sunfish-adminandCursor
3f941e8451
Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path, and adds deblob appliers plus tests; docs capture Swissquote fix and parity. Co-authored-by: Cursor <cursoragent@cursor.com>
3.6 KiB
009 signing / AVB (userspace Gate G)
Clone AXP/GOLDEN posture: user + release-keys, device unlocked
(orange). Not IOdes locked-bootloader.
Full checklist: docs/009-hardening-signing-checklist.md.
Stages
| Stage | What |
|---|---|
| US-S1 | Generate keys → /srv/rom/secrets/android-certs/ |
| US-S2 | Wire PRODUCT_DEFAULT_DEV_CERTIFICATE into bacon |
| US-S3 | Project AVB key (AVB_CUSTOM_KEY_PATH); decide WITH_AVB |
| US-S4+ | Userspace harden / CVE — separate patches |
Generate (rom-dev01 only)
# from synced repo copy or laptop scp of scripts/
sudo -u android-build bash /srv/rom/src/lineage/vendor/sunfish-a16/../../../../\
# prefer:
bash /path/to/AXP_Resurection/scripts/009-generate-release-keys.sh
Script writes under /srv/rom/secrets/android-certs/ when that parent is
writable, otherwise $HOME/.android-certs (Lineage default). On rom-dev01
(2026-09-29) secrets/ is root-owned without group write → keys live in
/home/android-build/.android-certs/. Refuses overwrite. Reminds about
encrypted offline backup before first signed ship bacon.
Wire (US-S2 — after keys exist)
In the bacon environment (not committed secrets):
export PRODUCT_DEFAULT_DEV_CERTIFICATE=$HOME/.android-certs/releasekey
# after root relocate: /srv/rom/secrets/android-certs/releasekey
# lunch lineage_sunfish-userdebug # first signed build
# later: lineage_sunfish-user
009-bacon-axp-stage1-combo4.sh auto-exports when $HOME/.android-certs/releasekey.pk8 exists.
AVB (US-S3)
Default tree falls back to AOSP external/avb/test/data/testkey_rsa2048.pem
(and LAB has been observed with testkey_rsa4096) plus
BOARD_AVB_MAKE_VBMETA_IMAGE_ARGS += --flags 3 unless WITH_AVB=true
(device/google/sunfish/BoardConfigLineage.mk).
Project key generation is in 009-generate-release-keys.sh
(avb.pem + avb_pkmd.bin). Wire in tree (soong-safe path), not only env:
vendor/sunfish-a16/BoardConfig.mk sets BOARD_AVB_KEY_PATH /
BOARD_AVB_ALGORITHM=SHA256_RSA4096 when certs/avb.pem exists. Keep
WITH_AVB unset → vbmeta flags 3 =
HASHTREE_DISABLED|VERIFICATION_DISABLED (libavb) → Magisk preroot on
unlocked/orange. That is signing infrastructure, not runtime AVB harden.
Validate after bacon (script fail-closed) on target_files IMAGES/ (the
OTA pair). Do not use out/target/product/$DEVICE/{boot,vbmeta}.img alone —
those make images can be stock and disagree with the Magisk payload in the zip.
Gates: pubkey sha1 == avb_pkmd.bin (not AOSP testkey); flags 3;
verify_image --key + --expected_chain_partition vbmeta_system:1:avb_pkmd.bin;
magiskboot cpio test ≠ 0; LAB stays flash.locked=0 + Magisk works.
OEM unlocking: leave enabled as a best-effort escape hatch (not a recovery guarantee). Do not relock the bootloader on this Magisk track.
Branding
Ship identity follows AXP/GOLDEN, not Lineage's unofficial channel.
GOLDEN (22.2-2026.003-sunfish-pro) reports ro.lineage.releasetype=PRO,
ro.build.tags=release-keys, and a version ending in sunfish-pro.
TARGET_UNOFFICIAL_BUILD_ID forces Lineage UNOFFICIAL and is not that
scheme. The next bacon sets PRO + release-keys + …-sunfish-pro.
Pro remains the full Magisk track (AXP PRO, not SLIM).
branding.mk adds ro.axp.resurection.track=pro. Ship scripts also publish
AXP-Resurection-Pro-<ver>-<date>-sunfish.zip as a hardlink/copy of the
Lineage bacon zip (no rebuild solely to rename).
Never
- Commit
*.pk8, private*.pem, or pass files. - Relock LAB/GOLDEN as a project requirement (OEM unlock-always-on does not make Magisk+relock safe).
- Flash old
kh-cve/kh-fullzips from 2026-09-18.