aports: extract aw88261_acf.bin on-device instead of shipping it

New package fp6-vendor-blobs: a manifest-driven systemd oneshot that
copies proprietary blobs out of the stock Android partitions on first
boot. pmOS installs flash only boot+userdata, so every installed unit
still carries the stock vendor/dsp partitions - the device duplicates a
file it already contains, for its own operation, and nothing proprietary
is distributed by us. Partitions are mounted read-only (ext4 additionally
with noload - not even a journal replay touches the stock data), every
copy is sha256-pinned and a miss fails loudly, and the consuming devices
are unbound and re-probed afterwards so the feature works the same boot.

The rebind is unconditional by design: aw88261 binds on a bare i2c
chip-id probe and requests the ACF only at ASoC card init (~21 s, after
SoundWire enumeration), so a bound device can still be one that lost the
firmware race - and that failed request is never retried.

soc-fairphone-fp6-audio (pkgver 4) stops shipping the blob, installs the
manifest fragment instead, and re-runs the extractor from
post-install/post-upgrade so upgrades restore the file immediately (the
old package version removed it on upgrade). License drops back to plain
BSD-3-Clause - nothing proprietary left in the package.

Verified on the dev phone (fp6 repo journal/blobs/captures/
2026-08-24-first-boot-extractor-verification.txt): first-boot extraction
+ same-boot audio, mid-session post-upgrade recovery, and the everyday
fast-path no-op; committed files byte-identical to the tested deployment.

Assisted-by: Claude:claude-fable-5

aports/device/fp6-vendor-blobs/APKBUILD

@@ -0,0 +1,47 @@
+# First-boot, on-device extraction of proprietary blobs from the stock
+# Android partitions, so the image never has to ship or distribute them.
+# pmOS installs flash only boot+userdata: the stock vendor/dsp partitions
+# stay on every installed unit, and the device duplicates files it already
+# lawfully contains, for its own operation. Design, legal frame and the
+# on-phone verification: fp6 repo journal/blobs/.
+#
+# Consumers depend on this package and install a manifest fragment into
+# /usr/share/fp6-vendor-blobs/manifest.d/ (syntax in the extract script);
+# their post-install/post-upgrade should also run
+# /usr/lib/fp6-vendor-blobs/extract --if-device so a package upgrade that
+# drops a previously-shipped blob restores the file immediately instead of
+# at the next boot. First consumer: soc-fairphone-fp6-audio (aw88261 acf).
+maintainer="Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>"
+pkgname=fp6-vendor-blobs
+pkgver=1
+pkgrel=0
+pkgdesc="On-device extraction of vendor blobs from the stock Android partitions"
+url="https://forgejo.catcrafts.net/Catcrafts/fp6-img"
+arch="noarch"
+license="MIT"
+# fallback mapper for when the initramfs didn't map the dynamic partitions
+depends="make-dynpart-mappings"
+options="!check"
+source="
+	fp6-vendor-blobs-extract
+	fp6-vendor-blobs.service
+"
+
+package() {
+	install -Dm755 "$srcdir"/fp6-vendor-blobs-extract \
+		"$pkgdir"/usr/lib/fp6-vendor-blobs/extract
+	install -Dm644 "$srcdir"/fp6-vendor-blobs.service \
+		"$pkgdir"/usr/lib/systemd/system/fp6-vendor-blobs.service
+	# enabled unconditionally: the unit is a fast no-op once every manifest
+	# dest exists, and blobs appearing on first boot must not depend on a
+	# manual systemctl enable
+	mkdir -p "$pkgdir"/etc/systemd/system/multi-user.target.wants
+	ln -s /usr/lib/systemd/system/fp6-vendor-blobs.service \
+		"$pkgdir"/etc/systemd/system/multi-user.target.wants/fp6-vendor-blobs.service
+	mkdir -p "$pkgdir"/usr/share/fp6-vendor-blobs/manifest.d
+}
+
+sha512sums="
+a71b2c86f980734d0aae6e135b26272fe52ae5603050bea52f55f7e74c8bd98c62b6194047711248d4fef40851792adc47d77c40016d99a0d68ecd2459894b80  fp6-vendor-blobs-extract
+e2c03e5016f1848c57e6160ce432530b181ff5d34a5aaf1822f0ffa5fe71d16691657ada4a5789c4d4209e14e83f43aab072d01f644b07b93648f91e2a7bb0ca  fp6-vendor-blobs.service
+"

aports/device/fp6-vendor-blobs/fp6-vendor-blobs-extract

@@ -0,0 +1,190 @@
+#!/bin/sh -u
+# fp6-vendor-blobs-extract - copy proprietary blobs out of the stock Android
+# partitions instead of distributing them. pmOS installs flash only
+# boot+userdata, so every installed FP6 still carries the stock vendor/dsp
+# partitions: the device duplicates files it already contains, for its own
+# operation - nothing is distributed by us or anyone else. Design, legal
+# frame and on-phone verification: fp6 repo journal/blobs/.
+#
+# Manifest fragments: /usr/share/fp6-vendor-blobs/manifest.d/*.manifest,
+# processed in sorted order; '#' comments and blank lines ignored:
+#
+#   file <partition[,partition...]> <path-in-partition> <dest> <sha256>
+#   rebind <bus> <device>
+#
+# file: mount the first available listed partition READ-ONLY (ext4 also
+#   gets -o noload - never a byte written to the stock partitions, not
+#   even a journal replay), copy <path-in-partition> to <dest>, verify the
+#   sha256. A missing source or a hash mismatch tries the next listed
+#   partition; no verified copy on any of them fails the run loudly - an
+#   unverified blob is never installed and a missing one never silently
+#   skipped. Dests that already exist are left alone (no hashing: a
+#   deliberately replaced file stays).
+# rebind: if this fragment's run extracted at least one file, unbind and
+#   re-probe <device> on <bus> so the consuming driver picks the file up
+#   in the same boot. Unconditional on purpose: a still-bound consumer may
+#   have already failed a deferred firmware request that is never retried
+#   (aw88261 binds on i2c probe but requests the ACF only at card init),
+#   so only a fresh probe with the file present is a known-good state.
+#   All of a fragment's devices are unbound first, then re-probed, so a
+#   shared sound card re-forms once instead of bouncing per device.
+#
+# Partitions resolve via /dev/mapper (the pmOS initramfs maps the dynamic
+# partitions in super on every boot), then /dev/disk/by-partlabel (raw
+# partitions like dsp_a), then one make-dynpart-mappings fallback run;
+# mappings that run creates are removed again at the end.
+#
+# --if-device: exit 0 quietly when no stock super partition is visible
+#   (apk post-install scripts run inside build/CI chroots too; on images
+#   built there the first-boot service does the real extraction).
+
+MANIFEST_DIR=/usr/share/fp6-vendor-blobs/manifest.d
+SUPER=/dev/disk/by-partlabel/super
+MNT=
+MNT_PART=
+CREATED=
+TRIED_MAPPING=
+
+log() { echo "fp6-vendor-blobs: $*"; }
+
+unmount_cur() {
+	if [ -n "$MNT" ]; then
+		umount "$MNT" 2>/dev/null
+		rmdir "$MNT" 2>/dev/null
+		MNT= MNT_PART=
+	fi
+}
+
+cleanup() {
+	unmount_cur
+	for name in $CREATED; do
+		dmsetup remove "$name" 2>/dev/null || true
+	done
+	CREATED=
+}
+
+fail() {
+	echo "fp6-vendor-blobs: ERROR: $*" >&2
+	cleanup
+	exit 1
+}
+
+# resolve a partition name to a block device
+part_dev() {
+	[ -b "/dev/mapper/$1" ] && { echo "/dev/mapper/$1"; return 0; }
+	[ -b "/dev/disk/by-partlabel/$1" ] && { echo "/dev/disk/by-partlabel/$1"; return 0; }
+	if [ -z "$TRIED_MAPPING" ] && [ -b "$SUPER" ]; then
+		TRIED_MAPPING=1
+		before=$(dmsetup ls 2>/dev/null | awk '{print $1}')
+		make-dynpart-mappings "$SUPER" 0 2>/dev/null
+		after=$(dmsetup ls 2>/dev/null | awk '{print $1}')
+		for name in $after; do
+			case " $before " in *" $name "*) ;; *) CREATED="$CREATED $name" ;; esac
+		done
+		[ -n "$CREATED" ] && log "mapped dynamic partitions:$CREATED"
+		[ -b "/dev/mapper/$1" ] && { echo "/dev/mapper/$1"; return 0; }
+	fi
+	return 1
+}
+
+mount_part() {
+	[ "$MNT_PART" = "$1" ] && return 0
+	unmount_cur
+	dev=$(part_dev "$1") || return 1
+	dir=$(mktemp -d /run/fp6-vendor-blobs.XXXXXX) || fail "mktemp failed"
+	# noload succeeds on any ext4 and correctly fails on non-ext4, where
+	# plain ro cannot write anyway (erofs); a dirty ext4 is never replayed
+	if ! mount -o ro,noload "$dev" "$dir" 2>/dev/null && \
+	   ! mount -o ro "$dev" "$dir" 2>/dev/null; then
+		rmdir "$dir" 2>/dev/null
+		return 1
+	fi
+	MNT=$dir
+	MNT_PART=$1
+}
+
+extract() { # <partition,...> <path-in-partition> <dest> <sha256>
+	parts=$1 src=$2 dest=$3 want=$4
+	for part in $(echo "$parts" | tr ',' ' '); do
+		mount_part "$part" || { log "$part: not mountable, trying next"; continue; }
+		[ -f "$MNT/$src" ] || { log "$part: no $src, trying next"; continue; }
+		tmp="$dest.fp6-extract.$$"
+		mkdir -p "${dest%/*}" || fail "cannot create ${dest%/*}"
+		cp "$MNT/$src" "$tmp" || { rm -f "$tmp"; fail "copying $part:$src failed"; }
+		got=$(sha256sum "$tmp" | awk '{print $1}')
+		if [ "$got" != "$want" ]; then
+			rm -f "$tmp"
+			log "$part:$src sha256 $got != expected, trying next"
+			continue
+		fi
+		chmod 644 "$tmp" && mv "$tmp" "$dest" || { rm -f "$tmp"; fail "installing $dest failed"; }
+		log "extracted $part:$src -> $dest"
+		return 0
+	done
+	fail "no listed partition ($parts) yields $src with sha256 $want - $dest NOT installed"
+}
+
+rebind_all() { # <bus/device ...>
+	for rb in $1; do
+		bus=${rb%%/*} dev=${rb#*/}
+		[ -e "/sys/bus/$bus/devices/$dev/driver" ] || continue
+		if echo "$dev" > "/sys/bus/$bus/devices/$dev/driver/unbind" 2>/dev/null; then
+			log "unbound $bus $dev"
+		fi
+	done
+	for rb in $1; do
+		bus=${rb%%/*} dev=${rb#*/}
+		if [ ! -e "/sys/bus/$bus/devices/$dev" ]; then
+			log "rebind: no $dev on bus $bus (yet) - its driver will probe on its own"
+		elif echo "$dev" > "/sys/bus/$bus/drivers_probe" 2>/dev/null; then
+			log "re-probed $bus $dev"
+		else
+			log "rebind: drivers_probe of $dev failed (driver not loaded yet?)"
+		fi
+	done
+}
+
+if [ "${1:-}" = --if-device ] && [ ! -b "$SUPER" ]; then
+	log "no stock super partition visible (build chroot?), nothing to do"
+	exit 0
+fi
+
+[ -d "$MANIFEST_DIR" ] || exit 0
+
+# fast path for every boot after the first: all dests already present
+missing=
+for f in "$MANIFEST_DIR"/*.manifest; do
+	[ -e "$f" ] || continue
+	while read -r kind _ _ dest _; do
+		[ "$kind" = file ] && [ ! -e "$dest" ] && missing=1
+	done < "$f"
+done
+[ -z "$missing" ] && exit 0
+
+for f in "$MANIFEST_DIR"/*.manifest; do
+	[ -e "$f" ] || continue
+	extracted=
+	rebinds=
+	while read -r kind a b c d; do
+		case "$kind" in
+		''|'#'*) ;;
+		file)
+			[ -n "$d" ] || fail "$f: malformed file line"
+			[ -e "$c" ] && continue
+			extract "$a" "$b" "$c" "$d" </dev/null
+			extracted=1
+			;;
+		rebind)
+			[ -n "$b" ] || fail "$f: malformed rebind line"
+			rebinds="$rebinds $a/$b"
+			;;
+		*) fail "$f: unknown directive '$kind'" ;;
+		esac
+	done < "$f"
+	if [ -n "$extracted" ] && [ -n "$rebinds" ]; then
+		rebind_all "$rebinds" </dev/null
+	fi
+done
+
+cleanup
+exit 0

aports/device/fp6-vendor-blobs/fp6-vendor-blobs.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=Extract vendor blobs from the stock Android partitions
+# The dynamic-partition mappings come from the initramfs and the dests live
+# on the rootfs, so local-fs ordering is enough. Deliberately not ordered
+# against driver/audio bringup: the extractor re-probes consumers itself
+# (manifest rebind lines), so it never has to win a race.
+After=local-fs.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/lib/fp6-vendor-blobs/extract
+
+[Install]
+WantedBy=multi-user.target

aports/device/soc-fairphone-fp6-audio/APKBUILD

@@ -1,27 +1,27 @@
 # Audio userspace files for the Fairphone 6 that no upstream package ships
 # yet: the AudioReach topology (built from Catcrafts/audioreach-topology
-# branch fp6), the AW88261 amp config blob, and the UCM profile. Files are
+# branch fp6), the UCM profile, and pipewire config. Files are
 # byte-identical to the ones deployed and tested on the development FP6.
 # The tplg/UCM target filenames contain spaces, hence the safe source names.
 #
-# Licensing: the topology (built from BSD-3-Clause audioreach-topology
+# The proprietary AW88261 amp config blob (aw88261_acf.bin) is NOT shipped
-# sources) and the UCM/pipewire configs are BSD-3-Clause. aw88261_acf.bin
+# since pkgver 4: fp6-vendor-blobs extracts it from the stock vendor
-# is a verbatim proprietary Awinic amp-config blob extracted from the
+# partition on-device (manifest fragment below), so nothing proprietary is
-# FP6's stock vendor partition; its redistribution status is unresolved
+# distributed. Provenance/design: fp6 repo journal/blobs/.
-# (candidate for FairBlobs adoption or install-time on-device extraction
-# from the stock vendor partition, which pmOS installs leave in place).
 maintainer="Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>"
 pkgname=soc-fairphone-fp6-audio
-pkgver=3
+pkgver=4
-pkgrel=1
+pkgrel=0
-pkgdesc="Fairphone 6 audio topology, amp firmware and UCM profile"
+pkgdesc="Fairphone 6 audio topology and UCM profile"
 url="https://forgejo.catcrafts.net/Catcrafts/audioreach-topology"
 arch="noarch"
-license="BSD-3-Clause AND proprietary"
+license="BSD-3-Clause"
+depends="fp6-vendor-blobs"
+install="$pkgname.post-install $pkgname.post-upgrade"
 options="!check"
 source="
 	fp6-tplg.bin
-	aw88261_acf.bin
+	aw88261-acf.manifest
 	ucm-milos-fp6.conf
 	HiFi.conf
 	50-echo-cancel.conf
@@ -30,8 +30,8 @@ source="
 package() {
 	install -Dm644 "$srcdir"/fp6-tplg.bin \
 		"$pkgdir/usr/lib/firmware/qcom/milos/Fairphone (Gen. 6)-tplg.bin"
-	install -Dm644 "$srcdir"/aw88261_acf.bin \
+	install -Dm644 "$srcdir"/aw88261-acf.manifest \
-		"$pkgdir"/usr/lib/firmware/qcom/milos/fairphone/fp6/aw88261_acf.bin
+		"$pkgdir"/usr/share/fp6-vendor-blobs/manifest.d/10-aw88261-acf.manifest
 	install -Dm644 "$srcdir"/ucm-milos-fp6.conf \
 		"$pkgdir/usr/share/alsa/ucm2/conf.d/milos/Fairphone (Gen. 6).conf"
 	install -Dm644 "$srcdir"/HiFi.conf \
@@ -47,7 +47,7 @@ package() {
 
 sha512sums="
 51071c574b9f5899c78ba9fe1b6f3bbda2195e6d274014a05869ae56ed0ff18e15678bd7d78cd68846900d3c579556328e229842152cffd943186d43344ed33c  fp6-tplg.bin
-a84b0595ae71b0bb594034a9f5fd77b984c9086cd917f32524c4b5172bc72a426e5d188d18dbccdb587f66d60fa15cad441fffcd48a3a1ce66335199b61e0350  aw88261_acf.bin
+bdfe413494b6815cf96843d83c6c9e8deb757b083d7577c93eab460de49d1cd00b8615c115c25d71f6488de4e65f04d5f02bca816b2c31747880a22613e547a3  aw88261-acf.manifest
 3bb268f9fcb8d1c0b42741b67da42b6361bab259e7211d9930919995ebe7dcf67826e6d4f00ff5e4fe5b52067fe90d00212158c3b4879d1bee481e87f0623206  ucm-milos-fp6.conf
 2a189c3141fedc43f8eb19f4df1e43487223d524e27da3f948556d224cca1f493f6815ada191953fb79a19d5c5abadb21de7b3ece7b74b0929338c216e21e84a  HiFi.conf
 ec63fa5363738a43c9eee4b1be70201e2d2076ec817031fda087e61d781e81dc67351be44faf8b056a2939875a139cd909f7c311115bb1150e17ad4493846606  50-echo-cancel.conf

aports/device/soc-fairphone-fp6-audio/aw88261-acf.manifest

@@ -0,0 +1,10 @@
+# AW88261 smart-amp config blob (proprietary, Awinic) - extracted from the
+# stock vendor partition on-device instead of being shipped (fp6 repo
+# journal/blobs/, 2026-08-24). Slot A first, slot B as fallback; the copy
+# must hash-match the blob the audio stack was tested with.
+file vendor_a,vendor_b firmware/aw882xx_acf.bin /usr/lib/firmware/qcom/milos/fairphone/fp6/aw88261_acf.bin af723973655ba5901948d4a22212323e39ce53ff0156021185720af4af6ab0b3
+# the amps bind on i2c probe but request the ACF only at card init, which
+# races the extractor on first boot and is never retried on failure - a
+# forced fresh probe of both amps makes audio work that same boot either way
+rebind i2c 6-0034
+rebind i2c 6-0035

aports/device/soc-fairphone-fp6-audio/soc-fairphone-fp6-audio.post-install

@@ -0,0 +1,6 @@
+#!/bin/sh
+# aw88261_acf.bin is not shipped - extract it from the stock vendor
+# partition right away rather than at the next boot. --if-device makes
+# this a quiet no-op inside build/CI chroots (the image's first boot
+# runs fp6-vendor-blobs.service instead).
+exec /usr/lib/fp6-vendor-blobs/extract --if-device

aports/device/soc-fairphone-fp6-audio/soc-fairphone-fp6-audio.post-upgrade

@@ -0,0 +1,6 @@
+#!/bin/sh
+# aw88261_acf.bin is not shipped - extract it from the stock vendor
+# partition right away rather than at the next boot. --if-device makes
+# this a quiet no-op inside build/CI chroots (the image's first boot
+# runs fp6-vendor-blobs.service instead).
+exec /usr/lib/fp6-vendor-blobs/extract --if-device

build.sh

@@ -129,6 +129,7 @@ rm -rf "$WORK/pmaports/device/testing/linux-postmarketos-qcom-milos" \
 mkdir -p "$WORK/pmaports/temp"
 cp -r aports/device/linux-postmarketos-qcom-milos "$WORK/pmaports/device/testing/"
 cp -r aports/device/soc-fairphone-fp6-audio "$WORK/pmaports/device/"
+cp -r aports/device/fp6-vendor-blobs "$WORK/pmaports/device/"
 cp -r aports/device/callaudioshim "$WORK/pmaports/device/"
 cp -r aports/device/fp6-device-tweaks "$WORK/pmaports/device/"
 cp -r aports/device/fp6-charging-mode "$WORK/pmaports/device/"