fp6-img/aports/device/fp6-vendor-blobs/APKBUILD
Jorijn van der Graaf 1c037c511d
aports: our own packages are GPL-3.0-only, as the repository is
fp6-charging-mode, fp6-device-tweaks, fp6-vendor-blobs and catcrafts-fp6-repo
declared license="MIT"; their contents are ours and GPL-3.0-only, as LICENSE
says since c9bac2c. No pkgrel bump: the field reaches the published packages
at each package's next bump.
2026-10-16 23:27:17 +02:00

68 lines
3.6 KiB
Text

# First-boot, on-device extraction of proprietary blobs from the stock
# Android partitions, so the image never has to ship or distribute them.
# pmOS installs flash only boot+userdata: the stock vendor/dsp partitions
# stay on every installed unit, and the device duplicates files it already
# lawfully contains, for its own operation. Design, legal frame and the
# on-phone verification: fp6 repo journal/blobs/.
#
# Consumers depend on this package and install a manifest fragment into
# /usr/share/fp6-vendor-blobs/manifest.d/ (syntax in the extract script);
# their post-install/post-upgrade should also run
# /usr/lib/fp6-vendor-blobs/extract --if-device so a package upgrade that
# drops a previously-shipped blob restores the file immediately instead of
# at the next boot (--refresh in addition for an mbn consumer: it re-derives
# the trustlet from the active slot even if a file is present). Consumers:
# soc-fairphone-fp6-audio (aw88261 acf), fingerprintd (focal64 trustlet).
#
# 1-r3 (2026-09-11): active slot first, an unpinned ('-') structurally
# verified mode for mbn, --refresh -- after two field units got no
# fingerprint sensor from a whole-image hash pin that can only match one
# Android build (fp6 repo journal/blobs/, journal/fingerprint/).
maintainer="Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>"
pkgname=fp6-vendor-blobs
pkgver=1
pkgrel=3
pkgdesc="On-device extraction of vendor blobs from the stock Android partitions"
url="https://forgejo.catcrafts.net/Catcrafts/fp6-img"
arch="noarch"
license="GPL-3.0-only"
# fallback mapper for when the initramfs didn't map the dynamic partitions
depends="make-dynpart-mappings"
install="$pkgname.post-upgrade"
options="!check"
source="
fp6-vendor-blobs-extract
fp6-vendor-blobs.service
fp6-vendor-blobs.preset
"
package() {
install -Dm755 "$srcdir"/fp6-vendor-blobs-extract \
"$pkgdir"/usr/lib/fp6-vendor-blobs/extract
install -Dm644 "$srcdir"/fp6-vendor-blobs.service \
"$pkgdir"/usr/lib/systemd/system/fp6-vendor-blobs.service
# enabled unconditionally: the unit is a fast no-op once every manifest
# dest exists, and blobs appearing on first boot must not depend on a
# manual systemctl enable. sysinit = the real (pre-coldplug) run;
# multi-user = the post-udev retry if the early run failed (see unit)
mkdir -p "$pkgdir"/etc/systemd/system/sysinit.target.wants \
"$pkgdir"/etc/systemd/system/multi-user.target.wants
ln -s /usr/lib/systemd/system/fp6-vendor-blobs.service \
"$pkgdir"/etc/systemd/system/sysinit.target.wants/fp6-vendor-blobs.service
ln -s /usr/lib/systemd/system/fp6-vendor-blobs.service \
"$pkgdir"/etc/systemd/system/multi-user.target.wants/fp6-vendor-blobs.service
# ...and a preset, because the symlink alone does NOT survive: image
# build runs `systemctl preset-all`, which removes .wants links for any
# unit not enabled by a preset. That is what shipped the 2026-08-24
# image with the service `disabled; preset: disabled` -- no blob
# extracted, no sound card. See journal/blobs/ 2026-08-28.
install -Dm644 "$srcdir"/fp6-vendor-blobs.preset \
"$pkgdir"/usr/lib/systemd/system-preset/50-fp6-vendor-blobs.preset
mkdir -p "$pkgdir"/usr/share/fp6-vendor-blobs/manifest.d
}
sha512sums="
e9618b4a1ccbe0913a608b32a1a9e87337e3da79a3d7ccc7f49292ae9aaa9406d2ea9817d63b3cfff2c4346b80dd2476c10725f4f0f95c859acd17b22ec03a16 fp6-vendor-blobs-extract
b4c290095d9f39515378dfef08de720ce49324210342aa13c131dfce1103785e796e6f821f0c659671a4c44b46f466ce0e03f11f216fdcdee2a99db5e7970800 fp6-vendor-blobs.service
9e79dd0aed13f11a71282aa24b2a26331e85c105e25ab0c0fed6189b8c300769a5f4308b18b91d9855868d658ad3a57c03e26c9b11bd27fd5e03f9a5decbbd6a fp6-vendor-blobs.preset
"