategy	Done (this file)
Document AXP sunfish-scoped preservation	Done (axp-sunfish-preservation.md + this file)
Document GrapheneOS Archive sunfish strategy	Done (this file)
Laptop AXP archive under ~/Archives/AXP.OS/	Exists (operator); rsync later
rom-dev01 AXP/Lineage/GOS archives	TO BE EXECUTED LATER
Lineage full sync / first manifest -r	TO BE EXECUTED LATER (003)
Feature 001 implement	Not started (frozen docs)
Features 002/003	Not started

---

7. Contradictions / pitfalls noted

1. Wiki vs GitHub for Lineage: install wiki caches may show 22.2; repos show lineage-23.2 — trust repos/repo init.
2. AXP “~48 GiB Disroot” ≠ required archive size — that is whole-org Git metadata; project policy is sunfish-selected only.
3. Codeberg AXP archive ≠ complete — LFS 404s (e.g. legacy_prebuilt_apps); keep anyway; do not claim 100% LFS.
4. download.axpos.org / timeout ≠ paths dead — probe /axp/sunfish/ etc.
5. OTA / → 403 does not mean updater API is down.
6. GrapheneOS-Archive growth — sunfish material is being archived; prefer Archive URLs + manifests over assuming old live GrapheneOS device support.
7. AXP Android version: GOLDEN is 22.2 / A15; last GrapheneOS sunfish is A13 — do not conflate.

---

8. Community inspiration (non-base) — LOS + microG + KSU-Next + SusFS

Not our ROM base. Useful field report for sunfish banking / root / SusFS.

Item	Detail
Thread	XDA: UNOFFICIAL sunfish LOS 22.2 + MicroG + KSU-Next + SusFS (torukk)
Ship	LOS 22.2 / A15 + upstream microG + kernel KSU-Next + SusFS
Kernel tree (author)	https://github.com/abu-adm/android_kernel_google_msm-4.14 (branch noted compatible with LOS23 kernel work)
Claims	Revolut / hard banks workable with spoofed KSU-Next manager + SusFS + TrickyStore + microG “unblock hardware attestation”; integrity landscape changes fast
LOS 23.2 note (forum)	Boot image with SusFS/ReSukiSU flashed onto official LOS 23.2: SusFS works, but ReSukiSU config unstable, heat, sudden reboots vs Magisk
Our use	Inspiration for 006/007 (profiles, SusFS, attestation modules on LAB). Still build our LOS 23.2 vanilla first (003), then microG/Phonesky, then KSU-Next. Do not adopt as drop-in base; layer AXP/Graphene call-rec / FLAG_SECURE / hardening later as planned

If iodé/vanilla keep failing Yuh KeyMint/RKP, this thread’s stack (SusFS + TrickyStore + microG HA toggles) is the first LAB experiment family to evaluate — after stock factory diagnosis when convenient.

---

9. Community inspiration (non-base) — rooted GrapheneOS OTAs

Not our ROM base. Not for sunfish (EOL; project targets modern supported Pixels).

Item	Detail
Repo	https://github.com/schnatterer/rooted-graphene
Idea	Patch Magisk into official GrapheneOS OTAs; keep AVB + locked bootloader + root; own OTA channel via Custota / GitHub Pages; switch Magisk ↔ rootless by OTA
Tooling of interest	avbroot, Custota, signed OTA pipeline
Limits (upstream notes)	Stock Magisk Zygisk broken in this setup → banking detection; optional third-party Magisk fork; KernelSU hard to integrate with this Magisk-in-OTA approach
Our use	Inspiration for later signing / AVB / OTA trade-offs. This Magisk track (009) is the ship root (KernelSU/007 standby). Do not treat as GrapheneOS-on-sunfish revival

Contrast with §8 (torukk): that one is sunfish + KSU-Next + SusFS + LOS; this one is modern Graphene + Magisk + locked AVB OTA. Different lessons for different stages.

---

10. Attestation / banking compatibility references

Primary reading when designing 006/007 attestation strategy (not sunfish-specific fixes by themselves):

Source	URL	Why keep
GrapheneOS attestation compatibility guide	https://grapheneos.org/articles/attestation-compatibility-guide	Explains hardware attestation API vs Play Integrity; SelfSigned + whitelist of official GOS verified-boot keys (attestation.json); why modern supported Pixels can work with banks that whitelist GOS; sunfish not on that key list (EOL)
PrivSec banking apps compat report (issue)	https://github.com/PrivSec-dev/banking-apps-compat-report/issues/509	Crowdsourced banking/attestation outcomes across ROMs (incl. Graphene); use for comparative evidence, not as a recipe dump

Project takeaway: Yuh/Swissquote working on supported GrapheneOS tracks whitelist + healthy TEE/AVB on current Pixels. Our sunfish path still needs LOS+microG/Phonesky + measured KeyMint/RKP behaviour; GOS docs inform what apps check, not a drop-in port.