sunfish-admin
12d2179c20
Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.
96 lines
4.9 KiB
Markdown
96 lines
4.9 KiB
Markdown
# Research: 004 microG + Phonesky
|
||
|
||
## Decision: Packaging layout — follow AXP GOLDEN scheme (owner 2026-09-15)
|
||
|
||
**Decision**: Mirror AXP GOLDEN partition roles. Do not invent a `product`-centric
|
||
layout. Measured on GOLDEN (`002`):
|
||
|
||
| Package | AXP GOLDEN path | Our packaging |
|
||
|---------|-----------------|---------------|
|
||
| Phonesky | `/system/priv-app/Phonesky_AXP-OS` | **system** + privileged |
|
||
| GmsCore | `/system_ext/app/MicrogGmsCore_GH_presigned` | **system_ext** app (not priv-app) |
|
||
| GsfProxy | `/system_ext/app/GsfProxy_GH` | **system_ext** app |
|
||
|
||
Ship via a small `vendor/sunfish-a16` include (partner_gms *pattern*) but
|
||
**replace FakeStore** with patched Phonesky. Permission XMLs follow the same
|
||
partitions (`system` for Phonesky, `system_ext` for microG).
|
||
|
||
**Rationale**: Owner — AXP methods exist for a reason; goal is modernize (LOS
|
||
23.2 / A16) and later replace Magisk with KSU-Next+SusFS (`007`), not redesign
|
||
the compatibility stack. Ad-hoc `LOCAL_PRODUCT_MODULE` + ABI-strip/re-sign of
|
||
GmsCore risks different update/SELinux/behaviour vs GOLDEN.
|
||
|
||
**Alternatives rejected**:
|
||
- All on `PRODUCT` — layout drift; hit partition checks awkwardly
|
||
- ABI-strip + project re-sign of GmsCore — breaks official microG F-Droid signer
|
||
- Stock lineageos4microg + FakeStore — wrong Store model
|
||
- Magisk module installers — not for `004` (root is `007`, non-Magisk)
|
||
|
||
**Partition headroom**: AXP release Phonesky APKs stay **fat** (all ABIs); CI
|
||
does not strip x86. If LOS 23.2 sunfish `BOARD_SUPER_PARTITION_ERROR_LIMIT` is
|
||
too tight for this package set, raise the error limit modestly (still under
|
||
`BOARD_GOOGLE_DYNAMIC_PARTITIONS_SIZE`) rather than breaking microG’s signer.
|
||
|
||
## Decision: Phonesky binary — patch latest, AXP procedure, project sign
|
||
|
||
**Decision**: Latest official Play (apkmd) → AXP `patch-playstore` → project JKS
|
||
under `/srv/rom/secrets/phonesky-signing/`. XMLs from AXP `etc/`. Do **not** ship
|
||
`Phonesky_AXP-OS-signed.apk` as product (wrong trust domain). Keep fat APK unless
|
||
a later measured need forces arch filtering (document then).
|
||
|
||
## Decision: microG — latest official PRESIGNED + F-Droid
|
||
|
||
**Decision**: Latest official GmsCore **default** APK (`com.google.android.gms-*.apk`
|
||
without `-hw`) + GsfProxy, `PRESIGNED`, system_ext like AXP `*_GH_presigned`.
|
||
Never re-sign. F-Droid microG repo is the update path. No FakeStore/Companion APK
|
||
from microG releases.
|
||
|
||
**Do not ship `*-hw.apk`**: that Huawei flavor omits
|
||
`NetworkLocationService` / `NetworkLocationProviderService` from the manifest, so
|
||
microG Location hides Wi‑Fi/cell NLP toggles. GOLDEN ships the default flavor
|
||
(`versionName` without `-hw`, e.g. `0.3.15.250932`); LAB previously had
|
||
`0.3.16.252432-hw` and only Timeline — corrected 2026-09-16 to
|
||
`0.3.16.252432` default for GOLDEN Location UI parity.
|
||
|
||
## Decision: Signature spoofing in `004`
|
||
|
||
**Decision**: Use LOS 23.2 restricted spoofing only; gaps → `005`.
|
||
|
||
## Decision: AXP scheme vs Android 16 / LOS 23.2 (owner 2026-09-15)
|
||
|
||
**Decision**: Prefer the AXP **A15 / GOLDEN** packaging and behaviour scheme when
|
||
LOS 23.2 / Android 16 still supports it. If A16 makes an equivalent path
|
||
*easier* (cleaner APIs, existing LOS hooks), use that — still targeting the
|
||
same end state (priv Play, updatable official-signer microG, banking path).
|
||
If A16 makes the AXP path *harder* or impossible, do **not** silently invent a
|
||
divergent stack: document the blocker and redesign the route to the **same**
|
||
goals (layout roles, update model, no Magisk-shaped packaging).
|
||
|
||
**Rationale**: AXP’s choices were intentional; A16 is a port/modernization, not
|
||
a license to ignore the oracle. Divergence only when measured necessity.
|
||
|
||
**Oracle scope (owner 2026-09-16)**: GOLDEN and abu are **Android 15** reference
|
||
images — use them for packaging/layout/behaviour (e.g. which GmsCore *flavor*
|
||
exposes Location NLP), not as a pin to their older package versions. On LOS 23.2
|
||
/ A16 we ship the **newest** fitting official microG (and peers) that preserve
|
||
that scheme (default/non-hw GmsCore, not `*-hw`).
|
||
|
||
**Measured A16 blocker (2026-09-14)**: Putting Phonesky on `system/priv-app`
|
||
fails `artifact_path_requirements` (`generic_system.mk`) under LOS 23.2.
|
||
**Route to same end state**: keep AXP paths and add them to
|
||
`PRODUCT_ARTIFACT_PATH_REQUIREMENT_ALLOWED_LIST` (same mechanism sunfish already
|
||
uses for a few system libs) — do not move Phonesky to `product` just to silence
|
||
the check. GmsCore/Gsf on `system_ext` already passed.
|
||
|
||
**Align-first (owner 2026-09-15)**: Do not invent `privapp-permissions` for
|
||
GmsCore while GOLDEN ships it as non-privileged `system_ext` app. Ship only
|
||
AXP Phonesky XMLs; repair from Self-Check / build errors if A16 truly requires
|
||
more.
|
||
|
||
## Decision: Signing strategy (FR-010) — locked
|
||
|
||
| Package | Signer | Update path |
|
||
|---------|--------|-------------|
|
||
| GmsCore / GsfProxy | Official microG (`PRESIGNED`) | F-Droid microG repo |
|
||
| Phonesky | Project JKS `/srv/rom/secrets/phonesky-signing/` | Same-signer patched APKs |
|