sunfish-admin
deaaf42caa
Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding, bundled apps, and AXP-class product surface docs/scripts.
381 lines
16 KiB
Bash
Executable File
381 lines
16 KiB
Bash
Executable File
#!/bin/bash
|
|
# 009 bacon — ship pack with project release keys (US-S2).
|
|
# Stage1+combo4+FORTIFY + CVE clean + hi-batch1+2+3 + PRODUCT_DEFAULT_DEV_CERTIFICATE.
|
|
# Requires $HOME/.android-certs/releasekey.{pk8,x509.pem}. userdebug.
|
|
set -e
|
|
cd /srv/rom/src/lineage
|
|
export HOME=/home/android-build
|
|
export CCACHE_DIR=/srv/rom/ccache
|
|
export USE_CCACHE=1
|
|
export PATH=/home/android-build/bin:/usr/local/bin:/usr/bin:/bin:$PATH
|
|
export ANDROID_BUILD_TOP=/srv/rom/src/lineage
|
|
unset OUT_DIR || true
|
|
export SUNFISH_A16_MAGISK_PREROOT=1
|
|
export MAGISK_APK=/srv/rom/prebuilts/magisk/Magisk-v30.7.apk
|
|
|
|
LOGDIR=/srv/rom/logs/009-build
|
|
mkdir -p "$LOGDIR"
|
|
LOG=$LOGDIR/bacon-axp-stage1-combo4-cve-hi-releasekeys.log
|
|
exec > >(tee -a "$LOG") 2>&1
|
|
|
|
echo "=== START 009-bacon-axp-cve-hi-releasekeys $(date -Is) ==="
|
|
|
|
CERT_DIR="${ANDROID_CERTS_DIR:-$HOME/.android-certs}"
|
|
if [[ ! -f "$CERT_DIR/releasekey.pk8" || ! -f "$CERT_DIR/releasekey.x509.pem" ]]; then
|
|
echo "FAIL: missing $CERT_DIR/releasekey.{pk8,x509.pem}" >&2
|
|
exit 1
|
|
fi
|
|
export PRODUCT_DEFAULT_DEV_CERTIFICATE="$CERT_DIR/releasekey"
|
|
echo "OK: PRODUCT_DEFAULT_DEV_CERTIFICATE=$PRODUCT_DEFAULT_DEV_CERTIFICATE"
|
|
|
|
LIVE=kernel/google/msm-4.14
|
|
BASE=28f9290ae067
|
|
KH=vendor/sunfish-a16/patches/009-kernel-hardening
|
|
LIST_CLEAN="$KH/cve-clean-offset.list"
|
|
LIST_HI1="$KH/cve-high-offset-batch1.list"
|
|
LIST_HI2="$KH/cve-high-offset-batch2.list"
|
|
LIST_HI3="$KH/cve-high-offset-batch3.list"
|
|
test -f "$LIST_CLEAN"
|
|
test -f "$LIST_HI1"
|
|
test -f "$LIST_HI2"
|
|
test -f "$LIST_HI3"
|
|
test -d "$LIVE"
|
|
|
|
echo "=== reset kernel @ $BASE ==="
|
|
git -C "$LIVE" reset --hard "$BASE"
|
|
git -C "$LIVE" clean -fdq
|
|
|
|
chmod +x "$KH"/apply_stage1_combo4.sh "$KH"/apply_cve_strict.sh \
|
|
"$KH"/apply_stage1.sh "$KH"/apply_combo4_fortify.sh 2>/dev/null || true
|
|
|
|
bash "$KH/apply_stage1_combo4.sh" "$LIVE"
|
|
|
|
# US-S5-1 — Yama + SLAB_FREELIST_RANDOM (Graphene/AXP defconfig gaps)
|
|
chmod +x "$KH/apply_uss5_1_defconfig.sh" 2>/dev/null || true
|
|
bash "$KH/apply_uss5_1_defconfig.sh" "$LIVE"
|
|
|
|
export CVE_STRICT_LIST="$LIST_CLEAN"
|
|
unset CVE_STRICT_CONTINUE || true
|
|
export CVE_MAX_FUZZ=1
|
|
export CVE_MAX_ABS_OFFSET=200
|
|
bash "$KH/apply_cve_strict.sh" "$LIVE"
|
|
|
|
export CVE_MAX_ABS_OFFSET=9999
|
|
for L in "$LIST_HI1" "$LIST_HI2" "$LIST_HI3"; do
|
|
echo "=== high-offset $(basename "$L") ==="
|
|
export CVE_STRICT_LIST="$L"
|
|
bash "$KH/apply_cve_strict.sh" "$LIVE"
|
|
done
|
|
|
|
DEF=$LIVE/arch/arm64/configs/sunfish_defconfig
|
|
if grep -qE "^CONFIG_KSU.*=y" "$DEF"; then
|
|
echo "FAIL: KernelSU in defconfig" >&2
|
|
exit 1
|
|
fi
|
|
for k in FORTIFY_SOURCE INIT_ON_ALLOC_DEFAULT_ON INIT_ON_FREE_DEFAULT_ON \
|
|
SECURITY_DMESG_RESTRICT SLAB_FREELIST_HARDENED \
|
|
SECURITY_YAMA SLAB_FREELIST_RANDOM; do
|
|
grep -q "^CONFIG_${k}=y" "$DEF" || { echo "FAIL missing $k" >&2; exit 1; }
|
|
done
|
|
grep -q "ret = __underlying_strlen(q);" "$LIVE/include/linux/string.h"
|
|
grep -q "mmget_still_valid" "$LIVE/mm/madvise.c"
|
|
echo "OK: Stage1+combo4+FORTIFY + CVE-clean + hi-batch1+2+3 markers present"
|
|
|
|
rm -f out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image.lz4 \
|
|
out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image \
|
|
out/target/product/sunfish/kernel
|
|
|
|
python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_wms_disable_secure_debuggable_gate.py
|
|
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_disable_user_apps.py
|
|
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_private_dns_providers.py
|
|
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_connectivity_check.py
|
|
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_unofficial_build_id.py
|
|
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_drop_openssh_packages.py
|
|
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_drop_jelly_gallery2.py
|
|
|
|
# Host prebuilts → vendor/sunfish-a16/prebuilt (rsync --delete must not wipe these).
|
|
mkdir -p vendor/sunfish-a16/prebuilt
|
|
link_prebuilt() {
|
|
local name="$1" src="$2"
|
|
local dst="vendor/sunfish-a16/prebuilt/$name"
|
|
ln -sfn "$src" "$dst"
|
|
test -e "$dst" || { echo "FAIL: missing prebuilt $dst -> $src" >&2; exit 1; }
|
|
}
|
|
link_prebuilt Phonesky.apk /srv/rom/prebuilts/phonesky/Phonesky.apk
|
|
link_prebuilt GmsCore.apk /srv/rom/prebuilts/microg/GmsCore.apk
|
|
link_prebuilt GsfProxy.apk /srv/rom/prebuilts/microg/GsfProxy.apk
|
|
link_prebuilt AuroraStore.apk /srv/rom/prebuilts/axp-apps/AuroraStore.apk
|
|
link_prebuilt Droidify.apk /srv/rom/prebuilts/axp-apps/Droidify.apk
|
|
link_prebuilt FossifyGallery.apk /srv/rom/prebuilts/axp-apps/FossifyGallery.apk
|
|
AAPT=/srv/rom/src/lineage/prebuilts/sdk/tools/linux/bin/aapt
|
|
"$AAPT" dump permissions vendor/sunfish-a16/prebuilt/Phonesky.apk 2>/dev/null | grep -q USE_EXACT_ALARM
|
|
|
|
# Early hook so LINEAGE_VERSION includes AXP-Resurection-Pro (before version.mk).
|
|
mkdir -p vendor/extra
|
|
ln -sfn ../sunfish-a16/extra-product.mk vendor/extra/product.mk
|
|
test -f vendor/extra/product.mk
|
|
|
|
MAGISK_STAGE_DIR=/srv/rom/src/lineage/out/.magisk \
|
|
vendor/sunfish-a16/magisk/prepare_magisk.sh
|
|
python3 vendor/sunfish-a16/magisk/apply_releasetools_hook.py --top "$ANDROID_BUILD_TOP" --force
|
|
test -f out/.magisk/READY
|
|
|
|
rm -rf out/soong/.intermediates/build/make/tools/releasetools/releasetools_common
|
|
rm -rf out/soong/.intermediates/build/make/tools/releasetools/add_img_to_target_files
|
|
rm -rf out/target/product/sunfish/obj/PACKAGING/target_files_intermediates
|
|
rm -f out/target/product/sunfish/lineage-*.zip \
|
|
out/target/product/sunfish/boot.img \
|
|
out/target/product/sunfish/system/priv-app/Phonesky/Phonesky.apk
|
|
touch frameworks/base/services/core/java/com/android/server/wm/WindowManagerService.java
|
|
|
|
set +u
|
|
# shellcheck disable=SC1091
|
|
source build/envsetup.sh
|
|
set -e
|
|
# re-export after envsetup (some trees clear it)
|
|
export PRODUCT_DEFAULT_DEV_CERTIFICATE="$CERT_DIR/releasekey"
|
|
breakfast sunfish userdebug
|
|
test "${TARGET_RELEASE:-}" = "bp4a"
|
|
BT_SEPOL=$(get_build_var MAINLINE_BLUETOOTH_SEPOLICY_DEV_CERTIFICATES)
|
|
echo "MAINLINE_BLUETOOTH_SEPOLICY_DEV_CERTIFICATES=$BT_SEPOL"
|
|
case "$BT_SEPOL" in
|
|
*vendor/sunfish-a16/certs*) ;;
|
|
*) echo "FAIL: BT sepolicy certs still AOSP default ($BT_SEPOL)" >&2; exit 1 ;;
|
|
esac
|
|
AVB_KEY=$(get_build_var BOARD_AVB_KEY_PATH)
|
|
AVB_ALG=$(get_build_var BOARD_AVB_ALGORITHM)
|
|
echo "BOARD_AVB_KEY_PATH=$AVB_KEY"
|
|
echo "BOARD_AVB_ALGORITHM=$AVB_ALG"
|
|
case "$AVB_KEY" in
|
|
*vendor/sunfish-a16/certs/avb.pem) ;;
|
|
*) echo "FAIL: AVB key not project certs/avb.pem ($AVB_KEY)" >&2; exit 1 ;;
|
|
esac
|
|
[[ "$AVB_ALG" == "SHA256_RSA4096" ]] || { echo "FAIL: AVB alg=$AVB_ALG" >&2; exit 1; }
|
|
|
|
echo "=== mka bacon $(date -Is) signing=$PRODUCT_DEFAULT_DEV_CERTIFICATE ==="
|
|
set -o pipefail
|
|
mka bacon -j8
|
|
ec=${PIPESTATUS[0]}
|
|
echo "bacon_exit=$ec $(date -Is)"
|
|
[ "$ec" -eq 0 ] || exit "$ec"
|
|
|
|
# Post-ship gates: drop pipefail. Early-exit awk/head + large pipes otherwise
|
|
# yield exit=141 (SIGPIPE) and skip Magisk/AVB/US-S4 checks.
|
|
set +o pipefail
|
|
|
|
PROD=out/target/product/sunfish
|
|
BID=$(date -u +%Y%m%dT%H%M%SZ)
|
|
DEST=/srv/rom/artifacts/009-axp-los23-port/${BID}-axp-stage1-combo4-cve-hi-releasekeys
|
|
mkdir -p "$DEST"
|
|
|
|
# Ship pair = target_files IMAGES (Magisk boot + matching vbmeta). OUT/*.img can be
|
|
# stock make images that do NOT match the OTA payload — do not prefer those.
|
|
TF_IMG=$(find "$PROD/obj/PACKAGING/target_files_intermediates" -type d -path '*/IMAGES' 2>/dev/null | head -1)
|
|
[[ -n "${TF_IMG:-}" && -d "$TF_IMG" ]] || { echo "FAIL: missing target_files IMAGES" >&2; exit 1; }
|
|
TF_IMG=$(readlink -f "$TF_IMG")
|
|
for f in boot.img vbmeta.img vbmeta_system.img dtbo.img; do
|
|
[[ -f "$TF_IMG/$f" ]] || { echo "FAIL: missing $TF_IMG/$f" >&2; exit 1; }
|
|
cp -v "$TF_IMG/$f" "$DEST/"
|
|
done
|
|
# Large partition images: hardlink into DEST so verify_image stays repeatable
|
|
# after OUT is cleaned (same FS). Fallback: absolute symlink, then full copy.
|
|
for f in vendor.img product.img system.img system_ext.img; do
|
|
[[ -f "$TF_IMG/$f" ]] || continue
|
|
rm -f "$DEST/$f"
|
|
if cp -al "$TF_IMG/$f" "$DEST/$f" 2>/dev/null; then
|
|
echo "hardlink $f -> $DEST/$f"
|
|
elif ln -sfn "$TF_IMG/$f" "$DEST/$f"; then
|
|
echo "symlink-abs $f -> $TF_IMG/$f"
|
|
else
|
|
cp -v "$TF_IMG/$f" "$DEST/$f"
|
|
fi
|
|
done
|
|
# Keep make OUT boot for forensics only (often stock / non-Magisk).
|
|
cp -v "$PROD/boot.img" "$DEST/boot-make-out.img" 2>/dev/null || true
|
|
cp -v "$PROD"/lineage-*-UNOFFICIAL*.zip "$DEST/" 2>/dev/null || \
|
|
cp -v "$PROD"/lineage-*.zip "$DEST/" 2>/dev/null || true
|
|
|
|
# Publish AXP Resurection Pro ship name (hardlink/copy). Lineage bacon.mk still
|
|
# emits lineage-*.zip; do not rebuild solely to rename.
|
|
ZIP_LINEAGE=$(ls "$DEST"/lineage-*.zip 2>/dev/null | head -1 || true)
|
|
if [[ -n "${ZIP_LINEAGE:-}" ]]; then
|
|
# lineage-23.2-YYYYMMDD-UNOFFICIAL[-AXP-Resurection[-Pro]]-sunfish.zip
|
|
# → AXP-Resurection-Pro-23.2-YYYYMMDD-sunfish.zip
|
|
ZIP_BASE=$(basename "$ZIP_LINEAGE")
|
|
ZIP_AXP=$(echo "$ZIP_BASE" | sed -E \
|
|
's/^lineage-([0-9]+\.[0-9]+)-([0-9]{8})(-[0-9]{6})?-UNOFFICIAL(-AXP-Resurection(-Pro)?)?-sunfish\.zip$/AXP-Resurection-Pro-\1-\2\3-sunfish.zip/')
|
|
if [[ "$ZIP_AXP" == "$ZIP_BASE" ]]; then
|
|
ZIP_AXP="AXP-Resurection-Pro-${ZIP_BASE#lineage-}"
|
|
fi
|
|
ln -f "$ZIP_LINEAGE" "$DEST/$ZIP_AXP" 2>/dev/null || cp -v "$ZIP_LINEAGE" "$DEST/$ZIP_AXP"
|
|
echo "ship_zip=$ZIP_AXP (from $ZIP_BASE)"
|
|
fi
|
|
|
|
WLAN=$PROD/vendor/lib/modules/wlan.ko
|
|
if [ -f "$WLAN" ] && [ -f "$PROD/obj/KERNEL_OBJ/Module.symvers" ]; then
|
|
KCRC=$(awk '$2=="kmalloc_caches"{print $1; exit}' "$PROD/obj/KERNEL_OBJ/Module.symvers")
|
|
MCRC=$(/sbin/modprobe --dump-modversions "$WLAN" 2>/dev/null | awk '$2=="kmalloc_caches"{print $1; exit}')
|
|
echo "wlan kmalloc_caches kernel=$KCRC module=$MCRC"
|
|
fi
|
|
|
|
# Avoid pipefail SIGPIPE: never `strings | grep` on large boot.img.
|
|
_BOOT_STR=$(mktemp)
|
|
strings "$DEST/boot.img" >"$_BOOT_STR"
|
|
if grep -iE 'KernelSU|CONFIG_KSU_SUSFS' "$_BOOT_STR" >/dev/null; then
|
|
rm -f "$_BOOT_STR"
|
|
echo "FAIL: KernelSU in boot" >&2
|
|
exit 1
|
|
fi
|
|
rm -f "$_BOOT_STR"
|
|
|
|
# Magisk preroot must be present on the ship boot (magiskboot cpio test: 0=stock, 1=Magisk).
|
|
MAGISKBOOT="$ANDROID_BUILD_TOP/out/.magisk/magiskboot"
|
|
[[ -x "$MAGISKBOOT" ]] || { echo "FAIL: missing $MAGISKBOOT" >&2; exit 1; }
|
|
MB_TMP=$(mktemp -d)
|
|
cp "$DEST/boot.img" "$MB_TMP/boot.img"
|
|
set +e
|
|
( cd "$MB_TMP" && "$MAGISKBOOT" unpack boot.img >/dev/null )
|
|
( cd "$MB_TMP" && "$MAGISKBOOT" cpio ramdisk.cpio test )
|
|
MB_EC=$?
|
|
set -e
|
|
rm -rf "$MB_TMP"
|
|
# magiskboot cpio test: 0=stock, non-zero (usually 1) = Magisk present
|
|
[[ "$MB_EC" -ne 0 ]] || { echo "FAIL: ship boot is stock (magiskboot cpio test=$MB_EC); expected Magisk" >&2; exit 1; }
|
|
echo "magiskboot_cpio_test=$MB_EC (non-zero => Magisk present)"
|
|
|
|
ZIP=$(ls "$DEST"/lineage-*-UNOFFICIAL*.zip 2>/dev/null | head -1 || true)
|
|
if [[ -n "$ZIP" ]]; then
|
|
unzip -p "$ZIP" META-INF/com/android/otacert 2>/dev/null | openssl x509 -noout -subject 2>/dev/null \
|
|
| tee "$DEST/otacert-subject.txt" || true
|
|
if grep -qi 'Test Keys\|Android\|AOSP' "$DEST/otacert-subject.txt" 2>/dev/null; then
|
|
echo "WARN: otacert subject looks like test/AOSP — check keys wire" | tee -a "$DEST/README.txt"
|
|
fi
|
|
fi
|
|
|
|
# US-S3 artifact gates — fail closed (signing infrastructure; NOT runtime AVB harden).
|
|
# flags=3 => HASHTREE_DISABLED|VERIFICATION_DISABLED (libavb); Magisk-friendly unlocked LAB.
|
|
AVBTOOL="$ANDROID_BUILD_TOP/out/host/linux-x86/bin/avbtool"
|
|
AVB_PEM="$ANDROID_BUILD_TOP/vendor/sunfish-a16/certs/avb.pem"
|
|
AVB_PKMD="$ANDROID_BUILD_TOP/vendor/sunfish-a16/certs/avb_pkmd.bin"
|
|
[[ -x "$AVBTOOL" ]] || { echo "FAIL: missing $AVBTOOL" >&2; exit 1; }
|
|
[[ -f "$DEST/vbmeta.img" ]] || { echo "FAIL: missing $DEST/vbmeta.img" >&2; exit 1; }
|
|
[[ -f "$DEST/boot.img" ]] || { echo "FAIL: missing $DEST/boot.img" >&2; exit 1; }
|
|
[[ -f "$AVB_PEM" ]] || { echo "FAIL: missing $AVB_PEM" >&2; exit 1; }
|
|
if [[ ! -f "$AVB_PKMD" ]]; then
|
|
"$AVBTOOL" extract_public_key --key "$AVB_PEM" --output "$AVB_PKMD"
|
|
fi
|
|
|
|
"$AVBTOOL" info_image --image "$DEST/vbmeta.img" | tee "$DEST/vbmeta-info.txt"
|
|
EXP=$(sha1sum "$AVB_PKMD" | awk '{print $1}')
|
|
GOT=$(awk '/^Public key \(sha1\):/{print $NF; exit}' "$DEST/vbmeta-info.txt")
|
|
FLAGS=$(awk '/^Flags:/{print $2; exit}' "$DEST/vbmeta-info.txt")
|
|
echo "avb_pubkey_sha1 artifact=$GOT project=$EXP flags=$FLAGS"
|
|
[[ -n "$GOT" ]] || { echo "FAIL: could not parse vbmeta public key sha1" >&2; exit 1; }
|
|
[[ "$GOT" == "$EXP" ]] || { echo "FAIL: vbmeta pubkey != project avb_pkmd.bin" >&2; exit 1; }
|
|
[[ "$FLAGS" == "3" ]] || { echo "FAIL: expected vbmeta Flags 3 (Magisk track), got '$FLAGS'" >&2; exit 1; }
|
|
|
|
# Cryptographic check against TF sibling images in $DEST (hardlinked/copied).
|
|
# Magisk boot footer is Algorithm NONE — chain trust is top-level vbmeta + project key.
|
|
# Does NOT mean the device will enforce AVB at boot (flags 3 disables that).
|
|
set +e
|
|
(
|
|
cd "$DEST"
|
|
"$AVBTOOL" verify_image --image vbmeta.img --key "$AVB_PEM" \
|
|
--expected_chain_partition "vbmeta_system:1:$AVB_PKMD"
|
|
) >"$DEST/vbmeta-verify.txt" 2>&1
|
|
ec_v=$?
|
|
set -e
|
|
cat "$DEST/vbmeta-verify.txt"
|
|
[[ "$ec_v" -eq 0 ]] || { echo "FAIL: avbtool verify_image vbmeta.img (TF Magisk boot chain)" >&2; exit 1; }
|
|
|
|
set +e
|
|
(
|
|
cd "$DEST"
|
|
"$AVBTOOL" verify_image --image vbmeta_system.img --key "$AVB_PEM"
|
|
) >"$DEST/vbmeta_system-verify.txt" 2>&1
|
|
ec_s=$?
|
|
set -e
|
|
cat "$DEST/vbmeta_system-verify.txt"
|
|
[[ "$ec_s" -eq 0 ]] || { echo "FAIL: avbtool verify_image vbmeta_system.img" >&2; exit 1; }
|
|
|
|
# Boot footer integrity (unsigned Magisk footer is OK); do not require --key match.
|
|
set +e
|
|
(
|
|
cd "$DEST"
|
|
"$AVBTOOL" verify_image --image boot.img
|
|
) >"$DEST/boot-verify.txt" 2>&1
|
|
ec_b=$?
|
|
set -e
|
|
cat "$DEST/boot-verify.txt"
|
|
[[ "$ec_b" -eq 0 ]] || { echo "FAIL: avbtool verify_image boot.img footer/hash" >&2; exit 1; }
|
|
|
|
# US-S4-1 — AXP PRO product surface (binaries gone; init.openssh.rc kept).
|
|
SIMG="$ANDROID_BUILD_TOP/out/host/linux-x86/bin/simg2img"
|
|
[[ -x "$SIMG" ]] || { echo "FAIL: missing $SIMG" >&2; exit 1; }
|
|
[[ -e "$DEST/product.img" ]] || { echo "FAIL: missing $DEST/product.img" >&2; exit 1; }
|
|
PROD_RAW=$(mktemp /tmp/axp-product-XXXX.img)
|
|
"$SIMG" "$DEST/product.img" "$PROD_RAW"
|
|
for p in /bin/sshd /bin/ssh /bin/scp /bin/sftp /bin/rsync /bin/start-ssh; do
|
|
if debugfs -R "stat $p" "$PROD_RAW" 2>&1 | grep -q 'Inode:'; then
|
|
rm -f "$PROD_RAW"
|
|
echo "FAIL: US-S4 expected absent $p on product.img" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
if ! debugfs -R "stat /etc/init/init.openssh.rc" "$PROD_RAW" 2>&1 | grep -q 'Inode:'; then
|
|
rm -f "$PROD_RAW"
|
|
echo "FAIL: US-S4 expected init.openssh.rc present (AXP surface)" >&2
|
|
exit 1
|
|
fi
|
|
echo "US-S4-1 product surface OK (no ssh/rsync bins; init.openssh.rc present)"
|
|
|
|
# US-S4-2 — AXP PRO: no Jelly / Gallery2 *apps* on product (Fossify stays).
|
|
# Note: LOCAL_OVERRIDES removes Gallery2.apk but stale JNI symlink dirs under
|
|
# product/app/Gallery2/lib can remain from older out/ — gate on the APK.
|
|
for p in /app/Jelly/Jelly.apk /app/Gallery2/Gallery2.apk; do
|
|
if debugfs -R "stat $p" "$PROD_RAW" 2>&1 | grep -q 'Inode:'; then
|
|
rm -f "$PROD_RAW"
|
|
echo "FAIL: US-S4-2 expected absent $p on product.img" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
# Directory-only Gallery2 leftover (jni symlinks) is not a shipped app — warn.
|
|
if debugfs -R "stat /app/Gallery2" "$PROD_RAW" 2>&1 | grep -q 'Inode:'; then
|
|
echo "WARN: US-S4-2 /app/Gallery2 dir still present (likely stale jni symlinks; no APK)"
|
|
fi
|
|
if ! debugfs -R "stat /app/FossifyGallery" "$PROD_RAW" 2>&1 | grep -q 'Inode:'; then
|
|
rm -f "$PROD_RAW"
|
|
echo "FAIL: US-S4-2 expected FossifyGallery present" >&2
|
|
exit 1
|
|
fi
|
|
rm -f "$PROD_RAW"
|
|
echo "US-S4-2 product surface OK (no Jelly/Gallery2 APK; FossifyGallery present)"
|
|
|
|
{
|
|
echo "artifact=$DEST"
|
|
echo "list_clean=$LIST_CLEAN (429)"
|
|
echo "list_hi=batch1+2+3"
|
|
echo "hardening=Stage1+combo4+FORTIFY + CVE-clean + hi-batch1+2+3 + US-S4-1-no-openssh + US-S4-2-no-jelly-gallery2 + US-S5-1-yama-slabrand"
|
|
echo "branding=AXP-Resurection-Pro"
|
|
echo "signing=$PRODUCT_DEFAULT_DEV_CERTIFICATE"
|
|
echo "avb_infra=$AVB_KEY alg=$AVB_ALG flags=3 (HASHTREE_DISABLED|VERIFICATION_DISABLED)"
|
|
echo "avb_runtime_enforce=no (unlocked Magisk track; not AVB-hardened boot)"
|
|
echo "avb_pubkey_sha1=$GOT"
|
|
echo "magiskboot_cpio_test=$MB_EC"
|
|
echo "ship_images=target_files/IMAGES (not OUT make images)"
|
|
echo "ship_zip_brand=AXP-Resurection-Pro-*-sunfish.zip (sibling of lineage-*.zip; not slim)"
|
|
echo "flash=sideload AXP-Resurection-Pro zip (or lineage twin); boot-only insufficient"
|
|
echo "recover=20261002T085915Z-axp-stage1-combo4-cve-hi-releasekeys"
|
|
echo "bootloader_lock=wont"
|
|
echo "oem_unlock=leave_enabled_escape_hatch_not_guaranteed_recovery"
|
|
date -u +"built=%Y-%m-%dT%H:%M:%SZ"
|
|
} | tee "$DEST/README.txt"
|
|
|
|
(cd "$DEST" && sha256sum boot.img boot-make-out.img vbmeta.img vbmeta_system.img dtbo.img \
|
|
lineage-*.zip AXP-Resurection-Pro-*.zip 2>/dev/null || true) \
|
|
| tee "$DEST/SHA256SUMS"
|
|
|
|
echo "FLASH_READY $DEST"
|
|
echo "=== DONE $DEST $(date -Is) ==="
|
|
exit 0
|