sunfish-admin
12d2179c20
Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.
105 lines
4.3 KiB
Markdown
105 lines
4.3 KiB
Markdown
# Research: 005 restricted signature spoofing
|
||
|
||
## Decision: First working stack = `004` leftovers + spoofing + modern location
|
||
|
||
**Decision**: Ship one LAB validation build that includes (1) unfinished `004`
|
||
packaging fixes, (2) restricted spoofing, (3) BeaconDB location docs — and
|
||
**exclude** `006` banking and `007` root.
|
||
|
||
**Rationale**: Owner: first phase that must work is microG + patched Play +
|
||
spoofing. Banking/root are later regressions.
|
||
|
||
**Alternatives considered**: Separate tiny `004b` rebuild only — rejected;
|
||
wastes a flash cycle before spoofing lands. Pulling `006` early — rejected;
|
||
blocks focus.
|
||
|
||
## Decision: Spoofing implementation source = EXTENDROM / AXP (port to A16)
|
||
|
||
**Decision**: Use [EXTENDROM_SIGNATURE_SPOOFING](https://github.com/sfX-android/android_vendor_extendrom/wiki/EXTENDROM_SIGNATURE_SPOOFING)
|
||
as the attributable primary source (matches GOLDEN behaviour:
|
||
`allow_signature_fake`, Developer Options, per-app `FAKE_PACKAGE_SIGNATURE`).
|
||
Port patches from the closest supported Android line (**A15** is STABLE/tested;
|
||
GOLDEN is A15) onto **A16 / LOS 23.2**.
|
||
|
||
**Rationale**: Stock LOS 23.2 tree on `rom-dev01` has **no**
|
||
`FAKE_PACKAGE_SIGNATURE` / `allow_signature_fake` (inventory 2026-09-15). AXP
|
||
GOLDEN proves the UX and setting key. Old `android_signature_spoofing` repo is
|
||
obsolete per upstream.
|
||
|
||
**Alternatives considered**:
|
||
|
||
| Option | Why not |
|
||
|--------|---------|
|
||
| lineageos4microg unrestricted spoof | Constitution forbids open spoofing |
|
||
| Magisk / LSPosed FakeGApps | Forbidden; rootless Compatibility MVP |
|
||
| Wait for LOS to grow A16 EXTENDROM dir | Blocks first stack; we port ourselves |
|
||
|
||
**A16 note**: EXTENDROM wiki table lists A15, not A16. Expect conflict resolution
|
||
(`repo diff` / split patches) per EXTENDROM porting guide. Record deltas in
|
||
`docs/a15-a16-delta.md`.
|
||
|
||
## Decision: Must spoof `signingInfo`, not only `signatures[]`
|
||
|
||
**Decision**: Implementation MUST spoof both legacy `PackageInfo.signatures` and
|
||
modern `PackageInfo.signingInfo` (GET_SIGNING_CERTIFICATES).
|
||
|
||
**Rationale**: microG #2680 / EXTENDROM #48 — Google/Play check `signingInfo` on
|
||
modern Android; Self-Check “correct signature” fails if only legacy arrays are
|
||
faked. LOS Gerrit has A13–A15 fixes; ensure A16 port includes equivalent.
|
||
|
||
## Decision: Allow-list = microG GmsCore + project Phonesky
|
||
|
||
**Decision**: Effective spoofing limited to:
|
||
|
||
- `com.google.android.gms` — official microG signer (`73aaa390…` short on GOLDEN)
|
||
- `com.android.vending` — project Phonesky JKS
|
||
SHA-256 digest
|
||
`31:31:86:CB:7D:F2:D4:01:33:72:12:07:B7:29:73:E8:52:F6:1C:87:67:C3:21:E5:C7:50:39:01:1B:83:BD:56`
|
||
|
||
Privapp/default XMLs that bind by cert digest MUST use **our** digest (not
|
||
AXP’s `00:5C:98:05:…`).
|
||
|
||
**Rationale**: Constitution + GOLDEN grants; AXP `er_*` XMLs bind Phonesky by
|
||
digest.
|
||
|
||
## Decision: Global toggle default OFF
|
||
|
||
**Decision**: `allow_signature_fake` defaults to disabled; user enables in
|
||
Developer Options (AXP setup guide).
|
||
|
||
**Rationale**: Matches oracle docs and reduces surprise attack surface.
|
||
|
||
## Decision: `004` packaging leftovers are a `005` ship gate
|
||
|
||
**Decision**: Before declaring `005` done, the flashable zip MUST include:
|
||
|
||
1. `LOCAL_REPLACE_PREBUILT_APK_INSTALLED` for GmsCore/Gsf/Phonesky (already in
|
||
working-tree `vendor/sunfish-a16/Android.mk`)
|
||
2. Phonesky privapp extras for Play 52 / A16 FGS:
|
||
`FOREGROUND_SERVICE_SYSTEM_EXEMPTED`, `SCHEDULE_EXACT_ALARM` /
|
||
`USE_EXACT_ALARM`, plus prior grammatical/status-bar entries
|
||
|
||
**Rationale**: Measured LAB failures — PRESIGNED strip → no `pm path`; missing
|
||
FGS allowlist → VpaService/DownloadService crash. Remount pushes are not the
|
||
shipped artifact.
|
||
|
||
## Decision: Modern location = BeaconDB (not UnifiedNlp backends)
|
||
|
||
**Decision**: Document configuring microG Location to use an Ichnaea-compatible
|
||
URL (`https://api.beacondb.net` or documented successor). Do **not** package
|
||
Déjà Vu / Nominatim NLP / MLS apps.
|
||
|
||
**Rationale**: microG 0.3.x dropped UnifiedNlp backends; MLS retired (2025);
|
||
GOLDEN also has no NLP backend packages. Owner wants modern stack.
|
||
|
||
**Alternatives considered**: Ship UnifiedNlp backends — rejected (obsolete for
|
||
0.3.x primary path).
|
||
|
||
## Decision: Out of scope remains `006`/`007`
|
||
|
||
**Decision**: No Insular/banking hard-gates; no KSU/SusFS in this feature’s
|
||
acceptance.
|
||
|
||
**Rationale**: Owner confirmation 2026-09-15 — first phase is microG + Play +
|
||
spoofing only.
|