Alpine's community/libqmi is at upstream 1c972b8a (2026-10-05), 23 commits
past the 30f3e998 this fork pinned "just past the !470 merge", with the
qmi-glib 1.39.1 the GNSS patches in modemmanager need. No patch was left;
the fork's one remaining addition, the FP6-tuned build (-march/-mtune,
whose gain was never measured), goes with it. build.sh loses its tarball,
checksum and build steps.
The registry still serves the fork (1.39.1_git20260808-r100 and -r101),
and that version outranks Alpine's 1.38.0_git* line, so with the aport
alone installed phones keep the fork and a fresh image takes it back at
its first 'apk upgrade': the fork's packages are deleted from the
registry with this push. Fresh images then install Alpine's libqmi and
keep it. Installed phones keep the fork until 'apk upgrade -a' downgrades
them to Alpine's or Alpine's version passes 1.39.1; the new modemmanager
works on either (verified on the FP6 with both).
pmbootstrap keeps a local package repository in its work dir and consults
it before every other repository. Whether that dir survives from one CI
run to the next is not established (run 60 rebuilt libqmi, modemmanager
and libcamera at the versions run 58 had built, which says it did not),
but nothing guarantees it either way, so build.sh deletes any
libqmi/qmi-utils apks found there before building, re-indexes the
repository from the files present and fails the run if any are left; the
publish step skips libqmi-*/qmi-utils-* as the backstop. pmbootstrap's
'zap --pkgs-local-mismatch' cannot do this: with systemd selected it looks
at packages/systemd-edge, not at the packages/edge the builds land in.
FP6IMG_UI selects the postmarketOS UI (plasma-mobile, the default, or
phosh). The package set is the same except that the Phosh image adds
imsd's opt-in imsd-ofono subpackage, the GNOME Calls backend; everything
else in it is UI-agnostic. The archive is named after the UI
(fp6-img-phosh.tar.xz), build-info.txt records it, and the workflow runs
the Phosh build as a second step of the same job with FP6IMG_KEEP_DIST=1
so both archives land in one release. Both knobs are carried across the
su into the build user.
The Phosh variant needs imsd 0.3.8 in the registry: that release ships
the preset that enables imsd-ofonod and keeps GNOME Calls alive across
imsd restarts.
The daemon's own package CI publishes it to the registry the same way imsd's
does, so the image takes it from there: the exact apk a user later gets via
apk upgrade, sha256-pinned, re-signed for the chroot. Section 3b now fetches
both sets, and every fetched file must have a pin -- the check used to be
`grep . | sha256sum -c`, which an empty pin list would have sailed through
with nothing checked.
Three apks: the daemon, its systemd units, and the session agent, which does
nothing until a user writes ~/.config/fingerprintd/fingers.conf. The daemon
needs the kernel aport's CONFIG_QCOMTEE=m (pkgrel 101) and fp6-vendor-blobs
1-r2's mbn directive to reassemble the trustlet, both built in this run;
0.2.3 says >=1-r2 so a mismatched pair is refused rather than installed.
The CI publish step skips fingerprintd-* like imsd-*: registry-sourced, not
ours to republish. README: fingerprint in the list, and the two things a user
will otherwise report as a dead sensor -- the lock screen listens for 60
seconds after it appears, and a held press is what the matcher was measured
on -- plus the untested question of stock Android's own fingerprints after
using this.
Verified on the dev phone (fp6 repo journal/fingerprint/, 2026-09-05): the
registry 0.2.2 package enrols through Plasma's Users page and unlocks the
lock screen; 0.2.3 differs by the dependency and a post-upgrade restart. The
image build itself, with the fprintd purge inside the chroot, runs first in
CI.
The imsd repo's package CI is now the only producer of the imsd apk. The
image installs the exact registry package users get via 'apk upgrade'
(pinned version + sha256 of the registry files), so the two can no longer
diverge and the payload-parity rule between two packagings is gone.
pmbootstrap has no knob for a third-party repository, and after the main
'apk add' it re-adds every package in its local packages dir by file path,
which makes apk verify the package's own signature. Registry packages are
signed with per-run keys nobody keeps (phones trust the registry-signed
index), so apk-resign.py replaces the signature stream with one from this
run's abuild key; control and data streams stay byte-identical and the
identity checksum equals the registry's. Verified on the host with apk
3.0.8: originals UNTRUSTED, re-signed OK, checksums equal.
The publish step skips imsd-*: those files came from the registry.
CI publishes every locally built apk to the instance's Alpine registry
(catbot credentials via the PACKAGE_TOKEN secret; step skips until it
exists). catcrafts-fp6-repo ships the registry signing key and appends
the repo URL - NOT yet in extra_packages: the registry must have its
first content before image builds may reference it (an empty repo's
missing APKINDEX would break apk in the build chroots).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
'pmbootstrap config' demands an existing config file, so write
pmbootstrap_v3.cfg ourselves (INI, aports/device/ui/systemd). Explicit
set -eu because 'sh script' ignores shebang flags - run 3 shipped a
3.5KB 'image' because failures didn't propagate. dist/ is now the only
build-user-owned path, so the tag step's git works again.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Learned from the pmbootstrap 3.11 source: aports overlays must replace
upstream dirs in one tree (duplicate pkgnames are a hard error), pmbootstrap
refuses root (drop to a sudo-capable build user), and export symlinks are
boot.img + fairphone-fp6.img. Stage 1 builds without imsd until the v0.3.0
tag exists. Temporary push trigger for bring-up.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Kernel aport forked from pmaports 7.1.2-r0, repointed at milos-linux
combined-stable with the tested FP6 config (+EFI_ZBOOT for packaging);
imsd + nftables aports from the pending pmaports submission. build.sh
carries TODO(validate) markers - not yet run end-to-end.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
