Jorijn van der Graaf
8ea35b890a
Two field units got no fingerprint sensor from fingerprintd 0.2.3's manifest: its focal64 line pinned the sha256 of one Android build's trustlet (16.82.0, the dev phone's), and Fairphone re-signs that trustlet every release, so the pin matches exactly one of the six builds seen. A user on 16.100.0 had to edit the manifest by hand; another ended up with a file QTEE refuses. The extractor now tries the active slot's partitions first (androidboot.slot_suffix from the kernel command line): for a signed image only the running TZ's own slot is guaranteed to load. An mbn line may give '-' instead of a hash, which means structural verification only: ELF64 header, every segment present at the size its program header declares, page-aligned offsets, a sane total. The loader in TZ verifies the signature and the per-segment hashes itself and refuses a damaged or foreign image (one flipped byte -> ERROR_ELF_SIGNATURE_ERROR, measured), so the whole-image hash added fragility and no protection. A real sha256 is still honoured, and the sha256 of what was installed is logged either way. --refresh re-derives mbn dests even when a file exists, replacing it only with an image that verifies; consumers call it from post-install/post-upgrade so a fresh 'apk add' needs no reboot and a hand-placed or wrongly pinned trustlet is replaced on the next upgrade. Verified on the dev phone (busybox): malformed inputs are refused with a reason (missing, truncated or oversize segment; non-ELF, ELF32 or short mdt; a garbage offset), both slots reassemble to the known-good hash, a foreign file survives a plain run and is replaced by --refresh, a failed refresh keeps the old file, pins still work, and the real post-upgrade path re-derived the installed trustlet with the daemon restarting on it. Record: fp6 repo journal/blobs/ and journal/fingerprint/, 2026-09-11.
68 lines
3.6 KiB
Text
68 lines
3.6 KiB
Text
# First-boot, on-device extraction of proprietary blobs from the stock
|
|
# Android partitions, so the image never has to ship or distribute them.
|
|
# pmOS installs flash only boot+userdata: the stock vendor/dsp partitions
|
|
# stay on every installed unit, and the device duplicates files it already
|
|
# lawfully contains, for its own operation. Design, legal frame and the
|
|
# on-phone verification: fp6 repo journal/blobs/.
|
|
#
|
|
# Consumers depend on this package and install a manifest fragment into
|
|
# /usr/share/fp6-vendor-blobs/manifest.d/ (syntax in the extract script);
|
|
# their post-install/post-upgrade should also run
|
|
# /usr/lib/fp6-vendor-blobs/extract --if-device so a package upgrade that
|
|
# drops a previously-shipped blob restores the file immediately instead of
|
|
# at the next boot (--refresh in addition for an mbn consumer: it re-derives
|
|
# the trustlet from the active slot even if a file is present). Consumers:
|
|
# soc-fairphone-fp6-audio (aw88261 acf), fingerprintd (focal64 trustlet).
|
|
#
|
|
# 1-r3 (2026-09-11): active slot first, an unpinned ('-') structurally
|
|
# verified mode for mbn, --refresh -- after two field units got no
|
|
# fingerprint sensor from a whole-image hash pin that can only match one
|
|
# Android build (fp6 repo journal/blobs/, journal/fingerprint/).
|
|
maintainer="Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>"
|
|
pkgname=fp6-vendor-blobs
|
|
pkgver=1
|
|
pkgrel=3
|
|
pkgdesc="On-device extraction of vendor blobs from the stock Android partitions"
|
|
url="https://forgejo.catcrafts.net/Catcrafts/fp6-img"
|
|
arch="noarch"
|
|
license="MIT"
|
|
# fallback mapper for when the initramfs didn't map the dynamic partitions
|
|
depends="make-dynpart-mappings"
|
|
install="$pkgname.post-upgrade"
|
|
options="!check"
|
|
source="
|
|
fp6-vendor-blobs-extract
|
|
fp6-vendor-blobs.service
|
|
fp6-vendor-blobs.preset
|
|
"
|
|
|
|
package() {
|
|
install -Dm755 "$srcdir"/fp6-vendor-blobs-extract \
|
|
"$pkgdir"/usr/lib/fp6-vendor-blobs/extract
|
|
install -Dm644 "$srcdir"/fp6-vendor-blobs.service \
|
|
"$pkgdir"/usr/lib/systemd/system/fp6-vendor-blobs.service
|
|
# enabled unconditionally: the unit is a fast no-op once every manifest
|
|
# dest exists, and blobs appearing on first boot must not depend on a
|
|
# manual systemctl enable. sysinit = the real (pre-coldplug) run;
|
|
# multi-user = the post-udev retry if the early run failed (see unit)
|
|
mkdir -p "$pkgdir"/etc/systemd/system/sysinit.target.wants \
|
|
"$pkgdir"/etc/systemd/system/multi-user.target.wants
|
|
ln -s /usr/lib/systemd/system/fp6-vendor-blobs.service \
|
|
"$pkgdir"/etc/systemd/system/sysinit.target.wants/fp6-vendor-blobs.service
|
|
ln -s /usr/lib/systemd/system/fp6-vendor-blobs.service \
|
|
"$pkgdir"/etc/systemd/system/multi-user.target.wants/fp6-vendor-blobs.service
|
|
# ...and a preset, because the symlink alone does NOT survive: image
|
|
# build runs `systemctl preset-all`, which removes .wants links for any
|
|
# unit not enabled by a preset. That is what shipped the 2026-08-24
|
|
# image with the service `disabled; preset: disabled` -- no blob
|
|
# extracted, no sound card. See journal/blobs/ 2026-08-28.
|
|
install -Dm644 "$srcdir"/fp6-vendor-blobs.preset \
|
|
"$pkgdir"/usr/lib/systemd/system-preset/50-fp6-vendor-blobs.preset
|
|
mkdir -p "$pkgdir"/usr/share/fp6-vendor-blobs/manifest.d
|
|
}
|
|
|
|
sha512sums="
|
|
e9618b4a1ccbe0913a608b32a1a9e87337e3da79a3d7ccc7f49292ae9aaa9406d2ea9817d63b3cfff2c4346b80dd2476c10725f4f0f95c859acd17b22ec03a16 fp6-vendor-blobs-extract
|
|
b4c290095d9f39515378dfef08de720ce49324210342aa13c131dfce1103785e796e6f821f0c659671a4c44b46f466ce0e03f11f216fdcdee2a99db5e7970800 fp6-vendor-blobs.service
|
|
9e79dd0aed13f11a71282aa24b2a26331e85c105e25ab0c0fed6189b8c300769a5f4308b18b91d9855868d658ad3a57c03e26c9b11bd27fd5e03f9a5decbbd6a fp6-vendor-blobs.preset
|
|
"
|