diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 1b7285bc..c83be5af 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -19,13 +19,13 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v2 + uses: actions/checkout@v3 # Login against a Docker registry except on PR # https://github.com/docker/login-action - name: Log into registry ${{ env.REGISTRY }} - if: github.event_name != 'pull_request' && !startsWith(github.ref, 'refs/pull') - uses: docker/login-action@dd4fa0671be5250ee6f50aedf4cb05514abda2c7 + if: github.event_name != 'pull_request' && !startsWith(github.ref, 'refs/pull') && github.actor != 'dependabot[bot]' + uses: docker/login-action@49ed152c8eca782a232dede0303416e8f356c37b with: registry: ${{ env.REGISTRY }} username: ${{ secrets.DOCKERHUB_USERNAME }} @@ -35,7 +35,7 @@ jobs: # https://github.com/docker/metadata-action - name: Extract Docker metadata id: meta - uses: docker/metadata-action@e5622373a38e60fb6d795a4421e56882f2d7a681 + uses: docker/metadata-action@69f6fc9d46f2f8bf0d5491e4aabe0bb8c6a4678a with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} flavor: latest=${{ github.ref == 'refs/heads/master' }} @@ -43,9 +43,9 @@ jobs: # Build and push Docker image with Buildx (don't push on PR) # https://github.com/docker/build-push-action - name: Build and push Docker image - uses: docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a + uses: docker/build-push-action@c84f38281176d4c9cdb1626ffafcd6b3911b5d94 with: context: . - push: ${{ github.event_name != 'pull_request' && !startsWith(github.ref, 'refs/pull') }} + push: ${{ github.event_name != 'pull_request' && !startsWith(github.ref, 'refs/pull') && github.actor != 'dependabot[bot]' }} tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml index 1e827fbc..13971d69 100644 --- a/.github/workflows/shellcheck.yml +++ b/.github/workflows/shellcheck.yml @@ -7,7 +7,7 @@ jobs: name: Shellcheck runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@v3 - name: Run ShellCheck uses: ludeeus/action-shellcheck@94e0aab03ca135d11a35e5bfc14e6746dc56e7e9 with: diff --git a/Dockerfile b/Dockerfile index b1a09b01..ae9a855f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM ubuntu:20.04@sha256:8ae9bafbb64f63a50caab98fd3a5e37b3eb837a3e0780b78e5218e63193961f9 +FROM ubuntu:22.04@sha256:20fa2d7bb4de7723f542be5923b06c4d704370f0390e4ae9e1c833c8785644c1 LABEL maintainer="Nicola Corna " # Environment variables @@ -146,8 +146,8 @@ RUN apt-get -qq update && \ cron curl flex g++-multilib gcc-multilib git gnupg gperf imagemagick \ kmod lib32ncurses5-dev lib32readline-dev lib32z1-dev liblz4-tool \ libncurses5 libncurses5-dev libsdl1.2-dev libssl-dev libxml2 \ - libxml2-utils lsof lzop maven openjdk-8-jdk pngcrush procps \ - python rsync schedtool squashfs-tools wget xdelta3 xsltproc yasm zip \ + libxml2-utils lsof lzop maven openjdk-8-jdk pngcrush procps python3 \ + python-is-python3 rsync schedtool squashfs-tools wget xdelta3 xsltproc yasm zip \ zlib1g-dev \ && rm -rf /var/lib/apt/lists/* diff --git a/src/build.sh b/src/build.sh index 91c0f4c2..dff503f3 100755 --- a/src/build.sh +++ b/src/build.sh @@ -61,6 +61,12 @@ for branch in ${BRANCH_NAME//,/ }; do frameworks_base_patch="android_frameworks_base-S.patch" modules_permission_patch="packages_modules_Permission-S.patch" ;; + lineage-20.0*) + themuppets_branch="lineage-20.0" + android_version="13" + frameworks_base_patch="android_frameworks_base-Android13.patch" + modules_permission_patch="packages_modules_Permission-Android13.patch" + ;; *) echo ">> [$(date)] Building branch $branch is not (yet) suppported" exit 1 @@ -171,6 +177,5 @@ for branch in ${BRANCH_NAME//,/ }; do sed -i "1s;^;PRODUCT_DEFAULT_DEV_CERTIFICATE := user-keys/releasekey\nPRODUCT_OTA_PUBLIC_KEYS := user-keys/releasekey\n\n;" "vendor/$vendor/config/common.mk" fi fi - fi done diff --git a/src/build_manifest.py b/src/build_manifest.py index 4a6b269c..bb762fe1 100755 --- a/src/build_manifest.py +++ b/src/build_manifest.py @@ -54,6 +54,9 @@ if args.remote: attributes["remote"] = args.remotename + if "revision" in child.attrib: + attributes["revision"] = child.attrib["revision"] + ET.SubElement(xmlout, 'project', attrib=attributes) xmlstr = minidom.parseString(ET.tostring(xmlout)).toprettyxml(indent=" ", encoding="UTF-8") diff --git a/src/init.sh b/src/init.sh index 8c5a1ae2..fe5a58d6 100755 --- a/src/init.sh +++ b/src/init.sh @@ -20,10 +20,10 @@ export SIGN_BUILDS=false export SRC_DIR=/opt/lineageOS export MICROG_DIR=/extra/microG/src -export BRANCH_NAME=lineage-19.1 +export BRANCH_NAME=lineage-20.0 export DEVICE_LIST=FP3 export SIGNATURE_SPOOFING=restricted -export CUSTOM_PACKAGES='GmsCore GsfProxy FakeStore MozillaNlpBackend NominatimNlpBackend com.google.android.maps.jar FDroid FDroidPrivilegedExtension' +export CUSTOM_PACKAGES='GmsCore GsfProxy FakeStore FDroid FDroidPrivilegedExtension' export RELEASE_TYPE=userdebug export ZIP_DIR=/tmp/microG/out @@ -36,7 +36,7 @@ mkdir -p $LOGS_DIR if [ "$SIGN_BUILDS" = true ]; then if [ -z "$(ls -A "$KEYS_DIR")" ]; then echo ">> [$(date)] SIGN_BUILDS = true but empty \$KEYS_DIR, generating new keys" - for c in releasekey platform shared media networkstack; do + for c in releasekey platform shared media networkstack sdk_sandbox bluetooth; do echo ">> [$(date)] Generating $c..." $MICROG_DIR/make_key "$KEYS_DIR/$c" "$KEYS_SUBJECT" <<< '' &> /dev/null done @@ -49,6 +49,14 @@ if [ "$SIGN_BUILDS" = true ]; then fi done done + + # those keys are only required starting with android-20, so people who have built earlier might not yet have them + for c in sdk_sandbox bluetooth; do + if [ ! -f "$KEYS_DIR/$c.pk8" ]; then + echo ">> [$(date)] Generating $c..." + /root/make_key "$KEYS_DIR/$c" "$KEYS_SUBJECT" <<< '' &> /dev/null + fi + done fi for c in cyngn{-priv,}-app testkey; do diff --git a/src/signature_spoofing_patches/android_frameworks_base-Android13.patch b/src/signature_spoofing_patches/android_frameworks_base-Android13.patch new file mode 100644 index 00000000..15fb0155 --- /dev/null +++ b/src/signature_spoofing_patches/android_frameworks_base-Android13.patch @@ -0,0 +1,118 @@ +diff --git a/core/api/current.txt b/core/api/current.txt +--- a/core/api/current.txt ++++ b/core/api/current.txt +@@ -87,6 +87,7 @@ package android { + field public static final String DUMP = "android.permission.DUMP"; + field public static final String EXPAND_STATUS_BAR = "android.permission.EXPAND_STATUS_BAR"; + field public static final String FACTORY_TEST = "android.permission.FACTORY_TEST"; ++ field public static final String FAKE_PACKAGE_SIGNATURE = "android.permission.FAKE_PACKAGE_SIGNATURE"; + field public static final String FOREGROUND_SERVICE = "android.permission.FOREGROUND_SERVICE"; + field public static final String GET_ACCOUNTS = "android.permission.GET_ACCOUNTS"; + field public static final String GET_ACCOUNTS_PRIVILEGED = "android.permission.GET_ACCOUNTS_PRIVILEGED"; +@@ -222,6 +223,7 @@ package android { + field public static final String CALL_LOG = "android.permission-group.CALL_LOG"; + field public static final String CAMERA = "android.permission-group.CAMERA"; + field public static final String CONTACTS = "android.permission-group.CONTACTS"; ++ field public static final String FAKE_PACKAGE = "android.permission-group.FAKE_PACKAGE"; + field public static final String LOCATION = "android.permission-group.LOCATION"; + field public static final String MICROPHONE = "android.permission-group.MICROPHONE"; + field public static final String NEARBY_DEVICES = "android.permission-group.NEARBY_DEVICES"; +diff --git a/core/res/AndroidManifest.xml b/core/res/AndroidManifest.xml +--- a/core/res/AndroidManifest.xml ++++ b/core/res/AndroidManifest.xml +@@ -3542,6 +3542,21 @@ + android:description="@string/permdesc_getPackageSize" + android:protectionLevel="normal" /> + ++ ++ ++ ++ ++ ++ + +diff --git a/core/res/res/values/strings.xml b/core/res/res/values/strings.xml +--- a/core/res/res/values/strings.xml ++++ b/core/res/res/values/strings.xml +@@ -974,6 +974,18 @@ + + + ++ ++ Spoof package signature ++ ++ Allows the app to pretend to be a different app. Malicious applications might be able to use this to access private application data. Legitimate uses include an emulator pretending to be what it emulates. Grant this permission with caution only! ++ ++ Spoof package signature ++ ++ allow to spoof package signature ++ ++ Allow ++ <b>%1$s</b> to spoof package signature? ++ + + disable or modify status bar + +diff --git a/services/core/java/com/android/server/pm/ComputerEngine.java b/services/core/java/com/android/server/pm/ComputerEngine.java +--- a/services/core/java/com/android/server/pm/ComputerEngine.java ++++ b/services/core/java/com/android/server/pm/ComputerEngine.java +@@ -1603,6 +1603,29 @@ public class ComputerEngine implements Computer { + return result; + } + ++ private boolean requestsFakeSignature(AndroidPackage p) { ++ return p.getMetaData() != null && ++ p.getMetaData().getString("fake-signature") != null; ++ } ++ ++ private PackageInfo mayFakeSignature(AndroidPackage p, PackageInfo pi, ++ Set permissions) { ++ try { ++ if (p.getMetaData() != null && ++ p.getTargetSdkVersion() > Build.VERSION_CODES.LOLLIPOP_MR1) { ++ String sig = p.getMetaData().getString("fake-signature"); ++ if (sig != null && ++ permissions.contains("android.permission.FAKE_PACKAGE_SIGNATURE")) { ++ pi.signatures = new Signature[] {new Signature(sig)}; ++ } ++ } ++ } catch (Throwable t) { ++ // We should never die because of any failures, this is system code! ++ Log.w("PackageManagerService.FAKE_PACKAGE_SIGNATURE", t); ++ } ++ return pi; ++ } ++ + public final PackageInfo generatePackageInfo(PackageStateInternal ps, + @PackageManager.PackageInfoFlagsBits long flags, int userId) { + if (!mUserManager.exists(userId)) return null; +@@ -1632,13 +1655,15 @@ public class ComputerEngine implements Computer { + final int[] gids = (flags & PackageManager.GET_GIDS) == 0 ? EMPTY_INT_ARRAY + : mPermissionManager.getGidsForUid(UserHandle.getUid(userId, ps.getAppId())); + // Compute granted permissions only if package has requested permissions +- final Set permissions = ((flags & PackageManager.GET_PERMISSIONS) == 0 ++ final Set permissions = (((flags & PackageManager.GET_PERMISSIONS) == 0 ++ && !requestsFakeSignature(p)) + || ArrayUtils.isEmpty(p.getRequestedPermissions())) ? Collections.emptySet() + : mPermissionManager.getGrantedPermissions(ps.getPackageName(), userId); + +- PackageInfo packageInfo = PackageInfoUtils.generate(p, gids, flags, ++ PackageInfo packageInfo = mayFakeSignature(p, PackageInfoUtils.generate(p, gids, flags, + state.getFirstInstallTime(), ps.getLastUpdateTime(), permissions, state, userId, +- ps); ++ ps), ++ permissions); + + if (packageInfo == null) { + return null; diff --git a/src/signature_spoofing_patches/packages_modules_Permission-Android13.patch b/src/signature_spoofing_patches/packages_modules_Permission-Android13.patch new file mode 100644 index 00000000..f6d79946 --- /dev/null +++ b/src/signature_spoofing_patches/packages_modules_Permission-Android13.patch @@ -0,0 +1,21 @@ +diff --git a/PermissionController/src/com/android/permissioncontroller/permission/utils/Utils.java b/PermissionController/src/com/android/permissioncontroller/permission/utils/Utils.java +index 48793ab51..d75a58360 100644 +--- a/PermissionController/src/com/android/permissioncontroller/permission/utils/Utils.java ++++ b/PermissionController/src/com/android/permissioncontroller/permission/utils/Utils.java +@@ -21,6 +21,7 @@ import static android.Manifest.permission_group.CALENDAR; + import static android.Manifest.permission_group.CALL_LOG; + import static android.Manifest.permission_group.CAMERA; + import static android.Manifest.permission_group.CONTACTS; ++import static android.Manifest.permission_group.FAKE_PACKAGE; + import static android.Manifest.permission_group.LOCATION; + import static android.Manifest.permission_group.MICROPHONE; + import static android.Manifest.permission_group.NEARBY_DEVICES; +@@ -341,6 +342,8 @@ public final class Utils { + PLATFORM_PERMISSIONS.put(Manifest.permission.BODY_SENSORS_BACKGROUND, SENSORS); + } + ++ PLATFORM_PERMISSIONS.put(Manifest.permission.FAKE_PACKAGE_SIGNATURE, FAKE_PACKAGE); ++ + PLATFORM_PERMISSION_GROUPS = new ArrayMap<>(); + int numPlatformPermissions = PLATFORM_PERMISSIONS.size(); + for (int i = 0; i < numPlatformPermissions; i++) {