sunfish-adminandCursor
2d145c2878
Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding and rebuild/sync helpers; document device roles, laptop migration, and Gitea. Co-authored-by: Cursor <cursoragent@cursor.com>
66 lines
3.5 KiB
Markdown
66 lines
3.5 KiB
Markdown
# 009 AXP LOS23 port — patch / packaging README
|
|
|
|
**Track**: Magisk AXP resurrection on LOS 23.2 sunfish (`AXP_Resurection`).
|
|
**Not ship**: KernelSU / SusFS (`007` standby / optional recycle only).
|
|
|
|
## Apply order (host tree under `/srv/rom/src/lineage/`)
|
|
|
|
1. **Google stack** — `vendor/sunfish-a16/gms.mk` + `Android.mk` (microG, GSF,
|
|
Phonesky). Host APKs: `/srv/rom/prebuilts/{microg,phonesky}/` (never Git).
|
|
2. **Signature spoofing** — `vendor/sunfish-a16/patches/005-sigspoof/`
|
|
(`apply_005_sigspoof.py`). Attribute: LOS restricted spoofing + AXP/005.
|
|
3. **Call recording unlock** — `vendor/sunfish-a16/patches/008-call-rec-flag-secure/`
|
|
(`extendrom_call_recording`). Attribute: EXTENDROM `F_CALLREC`.
|
|
4. **Magisk preroot** — EXTENDROM-class boot/`init_boot` patch using Magisk APK
|
|
from `/srv/rom/prebuilts/magisk/` (see `docs/009-magisk-preinstall-runbook.md`).
|
|
Stub: `vendor/sunfish-a16/magisk.mk`. Attribute: Magisk upstream + sfX
|
|
extendrom Magisk patcher. **Shipped on LAB (2026-10):** Magisk 30.7 preroot
|
|
via host EXTENDROM at `/srv/rom/references/extendrom/` (wired by the ship
|
|
bacon). Do not treat the old “blocked on T011” note as current.
|
|
5. **Bundled apps** — `/srv/rom/prebuilts/axp-apps/` + `apps.mk` (Aurora,
|
|
Droidify, Fossify Gallery). Symlink APKs into `vendor/sunfish-a16/prebuilt/`.
|
|
6. **Private DNS presets** — `apply_009_private_dns_providers.py` (GOLDEN list).
|
|
7. **Internet connectivity check** — `apply_009_connectivity_check.py` (GOLDEN
|
|
list **minus** AXP.OS / `axpos.org`).
|
|
8. **Disable for user apps** — `apply_009_disable_user_apps.py` (SPA gate).
|
|
9. **Userspace hardening / signing** — staged: see `signing/README.md`,
|
|
`hardening/README.md` (US-S4-1 OpenSSH trim), and
|
|
`docs/009-hardening-signing-checklist.md` (US-S1 keys → US-S2 wire →
|
|
US-S3 AVB → US-S4+ harden). Bootloader lock = wont.
|
|
10. **Kernel hardening** — LOS23 `msm-4.14` + map in
|
|
`docs/009-kernel-hardening-map.md` (FR-017). Stage 1:
|
|
`vendor/sunfish-a16/patches/009-kernel-hardening/apply_stage1.sh`
|
|
(AXP Graphene/AH allowlist). Priority: AXP → LOS → Iodé → optional
|
|
Graphene; no Divest hunt; no extra location lockdown.
|
|
11. **2026-10-16 polish** (ship bacon) — `apply_009_euicc_disabler_guard.py`,
|
|
`apply_009_thermal_cdev_log.py`; wave4
|
|
`apply_009_drop_lab_only_commands.py` must **keep/restore**
|
|
`disable_configstore`. Details: `docs/009-lab-polish-20261016.md`.
|
|
|
|
## Product includes
|
|
|
|
Wire Magisk-resurrection product from `vendor/sunfish-a16/` into
|
|
`lineage_sunfish` (same pattern as `004`/`005`). Keep Phonesky priv-app path.
|
|
**No FakeStore. No KernelSU product packages.**
|
|
|
|
## Deferred
|
|
|
|
- Banking Gate E / Island validation (owner future).
|
|
- Localization AXP-vs-LOS compare (`docs/009-localization-axp-vs-los.md` stub).
|
|
|
|
## Host paths (rom-dev01)
|
|
|
|
| What | Path |
|
|
|------|------|
|
|
| Magisk APK | `/srv/rom/prebuilts/magisk/Magisk-v30.7.apk` |
|
|
| EXTENDROM Magisk patcher | `/srv/rom/references/extendrom/config/magisk/` |
|
|
| Kernel source | `/srv/rom/src/lineage/kernel/google/msm-4.14` |
|
|
| Product include (gms) | `device/google/sunfish/lineage_sunfish.mk` → `vendor/sunfish-a16/gms.mk` |
|
|
| Vanilla baseline | `/srv/rom/artifacts/003-vanilla/20260914-lineage-23.2-sunfish/` |
|
|
| Optional KSU boots | `/srv/rom/artifacts/007-kernelsu/` (non-ship) |
|
|
|
|
**Host wiring (current):** EXTENDROM Magisk patcher lives under
|
|
`/srv/rom/references/extendrom/` and is invoked by
|
|
`scripts/009-bacon-axp-stage1-combo4-cve-hi-releasekeys.sh`. Magisk APK pin:
|
|
`/srv/rom/prebuilts/magisk/Magisk-v30.7.apk`.
|