Git-Mirrors/DivestOS
1
0
Fork 0
mirror of https://github.com/Divested-Mobile/DivestOS-Build.git synced 2024-10-01 01:35:54 -04:00
Code Issues Packages Projects Releases Wiki Activity
61cdb581cc
DivestOS/Scripts/Common/Functions.sh

1250 lines
64 KiB
Bash
Raw Normal View History

Dramatically deduplicate scripts
2018-04-04 07:52:11 -04:00
#!/bin/bash
License headers
2020-11-17 10:11:40 -05:00
#DivestOS: A privacy focused mobile distribution
2022 Signed-off-by: Tad <tad@spotco.us>
2022-05-01 01:13:46 -04:00
#Copyright (c) 2017-2022 Divested Computing Group
Dramatically deduplicate scripts
2018-04-04 07:52:11 -04:00
#
#This program is free software: you can redistribute it and/or modify
#it under the terms of the GNU General Public License as published by
#the Free Software Foundation, either version 3 of the License, or
#(at your option) any later version.
#
#This program is distributed in the hope that it will be useful,
#but WITHOUT ANY WARRANTY; without even the implied warranty of
#MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
#GNU General Public License for more details.
#
#You should have received a copy of the GNU General Public License
#along with this program. If not, see <https://www.gnu.org/licenses/>.
More fixes Ensure new shells have the correct settings too. Signed-off-by: Tad <tad@spotco.us>
2021-10-16 19:15:19 -04:00
umask 0022;
Dramatically deduplicate scripts
2018-04-04 07:52:11 -04:00
make divest functions error aware this commit adds (the currently non-existing) error handling when using divest's functions and scripts. all the magic here gets activated when `source ../../Scripts/init.sh` gets executed which is already a mandatory step before starting any of the divest functions. when something fails during patching, resetting or building each error will be catched + printed including an error code now. last but not least the executed file and the line number causing that failure will be shown, too. as all divest functions get source'd and so not a single build script gets executed all ERR's needs to be trapped to catch issues. I am not aware of another way to handle that properly as sourcing means we cannot track a script or smth while this approach here just works. Example for an error thrown in a function call: > ERROR: $DOS_WORKSPACE_ROOT/Scripts/Common/Functions.sh -> verifyAllPlatformTags() ended with status >1< at line >49< Final SUCCESS result message after using `patchWorkspace`: > [FINAL RESULT] No error detected (please check the above output nevertheless!) Final ERROR result message after using `patchWorkspace`: > [FINAL RESULT] Serious error(s) found!!! > Summary error code was: 126. Check & fix all error lines above Some notes: - when an error occurs the process continues until the end (like it is now) i.e. an error will not stop the current and following tasks - when multiple errors occur the exit codes will be summed - buildDevice: a (summed) end result gets printed (SUCCESS or ERROR) at the very end - the trap used to catch any error will also be active for any command executed on the cli. that means: type "false" -> ENTER and you will get an error, too same for any script exectued after source init.sh - when all goes well the trap will be resetted at the end but there are cases where this might not happen -> that is why `resetEnv` can be executed to reset the trap, i.e. all becomes as it was before sourcing init.sh - `resetEnv` gets called automatically: - after a successful `patchWorkspace` run - whenever CTRL+C is used (during a running task or just on the cli) - a process get killed (SIGHUP, TERM) - the whole implementation might not catch all errors though - it highly depends on how the function or the script/program called actually handles errors or better said: if they return a proper exit code on failures. For example some tools (like some git cmds) might print an error but don't return a non-zero exit code. This cannot be tracked other then with your eyes or these must be replaced by other methods returning a non-zero exit code on failures. Signed-off-by: steadfasterX <steadfasterX@gmail.com>
2023-04-14 04:24:46 -04:00
_fetchError(){
local last_status="$1";
local error_line_number="$2";
local last_func="$3";
local file=$(echo "$4" | sed "s#$DOS_WORKSPACE_ROOT#\$DOS_WORKSPACE_ROOT#g");
fix-up & enhance advanced error handling new (internal used) functions: - _exit - _exit_report - _exit_sigint these are used to fix several (wrong) error handlings. new environment variable: - UNATTENDED_PATCHING by default we assume unattended patching, i.e. if an error occurs during the patch, reset or any other process we will report the error and auto close the shell. this is needed as we source functions and code and so cannot simply terminate a master process. instead the whole shell will be terminated so if an error occurs nothing else will be executed (and you should notice easily that something is wrong). without that a (serious) error can still continue the rest of a function and you likely not even noticing the error itself. you can use: export UNATTENDED_PATCHING=0 before or after sourcing init.sh and it will *NOT* auto-close the shell. that way you can check the output and fix any issues. Signed-off-by: steadfasterX <steadfasterX@gmail.com>
2024-04-11 12:53:25 -04:00
# ignore when pressing TAB or sim.
if [[ "$file" =~ .*bash_completion ]];then return; fi
case $last_func in
command_not_found_handle|_filedir) return;;
esac
make divest functions error aware this commit adds (the currently non-existing) error handling when using divest's functions and scripts. all the magic here gets activated when `source ../../Scripts/init.sh` gets executed which is already a mandatory step before starting any of the divest functions. when something fails during patching, resetting or building each error will be catched + printed including an error code now. last but not least the executed file and the line number causing that failure will be shown, too. as all divest functions get source'd and so not a single build script gets executed all ERR's needs to be trapped to catch issues. I am not aware of another way to handle that properly as sourcing means we cannot track a script or smth while this approach here just works. Example for an error thrown in a function call: > ERROR: $DOS_WORKSPACE_ROOT/Scripts/Common/Functions.sh -> verifyAllPlatformTags() ended with status >1< at line >49< Final SUCCESS result message after using `patchWorkspace`: > [FINAL RESULT] No error detected (please check the above output nevertheless!) Final ERROR result message after using `patchWorkspace`: > [FINAL RESULT] Serious error(s) found!!! > Summary error code was: 126. Check & fix all error lines above Some notes: - when an error occurs the process continues until the end (like it is now) i.e. an error will not stop the current and following tasks - when multiple errors occur the exit codes will be summed - buildDevice: a (summed) end result gets printed (SUCCESS or ERROR) at the very end - the trap used to catch any error will also be active for any command executed on the cli. that means: type "false" -> ENTER and you will get an error, too same for any script exectued after source init.sh - when all goes well the trap will be resetted at the end but there are cases where this might not happen -> that is why `resetEnv` can be executed to reset the trap, i.e. all becomes as it was before sourcing init.sh - `resetEnv` gets called automatically: - after a successful `patchWorkspace` run - whenever CTRL+C is used (during a running task or just on the cli) - a process get killed (SIGHUP, TERM) - the whole implementation might not catch all errors though - it highly depends on how the function or the script/program called actually handles errors or better said: if they return a proper exit code on failures. For example some tools (like some git cmds) might print an error but don't return a non-zero exit code. This cannot be tracked other then with your eyes or these must be replaced by other methods returning a non-zero exit code on failures. Signed-off-by: steadfasterX <steadfasterX@gmail.com>
2023-04-14 04:24:46 -04:00
if [ ! -z "$last_func" ] && [ ! -z "$file" ];then
echo -e "\e[0;31mERROR: $file -> ${last_func}() ended with status >${last_status}< at line >$((error_line_number -1))<\e[0m";
fix-up & enhance advanced error handling new (internal used) functions: - _exit - _exit_report - _exit_sigint these are used to fix several (wrong) error handlings. new environment variable: - UNATTENDED_PATCHING by default we assume unattended patching, i.e. if an error occurs during the patch, reset or any other process we will report the error and auto close the shell. this is needed as we source functions and code and so cannot simply terminate a master process. instead the whole shell will be terminated so if an error occurs nothing else will be executed (and you should notice easily that something is wrong). without that a (serious) error can still continue the rest of a function and you likely not even noticing the error itself. you can use: export UNATTENDED_PATCHING=0 before or after sourcing init.sh and it will *NOT* auto-close the shell. that way you can check the output and fix any issues. Signed-off-by: steadfasterX <steadfasterX@gmail.com>
2024-04-11 12:53:25 -04:00
elif [ ! -z "$last_func" ];then
echo -e "\e[0;31mERROR: ${last_func}() ended with status >${last_status}< at line >$((error_line_number -1))<\e[0m";
make divest functions error aware this commit adds (the currently non-existing) error handling when using divest's functions and scripts. all the magic here gets activated when `source ../../Scripts/init.sh` gets executed which is already a mandatory step before starting any of the divest functions. when something fails during patching, resetting or building each error will be catched + printed including an error code now. last but not least the executed file and the line number causing that failure will be shown, too. as all divest functions get source'd and so not a single build script gets executed all ERR's needs to be trapped to catch issues. I am not aware of another way to handle that properly as sourcing means we cannot track a script or smth while this approach here just works. Example for an error thrown in a function call: > ERROR: $DOS_WORKSPACE_ROOT/Scripts/Common/Functions.sh -> verifyAllPlatformTags() ended with status >1< at line >49< Final SUCCESS result message after using `patchWorkspace`: > [FINAL RESULT] No error detected (please check the above output nevertheless!) Final ERROR result message after using `patchWorkspace`: > [FINAL RESULT] Serious error(s) found!!! > Summary error code was: 126. Check & fix all error lines above Some notes: - when an error occurs the process continues until the end (like it is now) i.e. an error will not stop the current and following tasks - when multiple errors occur the exit codes will be summed - buildDevice: a (summed) end result gets printed (SUCCESS or ERROR) at the very end - the trap used to catch any error will also be active for any command executed on the cli. that means: type "false" -> ENTER and you will get an error, too same for any script exectued after source init.sh - when all goes well the trap will be resetted at the end but there are cases where this might not happen -> that is why `resetEnv` can be executed to reset the trap, i.e. all becomes as it was before sourcing init.sh - `resetEnv` gets called automatically: - after a successful `patchWorkspace` run - whenever CTRL+C is used (during a running task or just on the cli) - a process get killed (SIGHUP, TERM) - the whole implementation might not catch all errors though - it highly depends on how the function or the script/program called actually handles errors or better said: if they return a proper exit code on failures. For example some tools (like some git cmds) might print an error but don't return a non-zero exit code. This cannot be tracked other then with your eyes or these must be replaced by other methods returning a non-zero exit code on failures. Signed-off-by: steadfasterX <steadfasterX@gmail.com>
2023-04-14 04:24:46 -04:00
else
echo -e "\e[0;31mERROR: last command ended with status >${last_status}< at line >$((error_line_number -1))<\e[0m";
fi
fix-up & enhance advanced error handling new (internal used) functions: - _exit - _exit_report - _exit_sigint these are used to fix several (wrong) error handlings. new environment variable: - UNATTENDED_PATCHING by default we assume unattended patching, i.e. if an error occurs during the patch, reset or any other process we will report the error and auto close the shell. this is needed as we source functions and code and so cannot simply terminate a master process. instead the whole shell will be terminated so if an error occurs nothing else will be executed (and you should notice easily that something is wrong). without that a (serious) error can still continue the rest of a function and you likely not even noticing the error itself. you can use: export UNATTENDED_PATCHING=0 before or after sourcing init.sh and it will *NOT* auto-close the shell. that way you can check the output and fix any issues. Signed-off-by: steadfasterX <steadfasterX@gmail.com>
2024-04-11 12:53:25 -04:00
export TR_ERR=$last_status
_exit_report
make divest functions error aware this commit adds (the currently non-existing) error handling when using divest's functions and scripts. all the magic here gets activated when `source ../../Scripts/init.sh` gets executed which is already a mandatory step before starting any of the divest functions. when something fails during patching, resetting or building each error will be catched + printed including an error code now. last but not least the executed file and the line number causing that failure will be shown, too. as all divest functions get source'd and so not a single build script gets executed all ERR's needs to be trapped to catch issues. I am not aware of another way to handle that properly as sourcing means we cannot track a script or smth while this approach here just works. Example for an error thrown in a function call: > ERROR: $DOS_WORKSPACE_ROOT/Scripts/Common/Functions.sh -> verifyAllPlatformTags() ended with status >1< at line >49< Final SUCCESS result message after using `patchWorkspace`: > [FINAL RESULT] No error detected (please check the above output nevertheless!) Final ERROR result message after using `patchWorkspace`: > [FINAL RESULT] Serious error(s) found!!! > Summary error code was: 126. Check & fix all error lines above Some notes: - when an error occurs the process continues until the end (like it is now) i.e. an error will not stop the current and following tasks - when multiple errors occur the exit codes will be summed - buildDevice: a (summed) end result gets printed (SUCCESS or ERROR) at the very end - the trap used to catch any error will also be active for any command executed on the cli. that means: type "false" -> ENTER and you will get an error, too same for any script exectued after source init.sh - when all goes well the trap will be resetted at the end but there are cases where this might not happen -> that is why `resetEnv` can be executed to reset the trap, i.e. all becomes as it was before sourcing init.sh - `resetEnv` gets called automatically: - after a successful `patchWorkspace` run - whenever CTRL+C is used (during a running task or just on the cli) - a process get killed (SIGHUP, TERM) - the whole implementation might not catch all errors though - it highly depends on how the function or the script/program called actually handles errors or better said: if they return a proper exit code on failures. For example some tools (like some git cmds) might print an error but don't return a non-zero exit code. This cannot be tracked other then with your eyes or these must be replaced by other methods returning a non-zero exit code on failures. Signed-off-by: steadfasterX <steadfasterX@gmail.com>
2023-04-14 04:24:46 -04:00
}
export -f _fetchError;
Dramatically deduplicate scripts
2018-04-04 07:52:11 -04:00
startPatcher() {
Small updates
2020-10-01 14:56:37 -04:00
java -jar "$DOS_BINARY_PATCHER" patch workspace "$DOS_BUILD_BASE" "$DOS_WORKSPACE_ROOT""Patches/Linux/" "$DOS_SCRIPTS_CVES" $1;
Dramatically deduplicate scripts
2018-04-04 07:52:11 -04:00
}
export -f startPatcher;
GPG verification for all platform repositories Signed-off-by: Tad <tad@spotco.us>
2022-08-26 22:00:59 -04:00
resetWorkspace() {
umask 0022;
Update CVE patchers TODO: enable CVE-2023-31084/4.4 Signed-off-by: Tad <tad@spotco.us>
2023-07-15 21:22:18 -04:00
if [ "$1" == "local" ]; then local noNetwork="--local-only"; fi;
repo forall -c 'git add -A && git reset --hard' && rm -rf out DOS_PATCHED_FLAG && repo sync --jobs-network=6 --jobs-checkout=12 --force-sync --detach $noNetwork;
Record current checkouts Signed-off-by: Tavi <tavi@divested.dev>
2024-04-10 08:15:58 -04:00
repo forall -v -c 'echo "$REPO_PATH $(git rev-parse HEAD)"' | sort -u > "$DOS_WORKSPACE_ROOT/Logs/resetWorkspace-$DOS_VERSION.txt";
GPG verification for all platform repositories Signed-off-by: Tad <tad@spotco.us>
2022-08-26 22:00:59 -04:00
}
export -f resetWorkspace;
Updates, logging, and churn also add an extra March ASB patch for 17.1 Signed-off-by: Tad <tad@spotco.us>
2023-03-31 11:21:35 -04:00
patchWorkspace() {
Disable logging, has weird behavior Signed-off-by: Tad <tad@spotco.us>
2023-04-01 10:02:22 -04:00
patchWorkspaceReal; #|& tee "$DOS_WORKSPACE_ROOT/Logs/patchWorkspace-$DOS_VERSION.log";
Updates, logging, and churn also add an extra March ASB patch for 17.1 Signed-off-by: Tad <tad@spotco.us>
2023-03-31 11:21:35 -04:00
}
export -f patchWorkspace;
More verification Signed-off-by: Tad <tad@spotco.us>
2022-08-26 23:02:25 -04:00
verifyAllPlatformTags() {
Functions.sh: fix source not found (#199) Fixes the following issue on systems where /bin/sh != /bin/bash (e.g. Ubuntu): > source [...]/Scripts/Common/Tag_Verifier.sh && verifyTagIfPlatform : 1: source: not found for these (unsupported) systems the following is still required (not needed on Fedora or other systems using /bin/sh -> /bin/bash): 1. `ln -s /bin/bash ~/.local/bin/sh` 2. .bashrc -> `export PATH="$HOME/.local/bin:$PATH"` 3. .bashrc -> `alias sh='/bin/bash'` Signed-off-by: steadfasterX <steadfasterX@users.noreply.github.com>
2023-03-31 12:59:45 -04:00
repo forall -v -c 'sh -c "source $DOS_WORKSPACE_ROOT/Scripts/Common/Tag_Verifier.sh && verifyTagIfPlatform $REPO_PROJECT $REPO_PATH"';
GPG verification for all platform repositories Signed-off-by: Tad <tad@spotco.us>
2022-08-26 22:00:59 -04:00
}
More verification Signed-off-by: Tad <tad@spotco.us>
2022-08-26 23:02:25 -04:00
export -f verifyAllPlatformTags;
GPG verification for all platform repositories Signed-off-by: Tad <tad@spotco.us>
2022-08-26 22:00:59 -04:00
Dramatically deduplicate scripts
2018-04-04 07:52:11 -04:00
enter() {
echo "================================================================================================"
Scripts: localize variables in functions
2019-09-17 00:55:50 -04:00
local dir="$1";
Robustness improvements Signed-off-by: Tad <tad@spotco.us>
2023-03-08 00:22:01 -05:00
local dirReal="$DOS_BUILD_BASE/$dir";
umask 0022 all the things umask 0077 breaks things in subtle ways
2021-06-27 14:14:34 -04:00
umask 0022;
Deduplicate Overclock.sh and Optimize.sh
2018-09-21 03:55:54 -04:00
if [ -d "$dirReal" ]; then
cd "$dirReal";
echo -e "\e[0;32m[ENTERING] $dir\e[0m";
return 0;
else
echo -e "\e[0;31m[ENTERING FAILED] $dir\e[0m";
return 1;
fi;
Dramatically deduplicate scripts
2018-04-04 07:52:11 -04:00
}
export -f enter;
enterAndClear() {
Small changes - SUPL NTP fix - Remove debug info from dexpreopt, saves a few MB - 15.1+: enable full dexpreopt, for perf and memory benefits - 17.1: change oneplus/msm8998-common kernel - 17.1: add OpenCamera to AUX list - Resurrect verity for devices missed previously - Update some CVE patchers - deblobber: remove some lingering atfwd blobs
2020-11-01 09:50:03 -05:00
if enter "$1"; then gitReset; else return 1; fi;
Dramatically deduplicate scripts
2018-04-04 07:52:11 -04:00
}
export -f enterAndClear;
gitReset() {
fix-up & enhance advanced error handling new (internal used) functions: - _exit - _exit_report - _exit_sigint these are used to fix several (wrong) error handlings. new environment variable: - UNATTENDED_PATCHING by default we assume unattended patching, i.e. if an error occurs during the patch, reset or any other process we will report the error and auto close the shell. this is needed as we source functions and code and so cannot simply terminate a master process. instead the whole shell will be terminated so if an error occurs nothing else will be executed (and you should notice easily that something is wrong). without that a (serious) error can still continue the rest of a function and you likely not even noticing the error itself. you can use: export UNATTENDED_PATCHING=0 before or after sourcing init.sh and it will *NOT* auto-close the shell. that way you can check the output and fix any issues. Signed-off-by: steadfasterX <steadfasterX@gmail.com>
2024-04-11 12:53:25 -04:00
(git add -A && git reset --hard) || true;
Dramatically deduplicate scripts
2018-04-04 07:52:11 -04:00
}
export -f gitReset;
Small changes Signed-off-by: Tad <tad@spotco.us>
2021-10-14 14:01:10 -04:00
applyPatchReal() {
currentWorkingPatch=$1;
firstLine=$(head -n1 "$currentWorkingPatch");
if [[ "$firstLine" = *"Mon Sep 17 00:00:00 2001"* ]] || [[ "$firstLine" = *"Thu Jan 1 00:00:00 1970"* ]]; then
More fixes Signed-off-by: Tad <tad@spotco.us>
2021-10-16 16:28:41 -04:00
if git am "$@"; then
Support refreshing patches Signed-off-by: Tad <tad@spotco.us>
2021-10-16 13:51:54 -04:00
if [ "$DOS_REFRESH_PATCHES" = true ]; then
if [[ "$currentWorkingPatch" == $DOS_PATCHES* ]]; then
Small tweaks Sad churn from git version. Will be removed next build cycle. Signed-off-by: Tad <tad@spotco.us>
2021-10-26 01:29:14 -04:00
git format-patch -1 HEAD --zero-commit --no-signature --output="$currentWorkingPatch";
Support refreshing patches Signed-off-by: Tad <tad@spotco.us>
2021-10-16 13:51:54 -04:00
fi;
fi;
fix-up & enhance advanced error handling new (internal used) functions: - _exit - _exit_report - _exit_sigint these are used to fix several (wrong) error handlings. new environment variable: - UNATTENDED_PATCHING by default we assume unattended patching, i.e. if an error occurs during the patch, reset or any other process we will report the error and auto close the shell. this is needed as we source functions and code and so cannot simply terminate a master process. instead the whole shell will be terminated so if an error occurs nothing else will be executed (and you should notice easily that something is wrong). without that a (serious) error can still continue the rest of a function and you likely not even noticing the error itself. you can use: export UNATTENDED_PATCHING=0 before or after sourcing init.sh and it will *NOT* auto-close the shell. that way you can check the output and fix any issues. Signed-off-by: steadfasterX <steadfasterX@gmail.com>
2024-04-11 12:53:25 -04:00
else
echo "Applying (git am): $currentWorkingPatch - FAILED"
git am --abort || true
echo "Applying (patch fallback): $currentWorkingPatch"
patch -r - --no-backup-if-mismatch --forward --ignore-whitespace --verbose -p1 < $currentWorkingPatch
Support refreshing patches Signed-off-by: Tad <tad@spotco.us>
2021-10-16 13:51:54 -04:00
fi;
Small changes Signed-off-by: Tad <tad@spotco.us>
2021-10-14 14:01:10 -04:00
else
echo "Applying (as diff): $currentWorkingPatch";
fix-up & enhance advanced error handling new (internal used) functions: - _exit - _exit_report - _exit_sigint these are used to fix several (wrong) error handlings. new environment variable: - UNATTENDED_PATCHING by default we assume unattended patching, i.e. if an error occurs during the patch, reset or any other process we will report the error and auto close the shell. this is needed as we source functions and code and so cannot simply terminate a master process. instead the whole shell will be terminated so if an error occurs nothing else will be executed (and you should notice easily that something is wrong). without that a (serious) error can still continue the rest of a function and you likely not even noticing the error itself. you can use: export UNATTENDED_PATCHING=0 before or after sourcing init.sh and it will *NOT* auto-close the shell. that way you can check the output and fix any issues. Signed-off-by: steadfasterX <steadfasterX@gmail.com>
2024-04-11 12:53:25 -04:00
git apply "$@";
Small changes Signed-off-by: Tad <tad@spotco.us>
2021-10-14 14:01:10 -04:00
fi;
}
export -f applyPatchReal;
applyPatch() {
currentWorkingPatch=$1;
fix-up & enhance advanced error handling new (internal used) functions: - _exit - _exit_report - _exit_sigint these are used to fix several (wrong) error handlings. new environment variable: - UNATTENDED_PATCHING by default we assume unattended patching, i.e. if an error occurs during the patch, reset or any other process we will report the error and auto close the shell. this is needed as we source functions and code and so cannot simply terminate a master process. instead the whole shell will be terminated so if an error occurs nothing else will be executed (and you should notice easily that something is wrong). without that a (serious) error can still continue the rest of a function and you likely not even noticing the error itself. you can use: export UNATTENDED_PATCHING=0 before or after sourcing init.sh and it will *NOT* auto-close the shell. that way you can check the output and fix any issues. Signed-off-by: steadfasterX <steadfasterX@gmail.com>
2024-04-11 12:53:25 -04:00
set -E
Small changes Signed-off-by: Tad <tad@spotco.us>
2021-10-14 14:01:10 -04:00
if [ -f "$currentWorkingPatch" ]; then
More fixes Signed-off-by: Tad <tad@spotco.us>
2021-10-16 16:28:41 -04:00
if git apply --check "$@" &> /dev/null; then
Small changes Signed-off-by: Tad <tad@spotco.us>
2021-10-14 14:01:10 -04:00
applyPatchReal "$@";
else
More fixes Signed-off-by: Tad <tad@spotco.us>
2021-10-16 16:28:41 -04:00
if git apply --reverse --check "$@" &> /dev/null; then
Small changes Signed-off-by: Tad <tad@spotco.us>
2021-10-14 14:01:10 -04:00
echo "Already applied: $currentWorkingPatch";
else
More fixes Signed-off-by: Tad <tad@spotco.us>
2021-10-16 16:28:41 -04:00
if git apply --check "$@" --3way &> /dev/null; then
Small changes Signed-off-by: Tad <tad@spotco.us>
2021-10-14 14:01:10 -04:00
applyPatchReal "$@" --3way;
echo "Applied (as 3way): $currentWorkingPatch";
else
Refresh most branch specific patches Fixed up: LineageOS-16.0/android_packages_apps_Backgrounds/308977.patch LineageOS-16.0/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch LineageOS-17.1/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch LineageOS-18.1/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch Must review again: LineageOS-14.1/android_packages_apps_PackageInstaller/64d8b44.patch Signed-off-by: Tad <tad@spotco.us>
2021-10-16 14:05:45 -04:00
echo -e "\e[0;31mERROR: Cannot apply: $currentWorkingPatch\e[0m";
fix-up & enhance advanced error handling new (internal used) functions: - _exit - _exit_report - _exit_sigint these are used to fix several (wrong) error handlings. new environment variable: - UNATTENDED_PATCHING by default we assume unattended patching, i.e. if an error occurs during the patch, reset or any other process we will report the error and auto close the shell. this is needed as we source functions and code and so cannot simply terminate a master process. instead the whole shell will be terminated so if an error occurs nothing else will be executed (and you should notice easily that something is wrong). without that a (serious) error can still continue the rest of a function and you likely not even noticing the error itself. you can use: export UNATTENDED_PATCHING=0 before or after sourcing init.sh and it will *NOT* auto-close the shell. that way you can check the output and fix any issues. Signed-off-by: steadfasterX <steadfasterX@gmail.com>
2024-04-11 12:53:25 -04:00
false
Small changes Signed-off-by: Tad <tad@spotco.us>
2021-10-14 14:01:10 -04:00
fi;
fi;
fi;
else
Refresh most branch specific patches Fixed up: LineageOS-16.0/android_packages_apps_Backgrounds/308977.patch LineageOS-16.0/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch LineageOS-17.1/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch LineageOS-18.1/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch Must review again: LineageOS-14.1/android_packages_apps_PackageInstaller/64d8b44.patch Signed-off-by: Tad <tad@spotco.us>
2021-10-16 14:05:45 -04:00
echo -e "\e[0;31mERROR: Patch doesn't exist: $currentWorkingPatch\e[0m";
fix-up & enhance advanced error handling new (internal used) functions: - _exit - _exit_report - _exit_sigint these are used to fix several (wrong) error handlings. new environment variable: - UNATTENDED_PATCHING by default we assume unattended patching, i.e. if an error occurs during the patch, reset or any other process we will report the error and auto close the shell. this is needed as we source functions and code and so cannot simply terminate a master process. instead the whole shell will be terminated so if an error occurs nothing else will be executed (and you should notice easily that something is wrong). without that a (serious) error can still continue the rest of a function and you likely not even noticing the error itself. you can use: export UNATTENDED_PATCHING=0 before or after sourcing init.sh and it will *NOT* auto-close the shell. that way you can check the output and fix any issues. Signed-off-by: steadfasterX <steadfasterX@gmail.com>
2024-04-11 12:53:25 -04:00
false
Small changes Signed-off-by: Tad <tad@spotco.us>
2021-10-14 14:01:10 -04:00
fi;
}
export -f applyPatch;
GPG verify all F-Droid apps before copy
2018-08-30 23:44:23 -04:00
gpgVerifyDirectory() {
Fixup and enable GPG verification Signed-off-by: Tad <tad@spotco.us>
2022-08-24 15:50:36 -04:00
if [ -r "$DOS_TMP_GNUPG/pubring.kbx" ]; then
GPG verify all F-Droid apps before copy
2018-08-30 23:44:23 -04:00
for sig in $1/*.asc; do
Fixup and enable GPG verification Signed-off-by: Tad <tad@spotco.us>
2022-08-24 15:50:36 -04:00
if gpg --homedir "$DOS_TMP_GNUPG" --verify $sig &>/dev/null; then
GPG verify all F-Droid apps before copy
2018-08-30 23:44:23 -04:00
echo -e "\e[0;32mGPG Verified Successfully: $sig\e[0m";
else
echo -e "\e[0;31mWARNING: GPG Verification Failed: $sig\e[0m";
sleep 60;
fi;
done;
else
Fixup and enable GPG verification Signed-off-by: Tad <tad@spotco.us>
2022-08-24 15:50:36 -04:00
echo -e "\e[0;33mWARNING: keyring is unavailable, GPG verification of $1 will not be performed!\e[0m";
GPG verify all F-Droid apps before copy
2018-08-30 23:44:23 -04:00
fi;
}
export -f gpgVerifyDirectory;
Many changes - Add support to scan for malware in certain directories - 15.1: Add new device, griffin - Note deprecation status of various devices - Add a few blobs to the deblobber
2018-05-10 23:45:29 -04:00
scanForMalware() {
Small changes - cheeseburger/dumpling: fix ogg vorbis playback, credit @LuK1337 - cheeseburger/dumpling: fix delta ota generation - remove a few more blobs - potentially bluetooth when ant is removed on newer devices - support newer clamav - commented support for extracting boot.img when recovery.img isn't available -- fastboot.zip should be preferred - potentially fix boot on many untested newer devices (diag on msm8996+) - update cherry picks
2020-02-23 20:51:13 -05:00
if [ -x /usr/bin/clamscan ] && [ -r /var/lib/clamav/main.c*d ]; then
Further improve malware scanner
2018-05-11 06:15:29 -04:00
echo -e "\e[0;32mStarting a malware scan...\e[0m";
Scripts: localize variables in functions
2019-09-17 00:55:50 -04:00
local excludes="--exclude-dir=\".git\" --exclude-dir=\".repo\"";
local scanQueue="$2";
Further improve malware scanner
2018-05-11 06:15:29 -04:00
if [ "$1" = true ]; then
Overhaul variable names
2018-06-29 00:55:21 -04:00
if [ "$DOS_MALWARE_SCAN_SETTING" != "quick" ] || [ "$DOS_MALWARE_SCAN_SETTING" = "extra" ]; then
scanQueue=$scanQueue" $DOS_BUILD_BASE/frameworks $DOS_BUILD_BASE/vendor";
Further improve malware scanner
2018-05-11 06:15:29 -04:00
fi;
Overhaul variable names
2018-06-29 00:55:21 -04:00
if [ "$DOS_MALWARE_SCAN_SETTING" = "slow" ]; then
scanQueue=$scanQueue"$DOS_BUILD_BASE/external $DOS_BUILD_BASE/prebuilts $DOS_BUILD_BASE/toolchain $DOS_BUILD_BASE/tools";
Further improve malware scanner
2018-05-11 06:15:29 -04:00
fi;
Overhaul variable names
2018-06-29 00:55:21 -04:00
if [ "$DOS_MALWARE_SCAN_SETTING" = "full" ]; then
scanQueue="$DOS_BUILD_BASE";
Further improve malware scanner
2018-05-11 06:15:29 -04:00
fi;
Improve the malware scanner and enable by default
2018-05-11 02:50:52 -04:00
fi;
Various fixes
2019-03-25 20:30:27 -04:00
du -hsc $scanQueue;
More cleanup
2021-03-20 16:15:01 -04:00
/usr/bin/clamscan --recursive --detect-pua --infected --allmatch --max-filesize=4000M --max-scansize=4000M $excludes $scanQueue;
Scripts: localize variables in functions
2019-09-17 00:55:50 -04:00
local clamscanExit="$?";
Many changes - Add support to scan for malware in certain directories - 15.1: Add new device, griffin - Note deprecation status of various devices - Add a few blobs to the deblobber
2018-05-10 23:45:29 -04:00
if [ "$clamscanExit" -eq "1" ]; then
echo -e "\e[0;31m----------------------------------------------------------------\e[0m";
echo -e "\e[0;31mWARNING: MALWARE WAS FOUND! PLEASE INVESTIGATE!\e[0m";
echo -e "\e[0;31m----------------------------------------------------------------\e[0m";
Small fixes
2020-11-09 00:29:29 -05:00
echo -e "\e[0;33mFalse positives such as the following are probably OK\e[0m";
Various fixes
2019-03-25 20:30:27 -04:00
echo -e "\e[0;33mPUAs: Ewind, Mobidash\e[0m";
echo -e "\e[0;31m----------------------------------------------------------------\e[0m";
Improve the malware scanner and enable by default
2018-05-11 02:50:52 -04:00
sleep 60;
Many changes - Add support to scan for malware in certain directories - 15.1: Add new device, griffin - Note deprecation status of various devices - Add a few blobs to the deblobber
2018-05-10 23:45:29 -04:00
fi;
if [ "$clamscanExit" -eq "0" ]; then
echo -e "\e[0;32mNo malware found\e[0m";
Improve the malware scanner and enable by default
2018-05-11 02:50:52 -04:00
fi;
if [ "$clamscanExit" -eq "2" ]; then
echo -e "\e[0;33m----------------------------------------------------------------\e[0m";
echo -e "\e[0;33mWARNING: AN ERROR OCCURED. PLEASE INVESTIGATE!\e[0m";
echo -e "\e[0;33m----------------------------------------------------------------\e[0m";
sleep 60;
Many changes - Add support to scan for malware in certain directories - 15.1: Add new device, griffin - Note deprecation status of various devices - Add a few blobs to the deblobber
2018-05-10 23:45:29 -04:00
fi;
else
echo -e "\e[0;33mWARNING: clamscan is unavailable, a malware scan will not be performed!\e[0m";
fi;
}
export -f scanForMalware;
Boot animation customization!
2018-06-24 04:26:59 -04:00
generateBootAnimationMask() {
Scripts: localize variables in functions
2019-09-17 00:55:50 -04:00
local text=$1;
local font=$2
local output=$3;
Fix boot animation + churn Signed-off-by: Tad <tad@spotco.us>
2022-04-18 17:42:32 -04:00
convert -depth 8 -background black -fill transparent -font "$font" -gravity center -size 512x128 label:"$text" "PNG32:$output";
Boot animation customization!
2018-06-24 04:26:59 -04:00
}
export -f generateBootAnimationMask;
Boot animation shine!
2018-06-24 08:42:02 -04:00
generateBootAnimationShine() {
Scripts: localize variables in functions
2019-09-17 00:55:50 -04:00
local color=$1;
local style=$2;
local output=$3;
Fix boot animation + churn Signed-off-by: Tad <tad@spotco.us>
2022-04-18 17:42:32 -04:00
#The colors need to be symmetrical in order to make the animation smooth and not have any noticeable lines
convert -depth 8 -size 1024x128 -define gradient:angle=90 "$style":"$color" \( +clone -flop \) +append "PNG24:$output";
Boot animation shine!
2018-06-24 08:42:02 -04:00
}
export -f generateBootAnimationShine;
Cleanup
2018-06-13 19:48:53 -04:00
audit2allowCurrent() {
Robustness improvements Signed-off-by: Tad <tad@spotco.us>
2023-03-08 00:22:01 -05:00
adb logcat -b all -d | audit2allow -p "$OUT/root/sepolicy";
Cleanup
2018-06-13 19:48:53 -04:00
}
export -f audit2allowCurrent;
audit2allowADB() {
adb pull /sys/fs/selinux/policy;
adb logcat -b all -d | audit2allow -p policy;
}
export -f audit2allowADB;
Improve release processing to support deltas and archiving
2019-08-29 14:37:06 -04:00
processRelease() {
Legal goodies
2021-03-01 21:05:42 -05:00
#Reference (MIT): GrapheneOS
Update commons Signed-off-by: Tad <tad@spotco.us>
2023-05-24 11:07:29 -04:00
#https://github.com/GrapheneOS/script/blob/13/release.sh
Scripts: localize variables in functions
2019-09-17 00:55:50 -04:00
local DEVICE="$1";
local BLOCK="$2";
local VERITY="$3";
Minor tweaks - 15.1+16.0: Replace in-line build signing patch with bash function - From GrapheneOS/script - 15.1+16.0: Enable fingerprint failed lockout after 5 attempts - From GrapheneOS
2019-08-27 13:13:48 -04:00
Scripts: localize variables in functions
2019-09-17 00:55:50 -04:00
local DATE=$(date -u '+%Y%m%d')
local KEY_DIR="$DOS_SIGNING_KEYS/$DEVICE";
local VERSION=$(echo $DOS_VERSION | cut -f2 -d "-");
local PREFIX="$DOS_BRANDING_ZIP_PREFIX-$VERSION-$DATE-dos-$DEVICE";
local ARCHIVE="$DOS_BUILDS/$DOS_VERSION/release_keys/";
local OUT_DIR="$DOS_BUILD_BASE/out/target/product/$DEVICE/";
Minor tweaks - 15.1+16.0: Replace in-line build signing patch with bash function - From GrapheneOS/script - 15.1+16.0: Enable fingerprint failed lockout after 5 attempts - From GrapheneOS
2019-08-27 13:13:48 -04:00
Failed attempt at fixing signing PRODUCT_OTA_PUBLIC_KEYS is meant to be set by a vendor tree, something we don't use. Override it at the source and set it explicitely as well. This ensures that the compiled recovery.img and the one generated by sign_target_files_apks.py includes the real public keys for verification. 11.0 signing is ignored. This will need to be extensively tested as breakage can mean brick on locked devices. Although in failure cases it seems test-keys are accepted. -- After much testing there appears to be a deeper issue with how keys are inserted into the recovery and handled
2021-04-05 22:57:59 -04:00
local RELEASETOOLS_PREFIX="build/tools/releasetools/";
20.0: More fixes It compiles, but fails to sign: > TypeError: cannot use a string pattern on a bytes-like object Signed-off-by: Tad <tad@spotco.us>
2022-10-15 16:22:53 -04:00
if [[ "$DOS_VERSION" == "LineageOS-18.1" ]] || [[ "$DOS_VERSION" == "LineageOS-19.1" ]] || [[ "$DOS_VERSION" == "LineageOS-20.0" ]]; then
18.1: Initial bringup - Functionality tested on mako and klte - In-place upgrade from 17.1 tested working on klte - Compile tested on bacon and klte - Recovery OTA key patch missing, unsure if still needed. - Deblobber needs support for removing vintf manifest paths from vendor Android.bp - Launcher needs more default_workspace grid variants (eg. 4x5)
2021-03-22 19:59:15 -04:00
local RELEASETOOLS_PREFIX="";
fi;
umask 0022 all the things umask 0077 breaks things in subtle ways
2021-06-27 14:14:34 -04:00
umask 0022;
Many changes - ASB chery picks - 16.0: recovery: fix sideload - Restore releasetools for some devices - Only include Backup where supported - Change some small defaults - z00t: 14.1 -> 15.1 - himaul: 14.1 -> 15.1 - i9100: 14.1 -> 15.1+16.0 - flo: 15.1 -> 16.0, disabled - flounder: 15.1 disabled, enable 14.1
2019-09-07 09:56:47 -04:00
echo -e "\e[0;32mProcessing release for $DEVICE\e[0m";
Improve release processing to support deltas and archiving
2019-08-29 14:37:06 -04:00
#Arguments
if [ "$BLOCK" != false ]; then
Scripts: localize variables in functions
2019-09-17 00:55:50 -04:00
local BLOCK_SWITCHES="--block";
Improve release processing to support deltas and archiving
2019-08-29 14:37:06 -04:00
fi;
Many changes - processRelease: Support AVB - sort device build order by SoC Additions: - taimen/muskie: 15.1, 16.0 - crosshatch/blueline: 16.0 - bonito/sargo: 16.0
2019-09-02 20:00:39 -04:00
if [[ "$VERITY" == "verity" ]]; then
Scripts: localize variables in functions
2019-09-17 00:55:50 -04:00
local VERITY_SWITCHES=(--replace_verity_public_key "$KEY_DIR/verity_key.pub" \
Minor tweaks - 15.1+16.0: Replace in-line build signing patch with bash function - From GrapheneOS/script - 15.1+16.0: Enable fingerprint failed lockout after 5 attempts - From GrapheneOS
2019-08-27 13:13:48 -04:00
--replace_verity_private_key "$KEY_DIR/verity" \
--replace_verity_keyid "$KEY_DIR/verity.x509.pem");
Many changes - ASB chery picks - 16.0: recovery: fix sideload - Restore releasetools for some devices - Only include Backup where supported - Change some small defaults - z00t: 14.1 -> 15.1 - himaul: 14.1 -> 15.1 - i9100: 14.1 -> 15.1+16.0 - flo: 15.1 -> 16.0, disabled - flounder: 15.1 disabled, enable 14.1
2019-09-07 09:56:47 -04:00
echo -e "\e[0;32m\t+ Verified Boot 1.0\e[0m";
Many changes - processRelease: Support AVB - sort device build order by SoC Additions: - taimen/muskie: 15.1, 16.0 - crosshatch/blueline: 16.0 - bonito/sargo: 16.0
2019-09-02 20:00:39 -04:00
elif [[ "$VERITY" == "avb" ]]; then
Scripts: localize variables in functions
2019-09-17 00:55:50 -04:00
local AVB_PKMD="$KEY_DIR/avb_pkmd.bin";
Simplify: always nochain Signed-off-by: Tad <tad@spotco.us>
2022-04-06 15:45:20 -04:00
local VERITY_SWITCHES=(--avb_vbmeta_key "$KEY_DIR/avb.pem" --avb_vbmeta_algorithm SHA256_RSA4096);
echo -e "\e[0;32m\t+ Verified Boot 2.0 with VBMETA and NOCHAIN\e[0m";
Actually enforce AVB + signing fixes - Turns out AVB was set permissive this entire time :( --flags 2 == VERIFICATION_DISABLED - APEX support from GrapheneOS - Disable vbmeta chaining like GrapheneOS and optionally handle it like CalyxOS taimen 19.1 boots with locked bootloader successfully after this Signed-off-by: Tad <tad@spotco.us>
2022-04-06 10:32:44 -04:00
fi;
20.0: More fixes It compiles, but fails to sign: > TypeError: cannot use a string pattern on a bytes-like object Signed-off-by: Tad <tad@spotco.us>
2022-10-15 16:22:53 -04:00
Pixel 6/7 prep + fixes These still need defconfig and deblobber handling All of these sections were reviewed & sorted Signed-off-by: Tad <tad@spotco.us>
2022-12-14 21:23:13 -05:00
#XXX: --extra_apks Bluetooth.apk="$KEY_DIR/bluetooth" \
20.0: More fixes It compiles, but fails to sign: > TypeError: cannot use a string pattern on a bytes-like object Signed-off-by: Tad <tad@spotco.us>
2022-10-15 16:22:53 -04:00
local APK_SWITCHES=(--extra_apks AdServicesApk.apk="$KEY_DIR/releasekey" \
--extra_apks HalfSheetUX.apk="$KEY_DIR/releasekey" \
--extra_apks OsuLogin.apk="$KEY_DIR/releasekey" \
--extra_apks SafetyCenterResources.apk="$KEY_DIR/releasekey" \
--extra_apks ServiceConnectivityResources.apk="$KEY_DIR/releasekey" \
--extra_apks ServiceUwbResources.apk="$KEY_DIR/releasekey" \
--extra_apks ServiceWifiResources.apk="$KEY_DIR/releasekey" \
--extra_apks WifiDialog.apk="$KEY_DIR/releasekey");
if [[ "$DOS_VERSION" == "LineageOS-20.0" ]]; then
local APK_SWITCHES_EXTRA=(--extra_apks Bluetooth.apk="$KEY_DIR/bluetooth");
fi;
if [[ "$DOS_VERSION" == "LineageOS-17.1" ]] || [[ "$DOS_VERSION" == "LineageOS-18.1" ]] || [[ "$DOS_VERSION" == "LineageOS-19.1" ]] || [[ "$DOS_VERSION" == "LineageOS-20.0" ]]; then
local APEX_SWITCHES=(--extra_apks com.android.adbd.apex="$KEY_DIR/releasekey" \
Actually enforce AVB + signing fixes - Turns out AVB was set permissive this entire time :( --flags 2 == VERIFICATION_DISABLED - APEX support from GrapheneOS - Disable vbmeta chaining like GrapheneOS and optionally handle it like CalyxOS taimen 19.1 boots with locked bootloader successfully after this Signed-off-by: Tad <tad@spotco.us>
2022-04-06 10:32:44 -04:00
--extra_apex_payload_key com.android.adbd.apex="$KEY_DIR/avb.pem" \
20.0: Fixes Signed-off-by: Tad <tad@spotco.us>
2022-10-15 14:51:30 -04:00
--extra_apks com.android.adservices.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.adservices.apex="$KEY_DIR/avb.pem" \
apex signing updates untested Signed-off-by: Tavi <tavi@divested.dev>
2024-04-09 13:25:54 -04:00
--extra_apks com.android.adservices.api.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.adservices.api.apex="$KEY_DIR/avb.pem" \
Actually enforce AVB + signing fixes - Turns out AVB was set permissive this entire time :( --flags 2 == VERIFICATION_DISABLED - APEX support from GrapheneOS - Disable vbmeta chaining like GrapheneOS and optionally handle it like CalyxOS taimen 19.1 boots with locked bootloader successfully after this Signed-off-by: Tad <tad@spotco.us>
2022-04-06 10:32:44 -04:00
--extra_apks com.android.apex.cts.shim.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.apex.cts.shim.apex="$KEY_DIR/avb.pem" \
--extra_apks com.android.appsearch.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.appsearch.apex="$KEY_DIR/avb.pem" \
--extra_apks com.android.art.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.art.apex="$KEY_DIR/avb.pem" \
--extra_apks com.android.art.debug.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.art.debug.apex="$KEY_DIR/avb.pem" \
20.0: Fixes Signed-off-by: Tad <tad@spotco.us>
2022-10-15 14:51:30 -04:00
--extra_apks com.android.btservices.apex="$KEY_DIR/bluetooth" \
--extra_apex_payload_key com.android.btservices.apex="$KEY_DIR/avb.pem" \
Actually enforce AVB + signing fixes - Turns out AVB was set permissive this entire time :( --flags 2 == VERIFICATION_DISABLED - APEX support from GrapheneOS - Disable vbmeta chaining like GrapheneOS and optionally handle it like CalyxOS taimen 19.1 boots with locked bootloader successfully after this Signed-off-by: Tad <tad@spotco.us>
2022-04-06 10:32:44 -04:00
--extra_apks com.android.cellbroadcast.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.cellbroadcast.apex="$KEY_DIR/avb.pem" \
20.0: Fixes Signed-off-by: Tad <tad@spotco.us>
2022-10-15 14:51:30 -04:00
--extra_apks com.android.compos.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.compos.apex="$KEY_DIR/avb.pem" \
apex signing updates untested Signed-off-by: Tavi <tavi@divested.dev>
2024-04-09 13:25:54 -04:00
--extra_apks com.android.configinfrastructure.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.configinfrastructure.apex="$KEY_DIR/avb.pem" \
--extra_apks com.android.connectivity.resources.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.connectivity.resources.apex="$KEY_DIR/avb.pem" \
Actually enforce AVB + signing fixes - Turns out AVB was set permissive this entire time :( --flags 2 == VERIFICATION_DISABLED - APEX support from GrapheneOS - Disable vbmeta chaining like GrapheneOS and optionally handle it like CalyxOS taimen 19.1 boots with locked bootloader successfully after this Signed-off-by: Tad <tad@spotco.us>
2022-04-06 10:32:44 -04:00
--extra_apks com.android.conscrypt.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.conscrypt.apex="$KEY_DIR/avb.pem" \
apex signing updates untested Signed-off-by: Tavi <tavi@divested.dev>
2024-04-09 13:25:54 -04:00
--extra_apks com.android.devicelock.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.devicelock.apex="$KEY_DIR/avb.pem" \
Actually enforce AVB + signing fixes - Turns out AVB was set permissive this entire time :( --flags 2 == VERIFICATION_DISABLED - APEX support from GrapheneOS - Disable vbmeta chaining like GrapheneOS and optionally handle it like CalyxOS taimen 19.1 boots with locked bootloader successfully after this Signed-off-by: Tad <tad@spotco.us>
2022-04-06 10:32:44 -04:00
--extra_apks com.android.extservices.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.extservices.apex="$KEY_DIR/avb.pem" \
apex signing updates untested Signed-off-by: Tavi <tavi@divested.dev>
2024-04-09 13:25:54 -04:00
--extra_apks com.android.graphics.pdf.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.graphics.pdf.apex="$KEY_DIR/avb.pem" \
--extra_apks com.android.hardware.biometrics.face.virtual.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.hardware.biometrics.face.virtual.apex="$KEY_DIR/avb.pem" \
--extra_apks com.android.hardware.biometrics.fingerprint.virtual.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.hardware.biometrics.fingerprint.virtual.apex="$KEY_DIR/avb.pem" \
--extra_apks com.android.hardware.cas.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.hardware.cas.apex="$KEY_DIR/avb.pem" \
--extra_apks com.android.hardware.wifi.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.hardware.wifi.apex="$KEY_DIR/avb.pem" \
--extra_apks com.android.healthfitness.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.healthfitness.apex="$KEY_DIR/avb.pem" \
--extra_apks com.android.hotspot2.osulogin.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.hotspot2.osulogin.apex="$KEY_DIR/avb.pem" \
Actually enforce AVB + signing fixes - Turns out AVB was set permissive this entire time :( --flags 2 == VERIFICATION_DISABLED - APEX support from GrapheneOS - Disable vbmeta chaining like GrapheneOS and optionally handle it like CalyxOS taimen 19.1 boots with locked bootloader successfully after this Signed-off-by: Tad <tad@spotco.us>
2022-04-06 10:32:44 -04:00
--extra_apks com.android.i18n.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.i18n.apex="$KEY_DIR/avb.pem" \
--extra_apks com.android.ipsec.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.ipsec.apex="$KEY_DIR/avb.pem" \
--extra_apks com.android.media.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.media.apex="$KEY_DIR/avb.pem" \
--extra_apks com.android.mediaprovider.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.mediaprovider.apex="$KEY_DIR/avb.pem" \
apex signing updates untested Signed-off-by: Tavi <tavi@divested.dev>
2024-04-09 13:25:54 -04:00
--extra_apks com.android.media.swcodec.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.media.swcodec.apex="$KEY_DIR/avb.pem" \
--extra_apks com.android.nearby.halfsheet.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.nearby.halfsheet.apex="$KEY_DIR/avb.pem" \
--extra_apks com.android.networkstack.tethering.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.networkstack.tethering.apex="$KEY_DIR/avb.pem" \
Actually enforce AVB + signing fixes - Turns out AVB was set permissive this entire time :( --flags 2 == VERIFICATION_DISABLED - APEX support from GrapheneOS - Disable vbmeta chaining like GrapheneOS and optionally handle it like CalyxOS taimen 19.1 boots with locked bootloader successfully after this Signed-off-by: Tad <tad@spotco.us>
2022-04-06 10:32:44 -04:00
--extra_apks com.android.neuralnetworks.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.neuralnetworks.apex="$KEY_DIR/avb.pem" \
20.0: Fixes Signed-off-by: Tad <tad@spotco.us>
2022-10-15 14:51:30 -04:00
--extra_apks com.android.ondevicepersonalization.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.ondevicepersonalization.apex="$KEY_DIR/avb.pem" \
Actually enforce AVB + signing fixes - Turns out AVB was set permissive this entire time :( --flags 2 == VERIFICATION_DISABLED - APEX support from GrapheneOS - Disable vbmeta chaining like GrapheneOS and optionally handle it like CalyxOS taimen 19.1 boots with locked bootloader successfully after this Signed-off-by: Tad <tad@spotco.us>
2022-04-06 10:32:44 -04:00
--extra_apks com.android.os.statsd.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.os.statsd.apex="$KEY_DIR/avb.pem" \
--extra_apks com.android.permission.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.permission.apex="$KEY_DIR/avb.pem" \
--extra_apks com.android.resolv.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.resolv.apex="$KEY_DIR/avb.pem" \
apex signing updates untested Signed-off-by: Tavi <tavi@divested.dev>
2024-04-09 13:25:54 -04:00
--extra_apks com.android.rkpd.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.rkpd.apex="$KEY_DIR/avb.pem" \
Actually enforce AVB + signing fixes - Turns out AVB was set permissive this entire time :( --flags 2 == VERIFICATION_DISABLED - APEX support from GrapheneOS - Disable vbmeta chaining like GrapheneOS and optionally handle it like CalyxOS taimen 19.1 boots with locked bootloader successfully after this Signed-off-by: Tad <tad@spotco.us>
2022-04-06 10:32:44 -04:00
--extra_apks com.android.runtime.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.runtime.apex="$KEY_DIR/avb.pem" \
apex signing updates untested Signed-off-by: Tavi <tavi@divested.dev>
2024-04-09 13:25:54 -04:00
--extra_apks com.android.safetycenter.resources.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.safetycenter.resources.apex="$KEY_DIR/avb.pem" \
Actually enforce AVB + signing fixes - Turns out AVB was set permissive this entire time :( --flags 2 == VERIFICATION_DISABLED - APEX support from GrapheneOS - Disable vbmeta chaining like GrapheneOS and optionally handle it like CalyxOS taimen 19.1 boots with locked bootloader successfully after this Signed-off-by: Tad <tad@spotco.us>
2022-04-06 10:32:44 -04:00
--extra_apks com.android.scheduling.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.scheduling.apex="$KEY_DIR/avb.pem" \
--extra_apks com.android.sdkext.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.sdkext.apex="$KEY_DIR/avb.pem" \
apex signing updates untested Signed-off-by: Tavi <tavi@divested.dev>
2024-04-09 13:25:54 -04:00
--extra_apks com.android.support.apexer.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.support.apexer.apex="$KEY_DIR/avb.pem" \
--extra_apks com.android.telephony.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.telephony.apex="$KEY_DIR/avb.pem" \
--extra_apks com.android.telephonymodules.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.telephonymodules.apex="$KEY_DIR/avb.pem" \
Actually enforce AVB + signing fixes - Turns out AVB was set permissive this entire time :( --flags 2 == VERIFICATION_DISABLED - APEX support from GrapheneOS - Disable vbmeta chaining like GrapheneOS and optionally handle it like CalyxOS taimen 19.1 boots with locked bootloader successfully after this Signed-off-by: Tad <tad@spotco.us>
2022-04-06 10:32:44 -04:00
--extra_apks com.android.tethering.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.tethering.apex="$KEY_DIR/avb.pem" \
--extra_apks com.android.tzdata.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.tzdata.apex="$KEY_DIR/avb.pem" \
20.0: Fixes Signed-off-by: Tad <tad@spotco.us>
2022-10-15 14:51:30 -04:00
--extra_apks com.android.uwb.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.uwb.apex="$KEY_DIR/avb.pem" \
apex signing updates untested Signed-off-by: Tavi <tavi@divested.dev>
2024-04-09 13:25:54 -04:00
--extra_apks com.android.uwb.resources.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.uwb.resources.apex="$KEY_DIR/avb.pem" \
--extra_apks com.android.vibrator.drv2624.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.vibrator.drv2624.apex="$KEY_DIR/avb.pem" \
--extra_apks com.android.vibrator.sunfish.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.vibrator.sunfish.apex="$KEY_DIR/avb.pem" \
20.0: Fixes Signed-off-by: Tad <tad@spotco.us>
2022-10-15 14:51:30 -04:00
--extra_apks com.android.virt.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.virt.apex="$KEY_DIR/avb.pem" \
Actually enforce AVB + signing fixes - Turns out AVB was set permissive this entire time :( --flags 2 == VERIFICATION_DISABLED - APEX support from GrapheneOS - Disable vbmeta chaining like GrapheneOS and optionally handle it like CalyxOS taimen 19.1 boots with locked bootloader successfully after this Signed-off-by: Tad <tad@spotco.us>
2022-04-06 10:32:44 -04:00
--extra_apks com.android.vndk.current.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.vndk.current.apex="$KEY_DIR/avb.pem" \
apex signing updates untested Signed-off-by: Tavi <tavi@divested.dev>
2024-04-09 13:25:54 -04:00
--extra_apks com.android.vndk.current.on_vendor.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.vndk.current.on_vendor.apex="$KEY_DIR/avb.pem" \
Actually enforce AVB + signing fixes - Turns out AVB was set permissive this entire time :( --flags 2 == VERIFICATION_DISABLED - APEX support from GrapheneOS - Disable vbmeta chaining like GrapheneOS and optionally handle it like CalyxOS taimen 19.1 boots with locked bootloader successfully after this Signed-off-by: Tad <tad@spotco.us>
2022-04-06 10:32:44 -04:00
--extra_apks com.android.wifi.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.wifi.apex="$KEY_DIR/avb.pem" \
apex signing updates untested Signed-off-by: Tavi <tavi@divested.dev>
2024-04-09 13:25:54 -04:00
--extra_apks com.android.wifi.dialog.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.wifi.dialog.apex="$KEY_DIR/avb.pem" \
--extra_apks com.android.wifi.resources.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.android.wifi.resources.apex="$KEY_DIR/avb.pem" \
Actually enforce AVB + signing fixes - Turns out AVB was set permissive this entire time :( --flags 2 == VERIFICATION_DISABLED - APEX support from GrapheneOS - Disable vbmeta chaining like GrapheneOS and optionally handle it like CalyxOS taimen 19.1 boots with locked bootloader successfully after this Signed-off-by: Tad <tad@spotco.us>
2022-04-06 10:32:44 -04:00
--extra_apks com.google.pixel.camera.hal.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.google.pixel.camera.hal.apex="$KEY_DIR/avb.pem" \
apex signing updates untested Signed-off-by: Tavi <tavi@divested.dev>
2024-04-09 13:25:54 -04:00
--extra_apks com.google.pixel.vibrator.hal.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.google.pixel.vibrator.hal.apex="$KEY_DIR/avb.pem" \
--extra_apks com.qorvo.uwb.apex="$KEY_DIR/releasekey" \
--extra_apex_payload_key com.qorvo.uwb.apex="$KEY_DIR/avb.pem");
Minor tweaks - 15.1+16.0: Replace in-line build signing patch with bash function - From GrapheneOS/script - 15.1+16.0: Enable fingerprint failed lockout after 5 attempts - From GrapheneOS
2019-08-27 13:13:48 -04:00
fi;
processRelease features - support removing device out after complete - support malware scan before sign - Update cherry picks
2019-10-13 20:35:24 -04:00
#Malware Scan
if [ "$DOS_MALWARE_SCAN_BEFORE_SIGN" = true ]; then
echo -e "\e[0;32mScanning files for malware before signing\e[0m";
Failed attempt at fixing signing PRODUCT_OTA_PUBLIC_KEYS is meant to be set by a vendor tree, something we don't use. Override it at the source and set it explicitely as well. This ensures that the compiled recovery.img and the one generated by sign_target_files_apks.py includes the real public keys for verification. 11.0 signing is ignored. This will need to be extensively tested as breakage can mean brick on locked devices. Although in failure cases it seems test-keys are accepted. -- After much testing there appears to be a deeper issue with how keys are inserted into the recovery and handled
2021-04-05 22:57:59 -04:00
scanForMalware false $OUT_DIR/obj/PACKAGING/target_files_intermediates/*$DEVICE-target_files-*.zip;
processRelease features - support removing device out after complete - support malware scan before sign - Update cherry picks
2019-10-13 20:35:24 -04:00
fi;
Improve release processing to support deltas and archiving
2019-08-29 14:37:06 -04:00
#Target Files
Many changes - ASB chery picks - 16.0: recovery: fix sideload - Restore releasetools for some devices - Only include Backup where supported - Change some small defaults - z00t: 14.1 -> 15.1 - himaul: 14.1 -> 15.1 - i9100: 14.1 -> 15.1+16.0 - flo: 15.1 -> 16.0, disabled - flounder: 15.1 disabled, enable 14.1
2019-09-07 09:56:47 -04:00
echo -e "\e[0;32mSigning target files\e[0m";
18.1: Initial bringup - Functionality tested on mako and klte - In-place upgrade from 17.1 tested working on klte - Compile tested on bacon and klte - Recovery OTA key patch missing, unsure if still needed. - Deblobber needs support for removing vintf manifest paths from vendor Android.bp - Launcher needs more default_workspace grid variants (eg. 4x5)
2021-03-22 19:59:15 -04:00
"$RELEASETOOLS_PREFIX"sign_target_files_apks -o -d "$KEY_DIR" \
20.0: More fixes It compiles, but fails to sign: > TypeError: cannot use a string pattern on a bytes-like object Signed-off-by: Tad <tad@spotco.us>
2022-10-15 16:22:53 -04:00
"${APK_SWITCHES[@]}" \
"${APK_SWITCHES_EXTRA[@]}" \
Actually enforce AVB + signing fixes - Turns out AVB was set permissive this entire time :( --flags 2 == VERIFICATION_DISABLED - APEX support from GrapheneOS - Disable vbmeta chaining like GrapheneOS and optionally handle it like CalyxOS taimen 19.1 boots with locked bootloader successfully after this Signed-off-by: Tad <tad@spotco.us>
2022-04-06 10:32:44 -04:00
"${APEX_SWITCHES[@]}" \
Minor tweaks - 15.1+16.0: Replace in-line build signing patch with bash function - From GrapheneOS/script - 15.1+16.0: Enable fingerprint failed lockout after 5 attempts - From GrapheneOS
2019-08-27 13:13:48 -04:00
"${VERITY_SWITCHES[@]}" \
Improve release processing to support deltas and archiving
2019-08-29 14:37:06 -04:00
$OUT_DIR/obj/PACKAGING/target_files_intermediates/*$DEVICE-target_files-*.zip \
Failed attempt at fixing signing PRODUCT_OTA_PUBLIC_KEYS is meant to be set by a vendor tree, something we don't use. Override it at the source and set it explicitely as well. This ensures that the compiled recovery.img and the one generated by sign_target_files_apks.py includes the real public keys for verification. 11.0 signing is ignored. This will need to be extensively tested as breakage can mean brick on locked devices. Although in failure cases it seems test-keys are accepted. -- After much testing there appears to be a deeper issue with how keys are inserted into the recovery and handled
2021-04-05 22:57:59 -04:00
"$OUT_DIR/$PREFIX-target_files.zip";
sha512sum "$OUT_DIR/$PREFIX-target_files.zip" > "$OUT_DIR/$PREFIX-target_files.zip.sha512sum";
Scripts: localize variables in functions
2019-09-17 00:55:50 -04:00
local INCREMENTAL_ID=$(grep "ro.build.version.incremental" $OUT_DIR/system/build.prop | cut -f2 -d "=" | sed 's/\.//g');
Failed attempt at fixing signing PRODUCT_OTA_PUBLIC_KEYS is meant to be set by a vendor tree, something we don't use. Override it at the source and set it explicitely as well. This ensures that the compiled recovery.img and the one generated by sign_target_files_apks.py includes the real public keys for verification. 11.0 signing is ignored. This will need to be extensively tested as breakage can mean brick on locked devices. Although in failure cases it seems test-keys are accepted. -- After much testing there appears to be a deeper issue with how keys are inserted into the recovery and handled
2021-04-05 22:57:59 -04:00
echo "$INCREMENTAL_ID" > "$OUT_DIR/$PREFIX-target_files.zip.id";
Improve release processing to support deltas and archiving
2019-08-29 14:37:06 -04:00
#Image
common: do not abort when recovery-in-boot when using strict (i.e set -e added by this PR) a build will fail on release when there is no recovery.img. this makes that non-fatal allowing to proceed Signed-off-by: steadfasterX <steadfasterX@users.noreply.github.com>
2023-09-26 08:54:04 -04:00
unzip -l $OUT_DIR/$PREFIX-target_files.zip | grep -q recovery.img || true;
Failed attempt at fixing signing PRODUCT_OTA_PUBLIC_KEYS is meant to be set by a vendor tree, something we don't use. Override it at the source and set it explicitely as well. This ensures that the compiled recovery.img and the one generated by sign_target_files_apks.py includes the real public keys for verification. 11.0 signing is ignored. This will need to be extensively tested as breakage can mean brick on locked devices. Although in failure cases it seems test-keys are accepted. -- After much testing there appears to be a deeper issue with how keys are inserted into the recovery and handled
2021-04-05 22:57:59 -04:00
local hasRecoveryImg="$?";
Ensure fastboot.zip is generated if necessary As dtbo is necessary on avicii, hotdog, hotdogb, instantnoodle, instantnoodlep, kebab, lemonades, pro1x Which all don't currently have a fastboo.zip provided Signed-off-by: Tad <tad@spotco.us>
2023-06-26 15:33:57 -04:00
unzip -l $OUT_DIR/$PREFIX-target_files.zip | grep -q dtbo.img;
local hasDtboImg="$?";
if [ "$hasRecoveryImg" == "1" ] || [ "$hasDtboImg" == "0" ]; then
Generate factory image if needed by device
2019-09-23 12:45:00 -04:00
echo -e "\e[0;32mCreating fastboot image\e[0m";
18.1: fix recovery signing friendly reminder to take a break when dealing with the same issue for extended periods of time
2021-04-06 05:06:15 -04:00
"$RELEASETOOLS_PREFIX"img_from_target_files "$OUT_DIR/$PREFIX-target_files.zip" \
Failed attempt at fixing signing PRODUCT_OTA_PUBLIC_KEYS is meant to be set by a vendor tree, something we don't use. Override it at the source and set it explicitely as well. This ensures that the compiled recovery.img and the one generated by sign_target_files_apks.py includes the real public keys for verification. 11.0 signing is ignored. This will need to be extensively tested as breakage can mean brick on locked devices. Although in failure cases it seems test-keys are accepted. -- After much testing there appears to be a deeper issue with how keys are inserted into the recovery and handled
2021-04-05 22:57:59 -04:00
"$OUT_DIR/$PREFIX-fastboot.zip";
sha512sum "$OUT_DIR/$PREFIX-fastboot.zip" > "$OUT_DIR/$PREFIX-fastboot.zip.sha512sum";
Generate factory image if needed by device
2019-09-23 12:45:00 -04:00
fi
Improve release processing to support deltas and archiving
2019-08-29 14:37:06 -04:00
#OTA
Many changes - ASB chery picks - 16.0: recovery: fix sideload - Restore releasetools for some devices - Only include Backup where supported - Change some small defaults - z00t: 14.1 -> 15.1 - himaul: 14.1 -> 15.1 - i9100: 14.1 -> 15.1+16.0 - flo: 15.1 -> 16.0, disabled - flounder: 15.1 disabled, enable 14.1
2019-09-07 09:56:47 -04:00
echo -e "\e[0;32mCreating OTA\e[0m";
18.1: Initial bringup - Functionality tested on mako and klte - In-place upgrade from 17.1 tested working on klte - Compile tested on bacon and klte - Recovery OTA key patch missing, unsure if still needed. - Deblobber needs support for removing vintf manifest paths from vendor Android.bp - Launcher needs more default_workspace grid variants (eg. 4x5)
2021-03-22 19:59:15 -04:00
"$RELEASETOOLS_PREFIX"ota_from_target_files $BLOCK_SWITCHES -k "$KEY_DIR/releasekey" \
FIX Signed-off-by: Tad <tad@spotco.us>
2022-04-06 16:12:16 -04:00
"$OUT_DIR/$PREFIX-target_files.zip" \
Failed attempt at fixing signing PRODUCT_OTA_PUBLIC_KEYS is meant to be set by a vendor tree, something we don't use. Override it at the source and set it explicitely as well. This ensures that the compiled recovery.img and the one generated by sign_target_files_apks.py includes the real public keys for verification. 11.0 signing is ignored. This will need to be extensively tested as breakage can mean brick on locked devices. Although in failure cases it seems test-keys are accepted. -- After much testing there appears to be a deeper issue with how keys are inserted into the recovery and handled
2021-04-05 22:57:59 -04:00
"$OUT_DIR/$PREFIX-ota.zip";
sha512sum "$OUT_DIR/$PREFIX-ota.zip" > "$OUT_DIR/$PREFIX-ota.zip.sha512sum";
Improve release processing to support deltas and archiving
2019-08-29 14:37:06 -04:00
#Deltas
Deblob manifest.xml Reverts 766219aa Fixes https://github.com/Divested-Mobile/DivestOS-Build/issues/55 Signed-off-by: Tad <tad@spotco.us>
2022-04-28 22:43:09 -04:00
#grep update_engine Build/*/device/*/*/*.mk -l
Nine device additions 20.0: - akatsuki - lemonades - dipper, equuleus, polaris, ursa 19.1: - kirin, mermaid - apollon note lemonades is failing like kebab: > Sum of sizes in oneplus_dynamic_partitions_partition_list is 3765178368, which is greater than oneplus_dynamic_partitions_size (3753902080) Signed-off-by: Tad <tad@spotco.us>
2023-05-08 22:28:11 -04:00
local DOS_GENERATE_DELTAS_DEVICES=('akari' 'akatsuki' 'alioth' 'Amber' 'aura' 'aurora' 'avicii' 'barbet' 'bluejay' 'blueline' 'bonito' 'bramble' 'cheetah' 'cheryl' 'coral' 'crosshatch' 'davinci' 'discovery' 'enchilada' 'fajita' 'flame' 'FP3' 'FP4' 'guacamole' 'guacamoleb' 'hotdog' 'hotdogb' 'instantnoodle' 'instantnoodlep' 'kebab' 'kirin' 'lemonade' 'lemonadep' 'lemonades' 'marlin' 'mata' 'mermaid' 'oriole' 'panther' 'pioneer' 'pro1' 'pro1x' 'raven' 'redfin' 'sailfish' 'sargo' 'sunfish' 'taimen' 'vayu' 'voyager' 'walleye' 'xz2c'); #TODO: check lmi/alioth/apollon
Improve release processing to support deltas and archiving
2019-08-29 14:37:06 -04:00
if [ "$DOS_GENERATE_DELTAS" = true ]; then
Small tweaks - Remove some changes that have been commented for a while - Don't remove the QCOM VR repos - Adjust the default quick tiles - Don't force hardware layers for recents - Only generate deltas for update_engine devices - Cherrypick: Update WebView to 90.0.4430.66 - Adjust yylloc sed line - Add comments to 17.1 devices explaining why they aren't removed for 18.1 yet
2021-04-14 20:48:15 -04:00
if [[ " ${DOS_GENERATE_DELTAS_DEVICES[@]} " =~ " ${DEVICE} " ]]; then
for LAST_TARGET_FILES in $ARCHIVE/target_files/$DOS_BRANDING_ZIP_PREFIX-$VERSION-*-dos-$DEVICE-target_files.zip; do
if [[ -f "$LAST_TARGET_FILES.id" ]]; then
local LAST_INCREMENTAL_ID=$(cat "$LAST_TARGET_FILES.id");
echo -e "\e[0;32mGenerating incremental OTA against $LAST_INCREMENTAL_ID\e[0m";
#TODO: Verify GPG signature and checksum of previous target-files first!
"$RELEASETOOLS_PREFIX"ota_from_target_files $BLOCK_SWITCHES -t 8 -k "$KEY_DIR/releasekey" -i \
"$LAST_TARGET_FILES" \
"$OUT_DIR/$PREFIX-target_files.zip" \
"$OUT_DIR/$PREFIX-incremental_$LAST_INCREMENTAL_ID.zip";
sha512sum "$OUT_DIR/$PREFIX-incremental_$LAST_INCREMENTAL_ID.zip" > "$OUT_DIR/$PREFIX-incremental_$LAST_INCREMENTAL_ID.zip.sha512sum";
fi;
done;
fi;
Improve release processing to support deltas and archiving
2019-08-29 14:37:06 -04:00
fi;
Minor tweaks - 15.1+16.0: Replace in-line build signing patch with bash function - From GrapheneOS/script - 15.1+16.0: Enable fingerprint failed lockout after 5 attempts - From GrapheneOS
2019-08-27 13:13:48 -04:00
recovery: fix sideload with larger files + 16.0: add a disabled patch to remove backuptool + processRelease: add support for copying recovery image to archive
2020-02-22 18:32:59 -05:00
#Extract signed recovery
Ensure fastboot.zip is generated if necessary As dtbo is necessary on avicii, hotdog, hotdogb, instantnoodle, instantnoodlep, kebab, lemonades, pro1x Which all don't currently have a fastboo.zip provided Signed-off-by: Tad <tad@spotco.us>
2023-06-26 15:33:57 -04:00
if [ "$hasRecoveryImg" == "0" ] && [ "$hasDtboImg" == "1" ]; then
recovery: fix sideload with larger files + 16.0: add a disabled patch to remove backuptool + processRelease: add support for copying recovery image to archive
2020-02-22 18:32:59 -05:00
echo -e "\e[0;32mExtracting signed recovery.img\e[0m";
Failed attempt at fixing signing PRODUCT_OTA_PUBLIC_KEYS is meant to be set by a vendor tree, something we don't use. Override it at the source and set it explicitely as well. This ensures that the compiled recovery.img and the one generated by sign_target_files_apks.py includes the real public keys for verification. 11.0 signing is ignored. This will need to be extensively tested as breakage can mean brick on locked devices. Although in failure cases it seems test-keys are accepted. -- After much testing there appears to be a deeper issue with how keys are inserted into the recovery and handled
2021-04-05 22:57:59 -04:00
mkdir "$OUT_DIR/rec_tmp";
unzip "$OUT_DIR/$PREFIX-target_files.zip" "IMAGES/recovery.img" -d "$OUT_DIR/rec_tmp";
mv "$OUT_DIR/rec_tmp/IMAGES/recovery.img" "$OUT_DIR/$PREFIX-recovery.img";
sha512sum "$OUT_DIR/$PREFIX-recovery.img" > "$OUT_DIR/$PREFIX-recovery.img.sha512sum";
recovery: fix sideload with larger files + 16.0: add a disabled patch to remove backuptool + processRelease: add support for copying recovery image to archive
2020-02-22 18:32:59 -05:00
fi;
Fix GPG signing
2020-06-27 01:45:02 -04:00
#File name fixes
Fixes + Churn - Fix instances of awk failing on missing globs - Remove unwanted packages from work/user/managed profiles - Remove proprietary camera extensions Signed-off-by: Tad <tad@spotco.us>
2023-07-24 03:59:03 -04:00
sed -i "s|$OUT_DIR/||" $OUT_DIR/*.sha512sum;
sed -i 's/-ota\././' $OUT_DIR/*.sha512sum;
sed -i 's/-incremental_/-/' $OUT_DIR/*.sha512sum;
Fixup broken checksum generation
2020-06-14 09:36:39 -04:00
Add GPG signing to processRelease
2020-06-17 13:18:16 -04:00
#GPG signing
if [ "$DOS_GPG_SIGNING" = true ]; then
for checksum in $OUT_DIR/*.sha512sum; do
Small changes
2020-06-20 14:19:40 -04:00
echo -e "\e[0;32mGPG signing $checksum\e[0m";
More fixes Signed-off-by: Tad <tad@spotco.us>
2021-10-16 16:28:41 -04:00
if gpg --homedir "$DOS_SIGNING_GPG" --sign --local-user "$DOS_GPG_SIGNING_KEY" --clearsign "$checksum"; then
Add GPG signing to processRelease
2020-06-17 13:18:16 -04:00
mv -f "$checksum.asc" "$checksum";
fi;
done;
fi;
Add an option to clobber after every run Signed-off-by: Tad <tad@spotco.us>
2022-01-24 18:01:21 -05:00
pkill java && sleep 10; #XXX: ugly hack
Improve release processing to support deltas and archiving
2019-08-29 14:37:06 -04:00
#Copy to archive
if [ "$DOS_AUTO_ARCHIVE_BUILDS" = true ]; then
Many changes - ASB chery picks - 16.0: recovery: fix sideload - Restore releasetools for some devices - Only include Backup where supported - Change some small defaults - z00t: 14.1 -> 15.1 - himaul: 14.1 -> 15.1 - i9100: 14.1 -> 15.1+16.0 - flo: 15.1 -> 16.0, disabled - flounder: 15.1 disabled, enable 14.1
2019-09-07 09:56:47 -04:00
echo -e "\e[0;32mCopying files to archive\e[0m";
Improve release processing to support deltas and archiving
2019-08-29 14:37:06 -04:00
mkdir -vp $ARCHIVE;
mkdir -vp $ARCHIVE/target_files;
Minor tweaks
2019-10-04 10:17:25 -04:00
mkdir -vp $ARCHIVE/fastboot;
Improve release processing to support deltas and archiving
2019-08-29 14:37:06 -04:00
mkdir -vp $ARCHIVE/incrementals;
Minor tweaks - 15.1+16.0: Replace in-line build signing patch with bash function - From GrapheneOS/script - 15.1+16.0: Enable fingerprint failed lockout after 5 attempts - From GrapheneOS
2019-08-27 13:13:48 -04:00
Fixup 89424768 Signed-off-by: Tad <tad@spotco.us>
2023-07-13 10:39:30 -04:00
cp -v $OUT_DIR/$PREFIX-ota.zip* $ARCHIVE/ || true;
Fix GPG signing
2020-06-27 01:45:02 -04:00
rename -- "-ota." "." $ARCHIVE/$PREFIX-ota.zip*;
Add a toggle for KSM Signed-off-by: Tad <tad@spotco.us>
2023-07-14 15:45:35 -04:00
if [ "$hasRecoveryImg" == "1" ] || [ "$hasDtboImg" == "0" ]; then cp -v $OUT_DIR/$PREFIX-fastboot.zip* $ARCHIVE/fastboot/ || true; fi;
if [ "$hasRecoveryImg" == "0" ] && [ "$hasDtboImg" == "1" ]; then cp -v $OUT_DIR/$PREFIX-recovery.img* $ARCHIVE/ || true; fi;
Small changes - Another fix - Deblobber tweaks - Patch from GrapheneOS - Cherrypick Signed-off-by: Tad <tad@spotco.us>
2023-07-13 10:45:43 -04:00
if [ "$DOS_GENERATE_DELTAS" = true ]; then
Fixup 89424768 Signed-off-by: Tad <tad@spotco.us>
2023-07-13 10:39:30 -04:00
if [[ " ${DOS_GENERATE_DELTAS_DEVICES[@]} " =~ " ${DEVICE} " ]]; then
cp -v $OUT_DIR/$PREFIX-target_files.zip* $ARCHIVE/target_files/ || true;
cp -v $OUT_DIR/$PREFIX-incremental_*.zip* $ARCHIVE/incrementals/ || true;
rename -- "-incremental_" "-" $ARCHIVE/incrementals/$PREFIX-incremental_*.zip* || true;
fi;
fi;
Disable IMS stack
2020-05-02 22:29:23 -04:00
sync;
processRelease features - support removing device out after complete - support malware scan before sign - Update cherry picks
2019-10-13 20:35:24 -04:00
#Remove to make space for next build
if [ "$DOS_REMOVE_AFTER" = true ]; then
echo -e "\e[0;32mRemoving to reclaim space\e[0m";
#TODO: add a sanity check
Tweaks Signed-off-by: Tad <tad@spotco.us>
2022-03-11 22:35:10 -05:00
rm -rf --one-file-system "$OUT_DIR";
if [ "$DOS_REMOVE_AFTER_FULL" = true ]; then rm -rf --one-file-system "$DOS_BUILD_BASE/out"; fi; #clobber entire workspace
Fixup 492ba67d It'd still error on a device that didn't support deltas Signed-off-by: Tad <tad@spotco.us>
2023-07-13 10:36:48 -04:00
sync;
processRelease features - support removing device out after complete - support malware scan before sign - Update cherry picks
2019-10-13 20:35:24 -04:00
fi;
Improve release processing to support deltas and archiving
2019-08-29 14:37:06 -04:00
fi;
processRelease features - support removing device out after complete - support malware scan before sign - Update cherry picks
2019-10-13 20:35:24 -04:00
sync;
Many changes - ASB chery picks - 16.0: recovery: fix sideload - Restore releasetools for some devices - Only include Backup where supported - Change some small defaults - z00t: 14.1 -> 15.1 - himaul: 14.1 -> 15.1 - i9100: 14.1 -> 15.1+16.0 - flo: 15.1 -> 16.0, disabled - flounder: 15.1 disabled, enable 14.1
2019-09-07 09:56:47 -04:00
echo -e "\e[0;32mRelease processing complete\e[0m";
Minor tweaks - 15.1+16.0: Replace in-line build signing patch with bash function - From GrapheneOS/script - 15.1+16.0: Enable fingerprint failed lockout after 5 attempts - From GrapheneOS
2019-08-27 13:13:48 -04:00
}
Improve release processing to support deltas and archiving
2019-08-29 14:37:06 -04:00
export -f processRelease;
Minor tweaks - 15.1+16.0: Replace in-line build signing patch with bash function - From GrapheneOS/script - 15.1+16.0: Enable fingerprint failed lockout after 5 attempts - From GrapheneOS
2019-08-27 13:13:48 -04:00
Fixup broken checksum generation
2020-06-14 09:36:39 -04:00
pushToServer() {
Robustness improvements Signed-off-by: Tad <tad@spotco.us>
2023-03-08 00:22:01 -05:00
#Examples
Small changes
2020-07-25 09:51:25 -04:00
rsync -Pau --no-perms --no-owner --no-group incrementals/divested-*-dos-$1-*.zip* root@divestos.org:/var/www/divestos.org/builds/LineageOS/$1/incrementals/ || true;
rsync -Pau --no-perms --no-owner --no-group divested-*-dos-$1.zip* root@divestos.org:/var/www/divestos.org/builds/LineageOS/$1/ || true;
rsync -Pau --no-perms --no-owner --no-group divested-*-dos-$1-recovery.img root@divestos.org:/var/www/divestos.org/builds/LineageOS/$1/ || true;
rsync -Pau --no-perms --no-owner --no-group fastboot/divested-*-dos-$1-*.zip* root@divestos.org:/var/www/divestos.org/builds/LineageOS/$1/ || true;
Fixup broken checksum generation
2020-06-14 09:36:39 -04:00
}
export -f pushToServer;
Small changes - SUPL NTP fix - Remove debug info from dexpreopt, saves a few MB - 15.1+: enable full dexpreopt, for perf and memory benefits - 17.1: change oneplus/msm8998-common kernel - 17.1: add OpenCamera to AUX list - Resurrect verity for devices missed previously - Update some CVE patchers - deblobber: remove some lingering atfwd blobs
2020-11-01 09:50:03 -05:00
removeBuildFingerprints() {
#Removes the stock/vendor fingerprint, allowing one to be generated instead
find device -maxdepth 3 -name "lineage*.mk" -type f -exec sh -c "awk -i inplace '!/BUILD_FINGERPRINT/' {}" \;
find device -maxdepth 3 -name "lineage*.mk" -type f -exec sh -c "awk -i inplace '!/PRIVATE_BUILD_DESC/' {}" \;
echo "Removed stock build fingerprints";
Small changes
2020-07-25 09:51:25 -04:00
}
Small changes - SUPL NTP fix - Remove debug info from dexpreopt, saves a few MB - 15.1+: enable full dexpreopt, for perf and memory benefits - 17.1: change oneplus/msm8998-common kernel - 17.1: add OpenCamera to AUX list - Resurrect verity for devices missed previously - Update some CVE patchers - deblobber: remove some lingering atfwd blobs
2020-11-01 09:50:03 -05:00
export -f removeBuildFingerprints;
Small changes
2020-07-25 09:51:25 -04:00
Certificate Authority store updates - Remove some untrustworthy CAs - Update CA store for all branches to aosp/e302aa968334b3c3fc9cd709a7c7661e0cf534eb Signed-off-by: Tad <tad@spotco.us>
2023-06-17 14:50:49 -04:00
removeUntrustedCerts() {
cd "$DOS_BUILD_BASE/system/ca-certificates/files";
rm -fv 7c302982.0 c2c1704e.0 d0cddf45.0; #TrustCor
rm -fv cb156124.0; #E-Turga
cd "$DOS_BUILD_BASE";
echo "Removed untrusted certificate authorities";
}
export -f removeUntrustedCerts;
Dramatically deduplicate scripts
2018-04-04 07:52:11 -04:00
compressRamdisks() {
if [ -f BoardConfig.mk ]; then
echo "LZMA_RAMDISK_TARGETS := boot,recovery" >> BoardConfig.mk;
echo "Enabled ramdisk compression";
fi;
}
export -f compressRamdisks;
Many small changes - Cherrypicks for ASB patches - Apps: Switch gallery to Simple Gallery - Apps: Switch camera to OpenCamera - PKGBUILD: update with image optimization dependencies - Deblobber: fix bug introducted in 6d33e4ecbfc3065e13adc42d658817bbc2c076fb
2019-08-05 23:56:52 -04:00
smallerSystem() {
echo "BOARD_SYSTEMIMAGE_JOURNAL_SIZE := 0" >> BoardConfig.mk;
Small tweaks
2021-04-12 21:24:57 -04:00
echo "PRODUCT_MINIMIZE_JAVA_DEBUG_INFO := true" >> device.mk;
Per-device signing keys - also fix OTA/recovery key regression - Update cherrypicks
2019-09-13 20:26:43 -04:00
echo "EXCLUDE_SERIF_FONTS := true" >> BoardConfig.mk;
echo "SMALLER_FONT_FOOTPRINT := true" >> BoardConfig.mk;
#echo "MINIMAL_FONT_FOOTPRINT := true" >> BoardConfig.mk;
Many small changes - Cherrypicks for ASB patches - Apps: Switch gallery to Simple Gallery - Apps: Switch camera to OpenCamera - PKGBUILD: update with image optimization dependencies - Deblobber: fix bug introducted in 6d33e4ecbfc3065e13adc42d658817bbc2c076fb
2019-08-05 23:56:52 -04:00
sed -i 's/common_full_phone.mk/common_mini_phone.mk/' *.mk &>/dev/null || true;
Fixes Signed-off-by: Tad <tad@spotco.us>
2022-04-01 07:35:28 -04:00
echo "Set smaller system args for $PWD";
Many small changes - Cherrypicks for ASB patches - Apps: Switch gallery to Simple Gallery - Apps: Switch camera to OpenCamera - PKGBUILD: update with image optimization dependencies - Deblobber: fix bug introducted in 6d33e4ecbfc3065e13adc42d658817bbc2c076fb
2019-08-05 23:56:52 -04:00
}
export -f smallerSystem;
Fix many device issues - Fix mata - Fix cheeseburger - Enable near-entire IMS stack (proprietary) - Fix many other new devices
2020-02-19 22:07:57 -05:00
deblobAudio() {
Re-enable the SOUND_TRIGGER removal bits disabled in e9fd952b It does not fix the phone call audio issues on mata like I hoped it would.
2021-01-18 09:11:37 -05:00
awk -i inplace '!/BOARD_SUPPORTS_SOUND_TRIGGER/' hardware/qcom/audio-caf/*/configs/*/*.mk &>/dev/null || true;
awk -i inplace '!/android.hardware.soundtrigger/' hardware/qcom/audio-caf/*/configs/*/*.mk &>/dev/null || true;
Tweak Signed-off-by: Tad <tad@spotco.us>
2022-02-21 23:30:45 -05:00
if [ "$DOS_DEBLOBBER_REMOVE_AUDIOFX" = true ]; then
awk -i inplace '!/DOLBY_/' hardware/qcom/audio-caf/*/configs/*/*.mk &>/dev/null || true;
#awk -i inplace '!/vendor.audio.dolby/' hardware/qcom/audio-caf/*/configs/*/*.mk &>/dev/null || true;
fi;
Fixes Signed-off-by: Tad <tad@spotco.us>
2022-04-01 07:35:28 -04:00
echo "Deblobbed audio!";
Fix many device issues - Fix mata - Fix cheeseburger - Enable near-entire IMS stack (proprietary) - Fix many other new devices
2020-02-19 22:07:57 -05:00
}
export -f deblobAudio;
Tiny tweaks
2020-10-22 15:24:17 -04:00
volteOverride() {
Robustness improvements Signed-off-by: Tad <tad@spotco.us>
2023-03-08 00:22:01 -05:00
cd "$DOS_BUILD_BASE/$1";
Tiny tweaks
2020-10-22 15:24:17 -04:00
if grep -sq "config_device_volte_available" "overlay/frameworks/base/core/res/res/values/config.xml"; then
if [ -f vendor.prop ] && ! grep -sq "volte_avail_ovr" "vendor.prop"; then
volteOverride: we don't care about video calling Signed-off-by: Tad <tad@spotco.us>
2023-05-19 12:26:16 -04:00
echo -e 'persist.dbg.volte_avail_ovr=1' >> vendor.prop;
Tiny tweaks
2020-10-22 15:24:17 -04:00
echo "Set VoLTE override in vendor.prop for $1";
Many small tweaks - Remove leftover WireGuard repo missed in 31898834 - Enable the volteOverride, to ensure VoLTE enablement on supported devices on unknown carriers - Extend volteOverride to support system.prop if vendor.prop doesn't exist (to cover eg. marlin/sailfish) - Disable commenting of SOUND_TRIGGER flags. sountrigger blobs are not removed due to boot breakage. disable this and stop patching hardware/qcom/audio. Intended to potentially fix phone call audio issues on mata - Small CVE patcher updates
2021-01-15 17:28:35 -05:00
elif [ -f system.prop ] && ! grep -sq "volte_avail_ovr" "system.prop"; then
volteOverride: we don't care about video calling Signed-off-by: Tad <tad@spotco.us>
2023-05-19 12:26:16 -04:00
echo -e 'persist.dbg.volte_avail_ovr=1' >> system.prop;
Many small tweaks - Remove leftover WireGuard repo missed in 31898834 - Enable the volteOverride, to ensure VoLTE enablement on supported devices on unknown carriers - Extend volteOverride to support system.prop if vendor.prop doesn't exist (to cover eg. marlin/sailfish) - Disable commenting of SOUND_TRIGGER flags. sountrigger blobs are not removed due to boot breakage. disable this and stop patching hardware/qcom/audio. Intended to potentially fix phone call audio issues on mata - Small CVE patcher updates
2021-01-15 17:28:35 -05:00
echo "Set VoLTE override in system.prop for $1";
Tiny tweaks
2020-10-22 15:24:17 -04:00
fi;
if [ -f vendor_prop.mk ] && ! grep -sq "volte_avail_ovr" "vendor_prop.mk"; then
volteOverride: we don't care about video calling Signed-off-by: Tad <tad@spotco.us>
2023-05-19 12:26:16 -04:00
echo -e '\nPRODUCT_PROPERTY_OVERRIDES += \\\n persist.dbg.volte_avail_ovr=1' >> vendor_prop.mk;
Tiny tweaks
2020-10-22 15:24:17 -04:00
echo "Set VoLTE override in vendor_prop.mk for $1";
fi;
Many small tweaks - Remove leftover WireGuard repo missed in 31898834 - Enable the volteOverride, to ensure VoLTE enablement on supported devices on unknown carriers - Extend volteOverride to support system.prop if vendor.prop doesn't exist (to cover eg. marlin/sailfish) - Disable commenting of SOUND_TRIGGER flags. sountrigger blobs are not removed due to boot breakage. disable this and stop patching hardware/qcom/audio. Intended to potentially fix phone call audio issues on mata - Small CVE patcher updates
2021-01-15 17:28:35 -05:00
#TODO: init/init*.cpp, device*.mk
Tiny tweaks
2020-10-22 15:24:17 -04:00
fi;
cd "$DOS_BUILD_BASE";
}
export -f volteOverride;
Fix many device issues - Fix mata - Fix cheeseburger - Enable near-entire IMS stack (proprietary) - Fix many other new devices
2020-02-19 22:07:57 -05:00
Remove User-Agent (and serial) from source built libloc Signed-off-by: Tad <tad@spotco.us>
2023-05-05 22:25:47 -04:00
hardenLocationSerials() {
#Prevent Qualcomm location stack from sending chipset serial number
#Devices using blob xtra-daemon (which Deblob.sh removes)
Fixups Signed-off-by: Tad <tad@spotco.us>
2023-07-06 16:37:45 -04:00
if [[ "$DOS_VERSION" != "LineageOS-20.0" ]]; then #20.0 has sysfs_soc_sensitive label
find device -name "hal_gnss*.te" -type f -exec sh -c "awk -i inplace '!/sysfs_soc/' {}" \;
find device -name "location.te" -type f -exec sh -c "awk -i inplace '!/sysfs_soc/' {}" \;
fi;
Remove User-Agent (and serial) from source built libloc Signed-off-by: Tad <tad@spotco.us>
2023-05-05 22:25:47 -04:00
#Devices using source built libloc, these ones typically have broad /sys access
## Null out the User-Agent header
find device -name "LocEngAdapter.cpp" -type f -exec sh -c "sed -i 's/userAgent, strlen(userAgent)/\"-\", 1/' {}" \;
find hardware -name "LocEngAdapter.cpp" -type f -exec sh -c "sed -i 's/userAgent, strlen(userAgent)/\"-\", 1/' {}" \;
## Prevent reading the serial number
find device -name "LocEngAdapter.cpp" -type f -exec sh -c "sed -i 's|soc0/serial_number|soc0/invalid|' {}" \;
find hardware -name "LocEngAdapter.cpp" -type f -exec sh -c "sed -i 's|soc0/serial_number|soc0/invalid|' {}" \;
Prevent Qualcomm location stack from reading chipset serial number The deblobber already removes xtra-daemon which is what actually performs the requests. This is just extra sanctity. Signed-off-by: Tad <tad@spotco.us>
2023-05-03 21:39:48 -04:00
echo "Removed serial number access to Qualcomm location stacks";
}
Remove User-Agent (and serial) from source built libloc Signed-off-by: Tad <tad@spotco.us>
2023-05-05 22:25:47 -04:00
export -f hardenLocationSerials;
Prevent Qualcomm location stack from reading chipset serial number The deblobber already removes xtra-daemon which is what actually performs the requests. This is just extra sanctity. Signed-off-by: Tad <tad@spotco.us>
2023-05-03 21:39:48 -04:00
Improve hardenLocation to include fwb and its overlays
2019-02-08 18:46:42 -05:00
hardenLocationConf() {
Scripts: localize variables in functions
2019-09-17 00:55:50 -04:00
local gpsConfig=$1;
Small changes - SUPL NTP fix - Remove debug info from dexpreopt, saves a few MB - 15.1+: enable full dexpreopt, for perf and memory benefits - 17.1: change oneplus/msm8998-common kernel - 17.1: add OpenCamera to AUX list - Resurrect verity for devices missed previously - Update some CVE patchers - deblobber: remove some lingering atfwd blobs
2020-11-01 09:50:03 -05:00
#Debugging: adb logcat -b all | grep -i -e locsvc -e izat -e gps -e gnss -e location -e xtra
Promote LGE G5, G6, and V20 to 19.1 Signed-off-by: Tad <tad@spotco.us>
2023-05-17 01:27:02 -04:00
#sed -i 's|DEBUG_LEVEL = .|DEBUG_LEVEL = 4|' "$gpsConfig" &> /dev/null || true; #Debug
#sed -i 's|DEBUG_LEVEL = .|DEBUG_LEVEL = 2|' "$gpsConfig" &> /dev/null || true; #Warning
Dramatically deduplicate scripts
2018-04-04 07:52:11 -04:00
#Enable GLONASS
GPS improvements
2018-08-07 23:07:36 -04:00
if [ "$DOS_GPS_GLONASS_FORCED" = true ]; then
Updates
2019-02-06 17:15:45 -05:00
sed -i 's/#A_GLONASS_POS_PROTOCOL_SELECT =/A_GLONASS_POS_PROTOCOL_SELECT =/' "$gpsConfig" &>/dev/null || true;
GPS improvements
2018-08-07 23:07:36 -04:00
sed -i 's/A_GLONASS_POS_PROTOCOL_SELECT = 0.*/A_GLONASS_POS_PROTOCOL_SELECT = 15/' "$gpsConfig" &>/dev/null || true;
Misc tweaks
2018-06-03 08:24:23 -04:00
fi;
GPS improvements
2018-08-07 23:07:36 -04:00
#Change capabilities
Fix GPS on various devices
2018-09-19 01:03:02 -04:00
sed -i 's|CAPABILITIES=.*|CAPABILITIES=0x13|' "$gpsConfig" &> /dev/null || true; #Disable MSA (privacy) and geofencing/ULP (both broken by deblobber)
A-GPS: disable LPP and LPPE also handle cases in variables Signed-off-by: Tad <tad@spotco.us>
2023-07-09 23:47:24 -04:00
sed -i 's|CAPABILITIES = .*|CAPABILITIES = 0x13|' "$gpsConfig" &> /dev/null || true;
sed -i 's/#SUPL_MODE=/SUPL_MODE=/' "$gpsConfig" &>/dev/null || true; #Uncomment
sed -i 's/#SUPL_MODE = /SUPL_MODE = /' "$gpsConfig" &>/dev/null || true;
Updates
2019-02-06 17:15:45 -05:00
sed -i 's/SUPL_MODE=$/SUPL_MODE=1/' "$gpsConfig" &>/dev/null || true; #Set to MSB if blank (to prevent MSA+MSB default)
A-GPS: disable LPP and LPPE also handle cases in variables Signed-off-by: Tad <tad@spotco.us>
2023-07-09 23:47:24 -04:00
sed -i 's/SUPL_MODE = $/SUPL_MODE = 1/' "$gpsConfig" &>/dev/null || true;
Improve hardenLocation to include fwb and its overlays
2019-02-08 18:46:42 -05:00
sed -i "s|SUPL_MODE=3|SUPL_MODE=1|" "$gpsConfig" &> /dev/null || true; #Disable MSA (privacy)
A-GPS: disable LPP and LPPE also handle cases in variables Signed-off-by: Tad <tad@spotco.us>
2023-07-09 23:47:24 -04:00
sed -i "s|SUPL_MODE = 3|SUPL_MODE = 1|" "$gpsConfig" &> /dev/null || true;
sed -i 's/#LPP_PROFILE=/LPP_PROFILE=/' "$gpsConfig" &>/dev/null || true; #Uncomment
sed -i 's/#LPP_PROFILE = /LPP_PROFILE = /' "$gpsConfig" &>/dev/null || true;
sed -i "s|LPP_PROFILE=.*|LPP_PROFILE=0|" "$gpsConfig" &> /dev/null || true; #Disable LPP (privacy)
sed -i "s|LPP_PROFILE = .*|LPP_PROFILE = 0|" "$gpsConfig" &> /dev/null || true;
sed -i "s|LPPE_CP_TECHNOLOGY=.*|LPPE_CP_TECHNOLOGY=0|" "$gpsConfig" &> /dev/null || true;
sed -i "s|LPPE_CP_TECHNOLOGY = .*|LPPE_CP_TECHNOLOGY = 0|" "$gpsConfig" &> /dev/null || true;
sed -i "s|LPPE_UP_TECHNOLOGY=.*|LPPE_UP_TECHNOLOGY=0|" "$gpsConfig" &> /dev/null || true;
sed -i "s|LPPE_UP_TECHNOLOGY = .*|LPPE_UP_TECHNOLOGY = 0|" "$gpsConfig" &> /dev/null || true;
Updates
2019-02-06 17:15:45 -05:00
#CVE-2018-9526 - See: https://android.googlesource.com/device/google/marlin/+/fa7f7382e8b39f7ca209824f97788ab25c44f6a3
sed -i 's/#SUPL_ES=/SUPL_ES=/' "$gpsConfig" &>/dev/null || true;
Improve hardenLocation to include fwb and its overlays
2019-02-08 18:46:42 -05:00
sed -i "s|SUPL_ES=0|SUPL_ES=1|" "$gpsConfig" &> /dev/null || true;
GPS improvements
2018-08-07 23:07:36 -04:00
#Change servers
sed -i "s|SUPL_HOST=.*|SUPL_HOST=$DOS_GPS_SUPL_HOST|" "$gpsConfig" &> /dev/null || true;
A-GPS: disable LPP and LPPE also handle cases in variables Signed-off-by: Tad <tad@spotco.us>
2023-07-09 23:47:24 -04:00
sed -i "s|SUPL_HOST = .*|SUPL_HOST = $DOS_GPS_SUPL_HOST|" "$gpsConfig" &> /dev/null || true;
GPS improvements
2018-08-07 23:07:36 -04:00
sed -i "s|NTP_SERVER=.*|NTP_SERVER=$DOS_GPS_NTP_SERVER|" "$gpsConfig" &> /dev/null || true;
A-GPS: disable LPP and LPPE also handle cases in variables Signed-off-by: Tad <tad@spotco.us>
2023-07-09 23:47:24 -04:00
sed -i "s|NTP_SERVER = .*|NTP_SERVER = $DOS_GPS_NTP_SERVER|" "$gpsConfig" &> /dev/null || true;
Updates
2019-02-06 17:15:45 -05:00
#CVE-2016-5341 - See: https://wwws.nightwatchcybersecurity.com/2016/12/05/cve-2016-5341/
Dramatically deduplicate scripts
2018-04-04 07:52:11 -04:00
#XTRA: Only use specified URLs
GPS improvements
2018-08-07 23:07:36 -04:00
sed -i 's|XTRA_SERVER_QUERY=1|XTRA_SERVER_QUERY=0|' "$gpsConfig" &>/dev/null || true;
A-GPS: disable LPP and LPPE also handle cases in variables Signed-off-by: Tad <tad@spotco.us>
2023-07-09 23:47:24 -04:00
sed -i 's|XTRA_SERVER_QUERY = 1|XTRA_SERVER_QUERY = 0|' "$gpsConfig" &>/dev/null || true;
GPS improvements
2018-08-07 23:07:36 -04:00
sed -i 's|#XTRA_SERVER|XTRA_SERVER|' "$gpsConfig" &>/dev/null || true;
More GPS fixes
2018-08-09 00:42:07 -04:00
#Switch gpsOneXtra to IZatCloud (invalid certificate)
Improve hardenLocation to include fwb and its overlays
2019-02-08 18:46:42 -05:00
sed -i '/xtrapath/!s|://xtra|://xtrapath|' "$gpsConfig" &>/dev/null || true;
sed -i 's|gpsonextra.net|izatcloud.net|' "$gpsConfig" &>/dev/null || true;
14.1+15.1: GPS week rollover fix 16.0: 279492 17.1: 278135 also switch to alternate Xtra servers https://developer.gemalto.com/threads/gps-time-info-error
2020-08-09 12:14:29 -04:00
sed -i 's|xtrapath1|xtrapath4|' "$gpsConfig" &>/dev/null || true;
sed -i 's|xtrapath2|xtrapath5|' "$gpsConfig" &>/dev/null || true;
sed -i 's|xtrapath3|xtrapath6|' "$gpsConfig" &>/dev/null || true;
More GPS fixes
2018-08-09 00:42:07 -04:00
#Enable HTTPS (IZatCloud supports HTTPS)
Improve hardenLocation to include fwb and its overlays
2019-02-08 18:46:42 -05:00
sed -i 's|http://xtrapath|https://xtrapath|' "$gpsConfig" &>/dev/null || true;
Use HTTPS for GLPals Signed-off-by: Tad <tad@spotco.us>
2023-01-20 21:20:29 -05:00
sed -i 's|http://gllto|https://gllto|' "$gpsConfig" &>/dev/null || true;
Improve hardenLocation to include fwb and its overlays
2019-02-08 18:46:42 -05:00
echo "Enhanced location services for $gpsConfig";
Dramatically deduplicate scripts
2018-04-04 07:52:11 -04:00
}
Improve hardenLocation to include fwb and its overlays
2019-02-08 18:46:42 -05:00
export -f hardenLocationConf;
Updater: Fix downloads over Tor + Update TODO + Minor tweaks
2019-02-08 20:58:15 -05:00
hardenLocationFWB() {
Scripts: localize variables in functions
2019-09-17 00:55:50 -04:00
local dir=$1;
Improve hardenLocation to include fwb and its overlays
2019-02-08 18:46:42 -05:00
#Enable GLONASS
if [ "$DOS_GPS_GLONASS_FORCED" = true ]; then
sed -i 's|A_GLONASS_POS_PROTOCOL_SELECT=0.*</item>|A_GLONASS_POS_PROTOCOL_SELECT=15</item>|' "$dir"/frameworks/base/core/res/res/values*/*.xml &>/dev/null || true;
fi;
#Change capabilities
sed -i "s|SUPL_MODE=3|SUPL_MODE=1|" "$dir"/frameworks/base/core/res/res/values*/*.xml &> /dev/null || true; #Disable MSA (privacy)
A-GPS: disable LPP and LPPE also handle cases in variables Signed-off-by: Tad <tad@spotco.us>
2023-07-09 23:47:24 -04:00
sed -i "s|LPP_PROFILE=.*</item>|LPP_PROFILE=0</item>|" "$dir"/frameworks/base/core/res/res/values*/*.xml &> /dev/null || true; #Disable LPP (privacy)
sed -i "s|LPPE_CP_TECHNOLOGY=.*</item>|LPPE_CP_TECHNOLOGY=0</item>|" "$dir"/frameworks/base/core/res/res/values*/*.xml &> /dev/null || true
sed -i "s|LPPE_UP_TECHNOLOGY=.*</item>|LPPE_UP_TECHNOLOGY=0</item>|" "$dir"/frameworks/base/core/res/res/values*/*.xml &> /dev/null || true;
Improve hardenLocation to include fwb and its overlays
2019-02-08 18:46:42 -05:00
#CVE-2018-9526 - See: https://android.googlesource.com/device/google/marlin/+/fa7f7382e8b39f7ca209824f97788ab25c44f6a3
sed -i "s|SUPL_ES=0|SUPL_ES=1|" "$dir"/frameworks/base/core/res/res/values*/*.xml &> /dev/null || true;
#Change servers
sed -i "s|NTP_SERVER=.*</item>|NTP_SERVER=$DOS_GPS_NTP_SERVER</item>|" "$dir"/frameworks/base/core/res/res/values*/*.xml &> /dev/null || true;
#CVE-2016-5341 - See: https://wwws.nightwatchcybersecurity.com/2016/12/05/cve-2016-5341/
#Switch gpsOneXtra to IZatCloud (invalid certificate)
sed -i '/xtrapath/!s|://xtra|://xtrapath|' "$dir"/frameworks/base/core/res/res/values*/*.xml &>/dev/null || true;
sed -i 's|gpsonextra.net|izatcloud.net|' "$dir"/frameworks/base/core/res/res/values*/*.xml &>/dev/null || true;
14.1+15.1: GPS week rollover fix 16.0: 279492 17.1: 278135 also switch to alternate Xtra servers https://developer.gemalto.com/threads/gps-time-info-error
2020-08-09 12:14:29 -04:00
sed -i 's|xtrapath1|xtrapath4|' "$dir"/frameworks/base/core/res/res/values*/*.xml &>/dev/null || true;
sed -i 's|xtrapath2|xtrapath5|' "$dir"/frameworks/base/core/res/res/values*/*.xml &>/dev/null || true;
sed -i 's|xtrapath3|xtrapath6|' "$dir"/frameworks/base/core/res/res/values*/*.xml &>/dev/null || true;
Improve hardenLocation to include fwb and its overlays
2019-02-08 18:46:42 -05:00
#Enable HTTPS (IZatCloud supports HTTPS)
sed -i 's|http://xtrapath|https://xtrapath|' "$dir"/frameworks/base/core/res/res/values*/*.xml &>/dev/null || true;
Use HTTPS for GLPals Signed-off-by: Tad <tad@spotco.us>
2023-01-20 21:20:29 -05:00
sed -i 's|http://gllto|https://gllto|' "$dir"/frameworks/base/core/res/res/values*/*.xml &>/dev/null || true;
Improve hardenLocation to include fwb and its overlays
2019-02-08 18:46:42 -05:00
echo "Enhanced location services for $dir";
}
Updater: Fix downloads over Tor + Update TODO + Minor tweaks
2019-02-08 20:58:15 -05:00
export -f hardenLocationFWB;
Dramatically deduplicate scripts
2018-04-04 07:52:11 -04:00
Minor tweaks and update F-Droid
2018-09-12 13:43:05 -04:00
hardenUserdata() {
Robustness improvements Signed-off-by: Tad <tad@spotco.us>
2023-03-08 00:22:01 -05:00
cd "$DOS_BUILD_BASE/$1";
Manifest cleanup + always remove latemount from /cache formatting/erasing /cache will result in selinux contexts being lost these are normally restored by system/core/rootdir/init.rc in post-fs but latemount causes /cache to not be mounted beforehand preventing it from ever being fixed result is broken ota and recovery updates
2018-12-20 17:22:34 -05:00
#Remove latemount to allow selinux contexts be restored upon /cache wipe
#Fixes broken OTA updater and broken /recovery updater
FIX Signed-off-by: Tad <tad@spotco.us>
2022-04-06 16:12:16 -04:00
sed -i '/\/cache/s|latemount,||' *fstab* */*fstab* */*/*fstab* &>/dev/null || true;
Manifest cleanup + always remove latemount from /cache formatting/erasing /cache will result in selinux contexts being lost these are normally restored by system/core/rootdir/init.rc in post-fs but latemount causes /cache to not be mounted beforehand preventing it from ever being fixed result is broken ota and recovery updates
2018-12-20 17:22:34 -05:00
Minor tweaks and update F-Droid
2018-09-12 13:43:05 -04:00
#TODO: Ensure: noatime,nosuid,nodev
FIX Signed-off-by: Tad <tad@spotco.us>
2022-04-06 16:12:16 -04:00
sed -i '/\/data/{/discard/!s|nosuid|discard,nosuid|}' *fstab* */*fstab* */*/*fstab* &>/dev/null || true;
20.0 doesn't support FDE Should fix boot on some LGE devices Signed-off-by: Tavi <tavi@divested.dev>
2024-02-13 17:04:24 -05:00
if [ "$1" != "device/samsung/tuna" ] && [ "$1" != "device/amazon/hdx-common" ] && [ "$1" != "device/motorola/athene" ] && [[ "$DOS_VERSION" != "LineageOS-20.0" ]]; then #tuna needs first boot to init, hdx-c has broken encryption
FIX Signed-off-by: Tad <tad@spotco.us>
2022-04-06 16:12:16 -04:00
sed -i 's|encryptable=/|forceencrypt=/|' *fstab* */*fstab* */*/*fstab* &>/dev/null || true;
More minor fixes
2019-03-26 19:37:56 -04:00
fi;
Minor tweaks and update F-Droid
2018-09-12 13:43:05 -04:00
echo "Hardened /data for $1";
Overhaul variable names
2018-06-29 00:55:21 -04:00
cd "$DOS_BUILD_BASE";
Dramatically deduplicate scripts
2018-04-04 07:52:11 -04:00
}
Minor tweaks and update F-Droid
2018-09-12 13:43:05 -04:00
export -f hardenUserdata;
Dramatically deduplicate scripts
2018-04-04 07:52:11 -04:00
Enable Clang's -ftrivial-auto-var-init=zero on supported kernels Signed-off-by: Tad <tad@spotco.us>
2022-03-31 20:27:25 -04:00
enableAutoVarInit() {
Update CVE patchers TODO: maybe split CVE-2022-23960/4.9 to get back? Signed-off-by: Tad <tad@spotco.us>
2022-04-19 12:26:51 -04:00
#grep TARGET_KERNEL_CLANG_COMPILE Build/*/device/*/*/*.mk -l
Pixel 6/7 prep + fixes These still need defconfig and deblobber handling All of these sections were reviewed & sorted Signed-off-by: Tad <tad@spotco.us>
2022-12-14 21:23:13 -05:00
#but exclude: grep INIT_STACK_ALL_ZERO Build/*/kernel/*/*/security/Kconfig.hardening -l
Promotions 16.0 santoni/land to 20.0 Mi8937 unified 17.1 griffin to 18.1 17.1 star*/crownlte to 20.0 20.0 add pro1x Signed-off-by: Tad <tad@spotco.us>
2023-04-17 13:06:09 -04:00
#already supported: fairphone/sm7225, fxtec/sm6115, google/bluejay, google/gs101, google/gs201, google/msm-4.14, google/raviole, google/redbull, oneplus/sm8250, oneplus/sm8350
Fixup 09494a1c compile tested: vayu, pioneer Signed-off-by: Tad <tad@spotco.us>
2023-11-07 18:59:53 -05:00
local DOS_AUTOVARINIT_KERNELS=('essential/msm8998' 'fairphone/sdm632' 'fxtec/msm8998' 'google/coral' 'google/msm-4.9' 'google/sunfish' 'google/wahoo' 'oneplus/msm8996' 'oneplus/msm8998' 'oneplus/sdm845' 'oneplus/sm7250' 'oneplus/sm8150' 'razer/msm8998' 'razer/sdm845' 'samsung/exynos9810' 'samsung/universal9810' 'sony/sdm660' 'sony/sdm845' 'xiaomi/msm8937' 'xiaomi/sdm660' 'xiaomi/sdm845' 'xiaomi/sm6150' 'xiaomi/sm8150' 'xiaomi/vayu' 'xiaomi/sm8250' 'zuk/msm8996');
Enable Clang's -ftrivial-auto-var-init=zero on supported kernels Signed-off-by: Tad <tad@spotco.us>
2022-03-31 20:27:25 -04:00
cd "$DOS_BUILD_BASE";
Fixes Signed-off-by: Tad <tad@spotco.us>
2022-04-01 07:35:28 -04:00
echo "auto-var-init: Starting!";
Enable Clang's -ftrivial-auto-var-init=zero on supported kernels Signed-off-by: Tad <tad@spotco.us>
2022-03-31 20:27:25 -04:00
for kernel in "${DOS_AUTOVARINIT_KERNELS[@]}"
do
if [ -d "$DOS_BUILD_BASE/kernel/$kernel" ]; then
cd "$DOS_BUILD_BASE/kernel/$kernel";
if git apply --check "$DOS_PATCHES_COMMON/android_kernel_common/0001-auto_var_init.patch" &> /dev/null; then
if git apply "$DOS_PATCHES_COMMON/android_kernel_common/0001-auto_var_init.patch" &> /dev/null; then #(GrapheneOS)
echo "auto-var-init: Enabled for $kernel";
else
echo "auto-var-init: Failed to enable for $kernel";
fi;
elif git apply --check --reverse "$DOS_PATCHES_COMMON/android_kernel_common/0001-auto_var_init.patch" &> /dev/null; then
echo "auto-var-init: Already enabled for $kernel";
elif grep -q "trivial-auto-var-init=pattern" Makefile; then
sed -i 's/ftrivial-auto-var-init=pattern/ftrivial-auto-var-init=zero -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang/' Makefile; #(GrapheneOS)
grep -q "trivial-auto-var-init=pattern" Makefile;
if [ $? -eq 0 ]; then
echo "auto-var-init: Failed to switch from pattern to zero on $kernel";
else
echo "auto-var-init: Switched from pattern to zero on $kernel";
fi;
elif grep -q "trivial-auto-var-init=zero" Makefile; then
echo "auto-var-init: Already enabled for $kernel";
else
echo "auto-var-init: Could not enable for $kernel";
fi;
Page sanitization improvements This ensures init_on_alloc/free is used instead of page poisioning where available. 3.4 through 3.18 have a patch without a toggle for page sanitization. Signed-off-by: Tad <tad@spotco.us>
2022-04-02 02:18:30 -04:00
# else
# echo "auto-var-init: $kernel not in tree";
Enable Clang's -ftrivial-auto-var-init=zero on supported kernels Signed-off-by: Tad <tad@spotco.us>
2022-03-31 20:27:25 -04:00
fi;
done;
Fixes Signed-off-by: Tad <tad@spotco.us>
2022-04-01 07:35:28 -04:00
echo "auto-var-init: Finished!";
Enable Clang's -ftrivial-auto-var-init=zero on supported kernels Signed-off-by: Tad <tad@spotco.us>
2022-03-31 20:27:25 -04:00
cd "$DOS_BUILD_BASE";
}
export -f enableAutoVarInit;
Update supported kernels to latest wireless regulations database Applies for ~43 kernel trees Source: wireless-regdb-2022.04.08 Signed-off-by: Tad <tad@spotco.us>
2022-04-19 11:25:19 -04:00
updateRegDb() {
Robustness improvements Signed-off-by: Tad <tad@spotco.us>
2023-03-08 00:22:01 -05:00
cd "$DOS_BUILD_BASE/$1";
Update supported kernels to latest wireless regulations database Applies for ~43 kernel trees Source: wireless-regdb-2022.04.08 Signed-off-by: Tad <tad@spotco.us>
2022-04-19 11:25:19 -04:00
#Latest database cannot be used due to differing flags, only update supported kernels
Update CVE patchers TODO: maybe split CVE-2022-23960/4.9 to get back? Signed-off-by: Tad <tad@spotco.us>
2022-04-19 12:26:51 -04:00
#md5sum Build/*/kernel/*/*/net/wireless/genregdb.awk | sort
Update supported kernels to latest wireless regulations database Applies for ~43 kernel trees Source: wireless-regdb-2022.04.08 Signed-off-by: Tad <tad@spotco.us>
2022-04-19 11:25:19 -04:00
if echo "d9ef5910b573c634fa7845bb6511ba89 net/wireless/genregdb.awk" | md5sum --check --quiet &>/dev/null; then
Disable regdb updates Last update broke wireless for Australian users Let's use what is included instead Signed-off-by: Tad <tad@spotco.us>
2023-10-13 02:24:25 -04:00
#cp "$DOS_PATCHES_COMMON/wireless-regdb/db.txt" "net/wireless/db.txt";
#echo "regdb: updated for $1";
echo "regdb: skipping regdb update for $1";
Update supported kernels to latest wireless regulations database Applies for ~43 kernel trees Source: wireless-regdb-2022.04.08 Signed-off-by: Tad <tad@spotco.us>
2022-04-19 11:25:19 -04:00
fi;
cd "$DOS_BUILD_BASE";
}
export -f updateRegDb;
Remove silly carrier restrictions Signed-off-by: Tad <tad@spotco.us>
2023-02-03 22:05:01 -05:00
fixupCarrierConfigs() {
cd "$DOS_BUILD_BASE";
local pathsToFixup="packages/apps/CarrierConfig/assets/*.xml device/*/*/overlay/packages/apps/CarrierConfig/res/xml/vendor.xml device/*/*/overlay/CarrierConfigResCommon/res/xml/vendor.xml device/*/*/rro_overlays/CarrierConfigOverlay/res/xml/vendor.xml";
#Things we don't want
#Reference (BSD-3-Clause): https://github.com/GrapheneOS/carriersettings-extractor/blob/13/carriersettings_extractor.py
Many tweaks - 19.1/20.0: Enable low ram for <6GB devices - 20.0: support RROs with exec spawning patch from GrapheneOS - allow work profiles when low ram is enabled - churn - cherrypicks Signed-off-by: Tad <tad@spotco.us>
2023-07-13 11:24:46 -04:00
local ccLines="allow_adding_apns_bool|apn_expand_bool|hide_ims_apn_bool|hide_preset_apn_details_bool|hide_enable_2g_bool|gps.lpp_profile|gps.persist_lpp_mode_bool";
Remove silly carrier restrictions Signed-off-by: Tad <tad@spotco.us>
2023-02-03 22:05:01 -05:00
sed -i -E "/($ccLines)/d" $pathsToFixup;
local ccArrays="read_only_apn_fields_string_array|read_only_apn_types_string_array";
sed -i -E "/("$ccArrays").*num=\"0\"/d" $pathsToFixup; #ugly hack because next line is very greedy
perl -0777 -pe 's,(<string-array.*?>.*?</string-array>),$1 =~ /'$ccArrays'/?"":$1,gse' -i $pathsToFixup; #Credit: https://unix.stackexchange.com/a/72160
sed -i "/^ $/d" $pathsToFixup;
sed -i "/^ $/d" $pathsToFixup;
#sed -i '/^[[:space:]]*$/d' *.xml;
cd "$DOS_BUILD_BASE";
}
export -f fixupCarrierConfigs;
Fix and enable exec_spawning feature This is the missing puzzle piece :) Signed-off-by: Tad <tad@spotco.us>
2022-03-28 21:58:05 -04:00
disableEnforceRRO() {
Robustness improvements Signed-off-by: Tad <tad@spotco.us>
2023-03-08 00:22:01 -05:00
cd "$DOS_BUILD_BASE/$1";
Fix and enable exec_spawning feature This is the missing puzzle piece :) Signed-off-by: Tad <tad@spotco.us>
2022-03-28 21:58:05 -04:00
awk -i inplace '!/PRODUCT_ENFORCE_RRO_TARGETS .= framework-res/' *.mk &>/dev/null || true;
awk -i inplace '!/PRODUCT_ENFORCE_RRO_TARGETS .= \*/' *.mk &>/dev/null || true;
sed -i '/PRODUCT_ENFORCE_RRO_TARGETS .= \\/,+1 d' *.mk &>/dev/null || true;
Fixes Signed-off-by: Tad <tad@spotco.us>
2022-04-01 07:35:28 -04:00
echo "Disabled enforced RRO for $1";
Fix and enable exec_spawning feature This is the missing puzzle piece :) Signed-off-by: Tad <tad@spotco.us>
2022-03-28 21:58:05 -04:00
cd "$DOS_BUILD_BASE";
}
export -f disableEnforceRRO;
Small changes - Disable generation of unused OTA to reduce compile time - 17.1+: Disable APEX, breaks signing, and is also useless since no Play Store. - 18.1: Fixup signing
2021-03-29 17:09:12 -04:00
disableAPEX() {
Robustness improvements Signed-off-by: Tad <tad@spotco.us>
2023-03-08 00:22:01 -05:00
cd "$DOS_BUILD_BASE/$1";
Many fixes to get bluejay booting & working proper - Enable APEX for Pixel 6/7, necessary for camera and pKVM - Also drop hack removing pKVM for Pixel 6/7 - patch from GrapheneOS - Extend hmalloc workaround to /apex - Deblobber: - actually handle wildcard f/w/b overlays - move some stuff around - remove some more Pixel blobs - flag and disable removal of camera extensions, being able to use the second camera is nice - Adjust what hardenDefconfig disables, caused boot issues minimal impact as most of these are already default-disabled can be narrowed down in future - Disable some of the bionic hardening patches, causing more boot issues annoying to lose, but having a phone that boots is more important - Add LTE only mode to 17.1, 18.1, 19.1, and 20.0, credit GrapheneOS - Remove Pixel 2 ramdisk compression reverts, fixed upstream And yes, I know I should've split up this commit... Signed-off-by: Tad <tad@spotco.us>
2022-12-23 22:00:31 -05:00
if [[ "$1" != *"device/google/gs101"* ]] && [[ "$1" != *"device/google/gs201"* ]] && [[ "$1" != *"device/google/oriole"* ]] && [[ "$1" != *"device/google/raven"* ]] && [[ "$1" != *"device/google/raviole"* ]] && [[ "$1" != *"device/google/bluejay"* ]] && [[ "$1" != *"device/google/panther"* ]] && [[ "$1" != *"device/google/cheetah"* ]] && [[ "$1" != *"device/google/pantah"* ]]; then
awk -i inplace '!/DEXPREOPT_GENERATE_APEX_IMAGE/' *.mk &>/dev/null || true;
awk -i inplace '!/updatable_apex.mk/' *.mk &>/dev/null || true;
echo "Disabled APEX for $1";
else
echo "Skipped disabling APEX for $1";
fi;
Small changes - Disable generation of unused OTA to reduce compile time - 17.1+: Disable APEX, breaks signing, and is also useless since no Play Store. - 18.1: Fixup signing
2021-03-29 17:09:12 -04:00
cd "$DOS_BUILD_BASE";
}
export -f disableAPEX;
Fixup OpenEUICC inclusion Signed-off-by: Tad <tad@spotco.us>
2023-08-21 17:56:38 -04:00
includeOE() {
cd "$DOS_BUILD_BASE/$1";
Fixups - Revert Freetype branch switching for 15.1+, broken - Don't include OpenEUICC on Pixel 2 and 3 series, they won't work - Churn Signed-off-by: Tad <tad@spotco.us>
2023-08-24 01:17:08 -04:00
#Skip: Pixel 2 series (only supports Google Fi), Pixel 3/a series (broken on 20.0)
if [[ "$1" != *"device/google/bonito"* ]] && [[ "$1" != *"device/google/crosshatch"* ]] && [[ "$1" != *"device/google/wahoo"* ]]; then
if [ -f device.mk ]; then
if grep -sq "euicc.xml" device.mk; then
echo -e "\nPRODUCT_PACKAGES += OpenEUICC" >> device.mk;
echo "Enabled OpenEUICC inclusion for $1";
fi;
Fixup OpenEUICC inclusion Signed-off-by: Tad <tad@spotco.us>
2023-08-21 17:56:38 -04:00
fi;
Fixups - Revert Freetype branch switching for 15.1+, broken - Don't include OpenEUICC on Pixel 2 and 3 series, they won't work - Churn Signed-off-by: Tad <tad@spotco.us>
2023-08-24 01:17:08 -04:00
if [ -f device-lineage.mk ]; then
if grep -sq "euicc.xml" device-lineage.mk; then
echo -e "\nPRODUCT_PACKAGES += OpenEUICC" >> device-lineage.mk;
echo "Enabled OpenEUICC inclusion for $1";
fi;
Fixup OpenEUICC inclusion Signed-off-by: Tad <tad@spotco.us>
2023-08-21 17:56:38 -04:00
fi;
fi;
cd "$DOS_BUILD_BASE";
}
export -f includeOE;
Dramatically deduplicate scripts
2018-04-04 07:52:11 -04:00
enableStrongEncryption() {
Robustness improvements Signed-off-by: Tad <tad@spotco.us>
2023-03-08 00:22:01 -05:00
cd "$DOS_BUILD_BASE/$1";
Dramatically deduplicate scripts
2018-04-04 07:52:11 -04:00
if [ -f BoardConfig.mk ]; then
Revert "Strong AES patch changes" This reverts commit 60b85e10fed14c14fe3939cfc0dc42fe45dc2a6d.
2018-04-28 15:35:53 -04:00
echo "TARGET_WANTS_STRONG_ENCRYPTION := true" >> BoardConfig.mk;
echo "Enabled AES-256 encryption for $1";
Dramatically deduplicate scripts
2018-04-04 07:52:11 -04:00
fi;
Overhaul variable names
2018-06-29 00:55:21 -04:00
cd "$DOS_BUILD_BASE";
Dramatically deduplicate scripts
2018-04-04 07:52:11 -04:00
}
export -f enableStrongEncryption;
Improvements and fixes - 18.1: disable m8, thermanager is not yet ready - 17.1: drop cheeseburger/dumpling, it is absolutely broken - deblobber: remove euicc + others - deblobber: hack to remove vintf fragments
2021-04-04 17:06:47 -04:00
addAdbKey() {
if [ -f ~/.android/adbkey.pub ]; then
cp ~/.android/adbkey.pub "$DOS_BUILD_BASE/vendor/divested/";
echo "PRODUCT_ADB_KEYS := vendor/divested/adbkey.pub" >> "$DOS_BUILD_BASE/vendor/divested/divestos.mk";
fi;
}
export -f addAdbKey;
Replace DNS patches with a function + some misc fixes
2018-06-24 01:27:33 -04:00
changeDefaultDNS() {
Scripts: localize variables in functions
2019-09-17 00:55:50 -04:00
local dnsPrimary="";
local dnsPrimaryV6="";
local dnsSecondary="";
local dnsSecondaryV6="";
Small tweaks
2020-12-12 09:50:27 -05:00
if [ ! -z "$DOS_DEFAULT_DNS_PRESET" ]; then
Minor tweaks - Cherry pick PPP/CVE-2020-8597 patches - Add some more DNS providers - Switch default DNS to Cloudflare's new malware blocking provider - GCC 10 build fix - Update CVE patchers (select)
2020-04-05 14:05:17 -04:00
if [[ "$DOS_DEFAULT_DNS_PRESET" == "AdGuard" ]]; then #https://adguard.com/en/adguard-dns/overview.html
Extend changeDefaultDNS to additional files Signed-off-by: Tad <tad@spotco.us>
2021-10-22 00:55:50 -04:00
dnsHex="0xb0678282L";
Minor tweaks - Cherry pick PPP/CVE-2020-8597 patches - Add some more DNS providers - Switch default DNS to Cloudflare's new malware blocking provider - GCC 10 build fix - Update CVE patchers (select)
2020-04-05 14:05:17 -04:00
dnsPrimary="176.103.130.130";
dnsPrimaryV6="2a00:5a60::ad1:0ff";
dnsSecondary="176.103.130.131";
dnsSecondaryV6="2a00:5a60::ad2:0ff";
elif [[ "$DOS_DEFAULT_DNS_PRESET" == "AdGuard-NOBL" ]]; then #https://adguard.com/en/adguard-dns/overview.html
Extend changeDefaultDNS to additional files Signed-off-by: Tad <tad@spotco.us>
2021-10-22 00:55:50 -04:00
dnsHex="0xb0678288L";
Minor tweaks - Cherry pick PPP/CVE-2020-8597 patches - Add some more DNS providers - Switch default DNS to Cloudflare's new malware blocking provider - GCC 10 build fix - Update CVE patchers (select)
2020-04-05 14:05:17 -04:00
dnsPrimary="176.103.130.136";
dnsPrimaryV6="2a00:5a60::01:ff";
dnsSecondary="176.103.130.137";
dnsSecondaryV6="2a00:5a60::02:ff";
elif [[ "$DOS_DEFAULT_DNS_PRESET" == "CensurfriDNS" ]]; then #https://uncensoreddns.org
Extend changeDefaultDNS to additional files Signed-off-by: Tad <tad@spotco.us>
2021-10-22 00:55:50 -04:00
dnsHex="0x5bef6464L";
Many changes - Add more DNS resolver choices - Change default DNS resolver back to OpenNIC - More cleanup - 15.1: Update some CVE patchers
2019-02-09 18:44:45 -05:00
dnsPrimary="91.239.100.100";
dnsPrimaryV6="2001:67c:28a4::";
dnsSecondary="89.233.43.71";
dnsSecondaryV6="2a01:3a0:53:53::";
elif [[ "$DOS_DEFAULT_DNS_PRESET" == "Cloudflare" ]]; then #https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/privacy-policy
Extend changeDefaultDNS to additional files Signed-off-by: Tad <tad@spotco.us>
2021-10-22 00:55:50 -04:00
dnsHex="0x01000001L";
Replace DNS patches with a function + some misc fixes
2018-06-24 01:27:33 -04:00
dnsPrimary="1.0.0.1";
dnsPrimaryV6="2606:4700:4700::1001";
dnsSecondary="1.1.1.1";
dnsSecondaryV6="2606:4700:4700::1111";
Minor tweaks - Cherry pick PPP/CVE-2020-8597 patches - Add some more DNS providers - Switch default DNS to Cloudflare's new malware blocking provider - GCC 10 build fix - Update CVE patchers (select)
2020-04-05 14:05:17 -04:00
elif [[ "$DOS_DEFAULT_DNS_PRESET" == "Cloudflare-BL" ]]; then #https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/privacy-policy
Extend changeDefaultDNS to additional files Signed-off-by: Tad <tad@spotco.us>
2021-10-22 00:55:50 -04:00
dnsHex="0x01000002L";
Minor tweaks - Cherry pick PPP/CVE-2020-8597 patches - Add some more DNS providers - Switch default DNS to Cloudflare's new malware blocking provider - GCC 10 build fix - Update CVE patchers (select)
2020-04-05 14:05:17 -04:00
dnsPrimary="1.0.0.2";
dnsPrimaryV6="2606:4700:4700::1002";
dnsSecondary="1.1.1.2";
dnsSecondaryV6="2606:4700:4700::1112";
Overhaul variable names
2018-06-29 00:55:21 -04:00
elif [[ "$DOS_DEFAULT_DNS_PRESET" == "DNSWATCH" ]]; then #https://dns.watch
Extend changeDefaultDNS to additional files Signed-off-by: Tad <tad@spotco.us>
2021-10-22 00:55:50 -04:00
dnsHex="0x54c84550L";
Replace DNS patches with a function + some misc fixes
2018-06-24 01:27:33 -04:00
dnsPrimary="84.200.69.80";
dnsPrimaryV6="2001:1608:10:25::1c04:b12f";
dnsSecondary="84.200.70.40";
dnsSecondaryV6="2001:1608:10:25::9249:d69b";
Overhaul variable names
2018-06-29 00:55:21 -04:00
elif [[ "$DOS_DEFAULT_DNS_PRESET" == "Google" ]]; then #https://developers.google.com/speed/public-dns/privacy
Extend changeDefaultDNS to additional files Signed-off-by: Tad <tad@spotco.us>
2021-10-22 00:55:50 -04:00
dnsHex="0x08080808L";
Replace DNS patches with a function + some misc fixes
2018-06-24 01:27:33 -04:00
dnsPrimary="8.8.8.8";
dnsPrimaryV6="2001:4860:4860::8888";
dnsSecondary="8.8.4.4";
dnsSecondaryV6="2001:4860:4860::8844";
Many changes - Add more DNS resolver choices - Change default DNS resolver back to OpenNIC - More cleanup - 15.1: Update some CVE patchers
2019-02-09 18:44:45 -05:00
elif [[ "$DOS_DEFAULT_DNS_PRESET" == "Neustar" ]]; then #https://www.security.neustar/digital-performance/dns-services/recursive-dns
Extend changeDefaultDNS to additional files Signed-off-by: Tad <tad@spotco.us>
2021-10-22 00:55:50 -04:00
dnsHex="0x9c9a4602L";
Many changes - Add more DNS resolver choices - Change default DNS resolver back to OpenNIC - More cleanup - 15.1: Update some CVE patchers
2019-02-09 18:44:45 -05:00
dnsPrimary="156.154.70.2";
dnsPrimaryV6="2610:a1:1018::2";
dnsSecondary="156.154.71.2";
dnsSecondaryV6="2610:a1:1019::2";
elif [[ "$DOS_DEFAULT_DNS_PRESET" == "Neustar-NOBL" ]]; then #https://www.security.neustar/digital-performance/dns-services/recursive-dns
Extend changeDefaultDNS to additional files Signed-off-by: Tad <tad@spotco.us>
2021-10-22 00:55:50 -04:00
dnsHex="0x9c9a4605L";
Many changes - Add more DNS resolver choices - Change default DNS resolver back to OpenNIC - More cleanup - 15.1: Update some CVE patchers
2019-02-09 18:44:45 -05:00
dnsPrimary="156.154.70.5";
dnsPrimaryV6="2610:a1:1018::5";
dnsSecondary="156.154.71.5";
dnsSecondaryV6="2610:a1:1019::5";
Overhaul variable names
2018-06-29 00:55:21 -04:00
elif [[ "$DOS_DEFAULT_DNS_PRESET" == "OpenDNS" ]]; then #https://www.cisco.com/c/en/us/about/legal/privacy-full.html
Extend changeDefaultDNS to additional files Signed-off-by: Tad <tad@spotco.us>
2021-10-22 00:55:50 -04:00
dnsHex="0xd043dedeL";
Replace DNS patches with a function + some misc fixes
2018-06-24 01:27:33 -04:00
dnsPrimary="208.67.222.222";
dnsPrimaryV6="2620:0:ccc::2";
dnsSecondary="208.67.220.220";
dnsSecondaryV6="2620:0:ccd::2";
Many changes - Add more DNS resolver choices - Change default DNS resolver back to OpenNIC - More cleanup - 15.1: Update some CVE patchers
2019-02-09 18:44:45 -05:00
elif [[ "$DOS_DEFAULT_DNS_PRESET" == "Quad9" ]]; then #https://www.quad9.net/privacy
Extend changeDefaultDNS to additional files Signed-off-by: Tad <tad@spotco.us>
2021-10-22 00:55:50 -04:00
dnsHex="0x09090909L";
Replace DNS patches with a function + some misc fixes
2018-06-24 01:27:33 -04:00
dnsPrimary="9.9.9.9";
dnsPrimaryV6="2620:fe::fe";
dnsSecondary="149.112.112.112";
Many changes - Update CVE patchers - Update submodules - Update defconfig enablers - Update DNS IP addresses - + Misc changes
2018-12-24 23:29:56 -05:00
dnsSecondaryV6="2620:fe::9";
Update CVE patchers
2020-11-12 22:49:23 -05:00
elif [[ "$DOS_DEFAULT_DNS_PRESET" == "Quad9-EDNS" ]]; then #https://www.quad9.net/privacy
Extend changeDefaultDNS to additional files Signed-off-by: Tad <tad@spotco.us>
2021-10-22 00:55:50 -04:00
dnsHex="0x0909090bL";
Update CVE patchers
2020-11-12 22:49:23 -05:00
dnsPrimary="9.9.9.11";
dnsPrimaryV6="2620:fe::11";
dnsSecondary="149.112.112.11";
dnsSecondaryV6="2620:fe::fe:11";
Many changes - Add more DNS resolver choices - Change default DNS resolver back to OpenNIC - More cleanup - 15.1: Update some CVE patchers
2019-02-09 18:44:45 -05:00
elif [[ "$DOS_DEFAULT_DNS_PRESET" == "Quad9-NOBL" ]]; then #https://www.quad9.net/privacy
Extend changeDefaultDNS to additional files Signed-off-by: Tad <tad@spotco.us>
2021-10-22 00:55:50 -04:00
dnsHex="0x0909090aL";
Few changes - Fix F-Droid building - Update F-Droid preferences - Add privacy policy links for DNS presets
2018-06-25 19:15:22 -04:00
dnsPrimary="9.9.9.10";
dnsPrimaryV6="2620:fe::10";
dnsSecondary="149.112.112.10";
Many changes - Update CVE patchers - Update submodules - Update defconfig enablers - Update DNS IP addresses - + Misc changes
2018-12-24 23:29:56 -05:00
dnsSecondaryV6="2620:fe::fe:10";
Overhaul variable names
2018-06-29 00:55:21 -04:00
elif [[ "$DOS_DEFAULT_DNS_PRESET" == "Verisign" ]]; then #https://www.verisign.com/en_US/security-services/public-dns/terms-of-service/index.xhtml
Extend changeDefaultDNS to additional files Signed-off-by: Tad <tad@spotco.us>
2021-10-22 00:55:50 -04:00
dnsHex="0x40064006L";
Boot animation customization!
2018-06-24 04:26:59 -04:00
dnsPrimary="64.6.64.6";
dnsPrimaryV6="2620:74:1b::1:1";
dnsSecondary="64.6.65.6";
dnsSecondaryV6="2620:74:1c::2:2";
Many changes - Add more DNS resolver choices - Change default DNS resolver back to OpenNIC - More cleanup - 15.1: Update some CVE patchers
2019-02-09 18:44:45 -05:00
elif [[ "$DOS_DEFAULT_DNS_PRESET" == "Yandex" ]]; then #https://dns.yandex.com/advanced
Extend changeDefaultDNS to additional files Signed-off-by: Tad <tad@spotco.us>
2021-10-22 00:55:50 -04:00
dnsHex="0x4d580858L";
Many changes - Add more DNS resolver choices - Change default DNS resolver back to OpenNIC - More cleanup - 15.1: Update some CVE patchers
2019-02-09 18:44:45 -05:00
dnsPrimary="77.88.8.88";
dnsPrimaryV6="2a02:6b8::feed:bad";
dnsSecondary="77.88.8.2";
dnsSecondaryV6="2a02:6b8:0:1::feed:bad";
elif [[ "$DOS_DEFAULT_DNS_PRESET" == "Yandex-NOBL" ]]; then #https://dns.yandex.com/advanced
Extend changeDefaultDNS to additional files Signed-off-by: Tad <tad@spotco.us>
2021-10-22 00:55:50 -04:00
dnsHex="0x4d580808L";
Many changes - Add more DNS resolver choices - Change default DNS resolver back to OpenNIC - More cleanup - 15.1: Update some CVE patchers
2019-02-09 18:44:45 -05:00
dnsPrimary="77.88.8.8";
dnsPrimaryV6="2a02:6b8::feed:0ff";
dnsSecondary="77.88.8.1";
dnsSecondaryV6="2a02:6b8:0:1::feed:0ff";
Replace DNS patches with a function + some misc fixes
2018-06-24 01:27:33 -04:00
fi;
else
Small tweaks
2020-12-12 09:50:27 -05:00
echo "You must first set a preset via the DOS_DEFAULT_DNS_PRESET variable in init.sh!";
Replace DNS patches with a function + some misc fixes
2018-06-24 01:27:33 -04:00
fi;
19.1+: Add the SUPL toggle setting from GrapheneOS Will need some work to apply on 17.1/18.1 Signed-off-by: Tad <tad@spotco.us>
2023-02-10 17:17:22 -05:00
local files="bionic/libc/dns/net/getaddrinfo.c frameworks/base/core/java/android/net/util/DnsUtils.java frameworks/base/core/java/com/android/internal/net/VpnProfile.java frameworks/base/core/res/res/values/config.xml frameworks/base/packages/SettingsLib/res/values/strings.xml frameworks/base/packages/Tethering/src/com/android/networkstack/tethering/TetheringConfiguration.java frameworks/base/services/core/java/com/android/server/connectivity/NetworkDiagnostics.java frameworks/base/services/core/java/com/android/server/connectivity/Tethering.java frameworks/base/services/core/java/com/android/server/connectivity/tethering/TetheringConfiguration.java frameworks/base/services/java/com/android/server/connectivity/Tethering.java packages/apps/Dialer/java/com/android/voicemail/impl/sync/VvmNetworkRequestCallback.java packages/modules/Connectivity/framework/src/android/net/util/DnsUtils.java packages/modules/Connectivity/service/native/libs/libclat/clatutils_test.cpp packages/modules/Connectivity/service/ServiceConnectivityResources/res/values/config.xml packages/modules/Connectivity/service/src/com/android/server/connectivity/ClatCoordinator.java packages/modules/Connectivity/service/src/com/android/server/connectivity/NetworkDiagnostics.java packages/modules/Connectivity/Tethering/src/com/android/networkstack/tethering/TetheringConfiguration.java packages/modules/DnsResolver/DnsResolver/doh.rs packages/modules/DnsResolver/DnsResolver/getaddrinfo.cpp packages/modules/DnsResolver/getaddrinfo.cpp";
#TODO: handle packages/modules/DnsResolver/PrivateDnsConfiguration.h maybe? or just leave as is
Fixes Signed-off-by: Tad <tad@spotco.us>
2023-02-01 18:06:59 -05:00
sed -i "s/8\.8\.8\.8/$dnsPrimary/g" $files &>/dev/null || true;
sed -i "s/2001:4860:4860::8888/$dnsPrimaryV6/g" $files &>/dev/null || true;
sed -i "s/8\.8\.4\.4/$dnsSecondary/g" $files &>/dev/null || true;
sed -i "s/4\.4\.4\.4/$dnsSecondary/g" $files &>/dev/null || true;
sed -i "s/2001:4860:4860::8844/$dnsSecondaryV6/g" $files &>/dev/null || true;
sed -i "s/0x08080808L/$dnsHex/g" $files &>/dev/null || true;
Replace DNS patches with a function + some misc fixes
2018-06-24 01:27:33 -04:00
}
export -f changeDefaultDNS;
Dramatically deduplicate scripts
2018-04-04 07:52:11 -04:00
editKernelLocalversion() {
Scripts: localize variables in functions
2019-09-17 00:55:50 -04:00
local defconfigPath=$(getDefconfig)
you want it, you got it! now compile it yourself. Signed-off-by: Tavi <tavi@divested.dev>
2024-04-09 13:41:25 -04:00
local replacement=$1;
if [ "$DOS_SNET" = true ]; then local replacement="-oink"; fi;
sed -i 's/CONFIG_LOCALVERSION=".*"/CONFIG_LOCALVERSION="'"$replacement"'"/' $defconfigPath &>/dev/null || true;
sed -zi '/CONFIG_LOCALVERSION="'"$replacement"'"/!s/$/\nCONFIG_LOCALVERSION="'"$replacement"'"/' $defconfigPath &>/dev/null;
Dramatically deduplicate scripts
2018-04-04 07:52:11 -04:00
}
export -f editKernelLocalversion;
Small changes
2020-07-25 09:51:25 -04:00
getDefconfig() {
More Pixel 6/7 work compiles, but fails to generate release due to pvmfw failure Signed-off-by: Tad <tad@spotco.us>
2022-12-15 18:00:23 -05:00
if ls private/gs-google/arch/arm64/configs/*_gki_defconfig 1> /dev/null 2>&1; then
local defconfigPath="private/gs-google/arch/arm64/configs/cloudripper_gki_defconfig private/gs-google/arch/arm64/configs/slider_gki_defconfig";
Small changes
2020-07-25 09:51:25 -04:00
elif ls arch/arm64/configs/lineage*defconfig 1> /dev/null 2>&1; then
local defconfigPath="arch/arm64/configs/lineage*defconfig";
More Pixel 6/7 work compiles, but fails to generate release due to pvmfw failure Signed-off-by: Tad <tad@spotco.us>
2022-12-15 18:00:23 -05:00
elif ls arch/arm/configs/lineage*defconfig 1> /dev/null 2>&1; then
local defconfigPath="arch/arm/configs/lineage*defconfig";
Small changes
2020-07-25 09:51:25 -04:00
else
Tweaks - Disable slub_debug=P for devices with INIT_ON_ALLOC/FREE_DEFAULT_ON - Disable slub_debug=Z due to known breakage - Disable many debug options on Linux 4.x and up - 19.1: fixup missing manifests for vayu :\ Signed-off-by: Tad <tad@spotco.us>
2022-06-02 15:18:47 -04:00
#grep TARGET_KERNEL_CONFIG Build/*/device/ -Rih | sed 's|TARGET_KERNEL_CONFIG .= |arch/arm\*/configs/|' | grep -v lineage | sort -u
#grep TARGET_KERNEL_VARIANT_CONFIG Build/*/device/ -Rih | sed 's|TARGET_KERNEL_VARIANT_CONFIG .= |arch/arm\*/configs/|' | grep -v lineage | sort -u
Refresh defconfig paths Signed-off-by: Tavi <tavi@divested.dev>
2024-04-09 13:31:32 -04:00
local defconfigPath="arch/arm*/configs/lineage*defconfig arch/arm*/configs/vendor/lineage*defconfig arch/arm*/configs/apollo_defconfig arch/arm*/configs/apq8084_sec_defconfig arch/arm*/configs/apq8084_sec_kccat6_eur_defconfig arch/arm*/configs/apq8084_sec_lentislte_skt_defconfig arch/arm*/configs/athene_defconfig arch/arm*/configs/aura_defconfig arch/arm*/configs/b1c1_defconfig arch/arm*/configs/beryllium_defconfig arch/arm*/configs/bonito_defconfig arch/arm*/configs/clark_defconfig arch/arm*/configs/cloudripper_gki_defconfig arch/arm*/configs/discovery_defconfig arch/arm*/configs/enchilada_defconfig arch/arm*/configs/exynos8890-hero2lte_defconfig arch/arm*/configs/exynos8890-herolte_defconfig arch/arm*/configs/exynos9810-crownlte_defconfig arch/arm*/configs/exynos9810-star2lte_defconfig arch/arm*/configs/exynos9810-starlte_defconfig arch/arm*/configs/floral_defconfig arch/arm*/configs/FP4_defconfig arch/arm*/configs/griffin_defconfig arch/arm*/configs/grouper_defconfig arch/arm*/configs/harpia_defconfig arch/arm*/configs/jactive_eur_defconfig arch/arm*/configs/jf_att_defconfig arch/arm*/configs/jf_eur_defconfig arch/arm*/configs/jf_spr_defconfig arch/arm*/configs/jfve_eur_defconfig arch/arm*/configs/jf_vzw_defconfig arch/arm*/configs/kirin_defconfig arch/arm*/configs/lavender_defconfig arch/arm*/configs/m1s1_defconfig arch/arm*/configs/m7_defconfig arch/arm*/configs/m8_defconfig arch/arm*/configs/m8dug_defconfig arch/arm*/configs/merlin_defconfig arch/arm*/configs/mermaid_defconfig arch/arm*/configs/msm8930_serrano_eur_3g_defconfig arch/arm*/configs/msm8930_serrano_eur_lte_defconfig arch/arm*/configs/msm8974-hdx_defconfig arch/arm*/configs/msm8974-hdx-perf_defconfig arch/arm*/configs/oneplus2_defconfig arch/arm*/configs/osprey_defconfig arch/arm*/configs/pioneer_defconfig arch/arm*/configs/platina_defconfig arch/arm*/configs/redbull_defconfig arch/arm*/configs/samsung_serrano_defconfig arch/arm*/configs/samsung_serrano_usa_defconfig arch/arm*/configs/shamu_defconfig arch/arm*/configs/slider_gki_defconfig arch/arm*/configs/sunfish_defconfig arch/arm*/configs/surnia_defconfig arch/arm*/configs/tama_akari_defconfig arch/arm*/configs/tama_akatsuki_defconfig arch/arm*/configs/tama_apollo_defconfig arch/arm*/configs/tama_aurora_defconfig arch/arm*/configs/thor_defconfig arch/arm*/configs/tulip_defconfig arch/arm*/configs/tuna_defconfig arch/arm*/configs/twrp_defconfig arch/arm*/configs/vendor/alioth_defconfig arch/arm*/configs/vendor/apollo_defconfig arch/arm*/configs/vendor/davinci.config arch/arm*/configs/vendor/fairphone/FP4.config arch/arm*/configs/vendor/kona-perf_defconfig arch/arm*/configs/vendor/lahaina-qgki_defconfig arch/arm*/configs/vendor/lito-perf_defconfig arch/arm*/configs/vendor/lmi_defconfig arch/arm*/configs/vendor/msm8937-perf_defconfig arch/arm*/configs/vendor/raphael_defconfig arch/arm*/configs/vendor/sdmsteppe-perf_defconfig arch/arm*/configs/vendor/sm8150-perf_defconfig arch/arm*/configs/vendor/vayu_defconfig arch/arm*/configs/vendor/vendor/fairphone/FP4.config arch/arm*/configs/vendor/vendor/xiaomi/sm8150-common.config arch/arm*/configs/vendor/vendor/xiaomi/sm8250-common.config arch/arm*/configs/vendor/xiaomi/alioth.config arch/arm*/configs/vendor/xiaomi/apollo.config arch/arm*/configs/vendor/xiaomi/beryllium.config arch/arm*/configs/vendor/xiaomi/dipper.config arch/arm*/configs/vendor/xiaomi/equuleus.config arch/arm*/configs/vendor/xiaomi/lmi.config arch/arm*/configs/vendor/xiaomi/mi845_defconfig arch/arm*/configs/vendor/xiaomi/polaris.config arch/arm*/configs/vendor/xiaomi/sm8150-common.config arch/arm*/configs/vendor/xiaomi/sm8250-common.config arch/arm*/configs/vendor/xiaomi/ursa.config arch/arm*/configs/vendor/xiaomi/vayu.config arch/arm*/configs/voyager_defconfig arch/arm*/configs/wayne_defconfig arch/arm*/configs/whyred_defconfig arch/arm*/configs/yellowstone_defconfig arch/arm*/configs/Z00T_defconfig arch/arm*/configs/z2_plus_defconfig arch/arm*/configs/zenfone3-perf_defconfig";
Small changes
2020-07-25 09:51:25 -04:00
fi;
echo $defconfigPath;
}
export -f getDefconfig;
Dramatically deduplicate scripts
2018-04-04 07:52:11 -04:00
hardenDefconfig() {
Robustness improvements Signed-off-by: Tad <tad@spotco.us>
2023-03-08 00:22:01 -05:00
cd "$DOS_BUILD_BASE/$1";
Dramatically deduplicate scripts
2018-04-04 07:52:11 -04:00
#Attempts to enable/disable supported options to increase security
#See https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings
Small update Signed-off-by: Tad <tad@spotco.us>
2021-09-20 12:12:58 -04:00
#and (GPL-3.0) https://github.com/a13xp0p0v/kconfig-hardened-check/blob/master/kconfig_hardened_check/__init__.py
Dramatically deduplicate scripts
2018-04-04 07:52:11 -04:00
Tweaks - Disable slub_debug=P for devices with INIT_ON_ALLOC/FREE_DEFAULT_ON - Disable slub_debug=Z due to known breakage - Disable many debug options on Linux 4.x and up - 19.1: fixup missing manifests for vayu :\ Signed-off-by: Tad <tad@spotco.us>
2022-06-02 15:18:47 -04:00
local defconfigPath=$(getDefconfig);
local kernelVersion="0.0.0";
if [ -f "Makefile" ]; then
local kernelVersion=$(head -n5 "Makefile" | sed '/# SPDX-License-Identifier: GPL-2.0/d;/EXTRAVERSION/d;/NAME/d' | sed 's/.*= //;s/\n//' | sed -e :a -e N -e '$!ba' -e 's/\n/ /g' | sed 's/\ /./g');
fi;
Dramatically deduplicate scripts
2018-04-04 07:52:11 -04:00
#Enable supported options
Breakup hardenDefconfig for readbility and debugging purposes Signed-off-by: Tad <tad@spotco.us>
2021-08-13 22:40:12 -04:00
#Linux <3.0
Make hardenDefconfig more manageable No functional changes Signed-off-by: Tad <tad@spotco.us>
2022-10-03 08:24:34 -04:00
declare -a optionsYes=("BUG" "IPV6_PRIVACY" "SECCOMP" "SECURITY" "SECURITY_DMESG_RESTRICT" "STRICT_DEVMEM" "SYN_COOKIES");
optionsYes+=("DEBUG_KERNEL" "DEBUG_CREDENTIALS" "DEBUG_LIST" "DEBUG_VIRTUAL");
optionsYes+=("DEBUG_RODATA" "DEBUG_SET_MODULE_RONX");
defconfig tweaks Signed-off-by: Tad <tad@spotco.us>
2022-04-29 12:14:05 -04:00
#optionsYes+=("DEBUG_SG"); #bootloops - https://patchwork.kernel.org/patch/8989981
KSM tuning - Only enable on Linux 3.0 through 4.9 - Always enable defer option - Only run twice a second, instead of fifty times a second Signed-off-by: Tad <tad@spotco.us>
2023-07-14 17:35:48 -04:00
if [ "$DOS_USE_KSM" = true ] && [ -f "mm/ksm.c" ]; then
if [[ $kernelVersion == "3."* ]] || [[ $kernelVersion == "4.4"* ]] || [[ $kernelVersion == "4.9"* ]]; then
optionsYes+=("KSM");
sed -i 's/unsigned int ksm_run = KSM_RUN_STOP;/unsigned int ksm_run = KSM_RUN_MERGE;/' mm/ksm.c &>/dev/null || true;
sed -i 's/unsigned long ksm_run = KSM_RUN_STOP;/unsigned long ksm_run = KSM_RUN_MERGE;/' mm/ksm.c &>/dev/null || true;
else
local ksmNotNeeded=true;
sed -i 's/unsigned int ksm_run = KSM_RUN_MERGE;/unsigned int ksm_run = KSM_RUN_STOP;/' mm/ksm.c &>/dev/null || true;
sed -i 's/unsigned long ksm_run = KSM_RUN_MERGE;/unsigned long ksm_run = KSM_RUN_STOP;/' mm/ksm.c &>/dev/null || true;
fi;
fi;
Breakup hardenDefconfig for readbility and debugging purposes Signed-off-by: Tad <tad@spotco.us>
2021-08-13 22:40:12 -04:00
Only enable CONFIG_DEBUG_NOTIFIERS on kernels <=4.9 OnePlus 9 failed boot kernel log points to this. GrapheneOS noted this as an inherent issue on the Pixel 4 and 5 too. Signed-off-by: Tad <tad@spotco.us>
2022-08-25 15:03:59 -04:00
if [[ $kernelVersion == "3."* ]] || [[ $kernelVersion == "4.4"* ]] || [[ $kernelVersion == "4.9"* ]]; then
optionsYes+=("DEBUG_NOTIFIERS"); #(https://github.com/GrapheneOS/os-issue-tracker/issues/681)
fi;
Breakup hardenDefconfig for readbility and debugging purposes Signed-off-by: Tad <tad@spotco.us>
2021-08-13 22:40:12 -04:00
#Linux 3.4
optionsYes+=("SECURITY_YAMA");
#Linux 3.5
optionsYes+=("PANIC_ON_OOPS" "SECCOMP_FILTER");
#Linux 3.7
optionsYes+=("ASYMMETRIC_PUBLIC_KEY_SUBTYPE" "SECURITY_YAMA_STACKED" "X509_CERTIFICATE_PARSER");
#Linux 3.13
optionsYes+=("SYSTEM_TRUSTED_KEYRING");
#Linux 3.14
optionsYes+=("CC_STACKPROTECTOR" "CC_STACKPROTECTOR_STRONG");
#Linux 3.17
optionsYes+=("PKCS7_MESSAGE_PARSER");
#Linux 3.18
optionsYes+=("HARDENED_USERCOPY" "SCHED_STACK_END_CHECK");
#Linux 4.3
optionsYes+=("ARM64_PAN" "CPU_SW_DOMAIN_PAN");
#Linux 4.4
optionsYes+=("LEGACY_VSYSCALL_NONE");
#Linux 4.5
optionsYes+=("IO_STRICT_DEVMEM");
#Linux 4.6
Simplify Signed-off-by: Tad <tad@spotco.us>
2022-04-02 15:15:30 -04:00
optionsYes+=("ARM64_UAO" "PAGE_POISONING" "PAGE_POISONING_ZERO" "PAGE_POISONING_NO_SANITY");
Breakup hardenDefconfig for readbility and debugging purposes Signed-off-by: Tad <tad@spotco.us>
2021-08-13 22:40:12 -04:00
#Linux 4.7
optionsYes+=("ASYMMETRIC_KEY_TYPE" "RANDOMIZE_BASE" "SLAB_FREELIST_RANDOM");
#Linux 4.8
optionsYes+=("RANDOMIZE_MEMORY");
#Linux 4.9
optionsYes+=("THREAD_INFO_IN_TASK" "VMAP_STACK");
#Linux 4.10
Small changes Signed-off-by: Tad <tad@spotco.us>
2021-10-14 14:01:10 -04:00
optionsYes+=("ARM64_SW_TTBR0_PAN" "BUG_ON_DATA_CORRUPTION");
Breakup hardenDefconfig for readbility and debugging purposes Signed-off-by: Tad <tad@spotco.us>
2021-08-13 22:40:12 -04:00
#Linux 4.11
optionsYes+=("STRICT_KERNEL_RWX" "STRICT_MODULE_RWX");
#Linux 4.13
optionsYes+=("FORTIFY_SOURCE" "REFCOUNT_FULL");
#Linux 4.14
optionsYes+=("SLAB_FREELIST_HARDENED");
Make ZRAM great again Signed-off-by: Tad <tad@spotco.us>
2022-05-18 19:00:45 -04:00
#optionsYes+=("LTO_CLANG" "CFI_CLANG");
#optionsYes+=("RESET_ATTACK_MITIGATION"); #EFI only
Breakup hardenDefconfig for readbility and debugging purposes Signed-off-by: Tad <tad@spotco.us>
2021-08-13 22:40:12 -04:00
#Linux 4.15
optionsYes+=("PAGE_TABLE_ISOLATION" "RETPOLINE");
#Linux 4.16
optionsYes+=("UNMAP_KERNEL_AT_EL0");
#Linux 4.17
optionsYes+=("HARDEN_EL2_VECTORS");
#Linux 4.18
optionsYes+=("HARDEN_BRANCH_PREDICTOR" "STACKPROTECTOR" "STACKPROTECTOR_STRONG");
#Linux 5.0
Make hardenDefconfig more manageable No functional changes Signed-off-by: Tad <tad@spotco.us>
2022-10-03 08:24:34 -04:00
optionsYes+=("ARM64_PTR_AUTH"); #can stall CPUs on boot if missing support
optionsYes+=("RODATA_FULL_DEFAULT_ENABLED" "STACKPROTECTOR_PER_TASK");
Breakup hardenDefconfig for readbility and debugging purposes Signed-off-by: Tad <tad@spotco.us>
2021-08-13 22:40:12 -04:00
#Linux 5.2
optionsYes+=("INIT_STACK_ALL" "SHUFFLE_PAGE_ALLOCATOR");
#Linux 5.8
optionsYes+=("ARM64_BTI_KERNEL" "DEBUG_WX");
#Linux 5.9
optionsYes+=("INIT_STACK_ALL_ZERO");
hardenDefconfig: pull in some more options Signed-off-by: Tad <tad@spotco.us>
2021-09-19 01:20:41 -04:00
#Linux 5.10
optionsYes+=("ARM64_MTE");
defconfig tweaks Signed-off-by: Tad <tad@spotco.us>
2022-04-29 12:14:05 -04:00
#Linux 5.12
Make ZRAM great again Signed-off-by: Tad <tad@spotco.us>
2022-05-18 19:00:45 -04:00
#optionsYes+=("KFENCE"); #useless?
defconfig tweaks Signed-off-by: Tad <tad@spotco.us>
2022-04-29 12:14:05 -04:00
hardenDefconfig: pull in some more options Signed-off-by: Tad <tad@spotco.us>
2021-09-19 01:20:41 -04:00
#Linux 5.13
optionsYes+=("ARM64_EPAN" "RANDOMIZE_KSTACK_OFFSET_DEFAULT");
defconfig tweaks Signed-off-by: Tad <tad@spotco.us>
2022-04-29 12:14:05 -04:00
#Linux 5.15
optionsYes+=("IOMMU_DEFAULT_DMA_STRICT" "ZERO_CALL_USED_REGS");
#optionsYes+=("WERROR");
#Linux 5.17
optionsYes+=("HARDEN_BRANCH_HISTORY" "MITIGATE_SPECTRE_BRANCH_HISTORY");
#Linux 5.18
2022 Signed-off-by: Tad <tad@spotco.us>
2022-05-01 01:13:46 -04:00
#optionsYes+=("SHADOW_CALL_STACK" "SHADOW_CALL_STACK_VMAP");
defconfig tweaks Signed-off-by: Tad <tad@spotco.us>
2022-04-29 12:14:05 -04:00
Breakup hardenDefconfig for readbility and debugging purposes Signed-off-by: Tad <tad@spotco.us>
2021-08-13 22:40:12 -04:00
#GCC Plugins - 4.19 - 5.2
defconfig tweaks Signed-off-by: Tad <tad@spotco.us>
2022-04-29 12:14:05 -04:00
#optionsYes+=("GCC_PLUGINS" "GCC_PLUGIN_LATENT_ENTROPY" "GCC_PLUGIN_RANDSTRUCT" "GCC_PLUGIN_STACKLEAK" "GCC_PLUGIN_STRUCTLEAK" "GCC_PLUGIN_STRUCTLEAK_BYREF_ALL");
Make ZRAM great again Signed-off-by: Tad <tad@spotco.us>
2022-05-18 19:00:45 -04:00
#AOSP uses Clang, not GCC
Breakup hardenDefconfig for readbility and debugging purposes Signed-off-by: Tad <tad@spotco.us>
2021-08-13 22:40:12 -04:00
#GrapheneOS Patches
Simplify Signed-off-by: Tad <tad@spotco.us>
2022-04-02 15:15:30 -04:00
optionsYes+=("PAGE_SANITIZE" "PAGE_SANITIZE_VERIFY" "SLAB_HARDENED" "SLAB_SANITIZE" "SLAB_SANITIZE_VERIFY");
Only enable CONFIG_DEBUG_NOTIFIERS on kernels <=4.9 OnePlus 9 failed boot kernel log points to this. GrapheneOS noted this as an inherent issue on the Pixel 4 and 5 too. Signed-off-by: Tad <tad@spotco.us>
2022-08-25 15:03:59 -04:00
#Disabled: SLAB_CANARY (https://github.com/GrapheneOS/os-issue-tracker/issues/124)
Breakup hardenDefconfig for readbility and debugging purposes Signed-off-by: Tad <tad@spotco.us>
2021-08-13 22:40:12 -04:00
#out of tree or renamed or removed ?
optionsYes+=("KAISER" "KGSL_PER_PROCESS_PAGE_TABLE" "MMC_SECDISCARD" "SECURITY_PERF_EVENTS_RESTRICT" "SLUB_HARDENED" "STRICT_MEMORY_RWX");
#Hardware enablement #XXX: This needs a better home
optionsYes+=("HID_GENERIC" "HID_STEAM" "HID_SONY" "HID_WIIMOTE" "INPUT_JOYSTICK" "JOYSTICK_XPAD" "USB_USBNET" "USB_NET_CDCETHER");
Pixel 6/7 prep + fixes These still need defconfig and deblobber handling All of these sections were reviewed & sorted Signed-off-by: Tad <tad@spotco.us>
2022-12-14 21:23:13 -05:00
#grep INIT_ON_ALLOC_DEFAULT_ON Build/*/kernel/*/*/security/Kconfig.hardening -l
Fixup 09494a1c compile tested: vayu, pioneer Signed-off-by: Tad <tad@spotco.us>
2023-11-07 18:59:53 -05:00
modernKernels=('fairphone/sm7225' 'fxtec/sm6115' 'google/barbet' 'google/bluejay' 'google/coral' 'google/gs101' 'google/gs201' 'google/msm-4.14' 'google/raviole' 'google/redbull' 'google/sunfish' 'oneplus/sm8150' 'oneplus/sm8250' 'oneplus/sm8350' 'xiaomi/sm8150' 'xiaomi/sm8250' 'xiaomi/vayu');
Page sanitization improvements This ensures init_on_alloc/free is used instead of page poisioning where available. 3.4 through 3.18 have a patch without a toggle for page sanitization. Signed-off-by: Tad <tad@spotco.us>
2022-04-02 02:18:30 -04:00
for kernelModern in "${modernKernels[@]}"; do
if [[ "$1" == *"/$kernelModern"* ]]; then
Simplify Signed-off-by: Tad <tad@spotco.us>
2022-04-02 15:15:30 -04:00
optionsYes+=("INIT_ON_ALLOC_DEFAULT_ON" "INIT_ON_FREE_DEFAULT_ON");
Page sanitization improvements This ensures init_on_alloc/free is used instead of page poisioning where available. 3.4 through 3.18 have a patch without a toggle for page sanitization. Signed-off-by: Tad <tad@spotco.us>
2022-04-02 02:18:30 -04:00
fi;
done;
Pixel 6/7 prep + fixes These still need defconfig and deblobber handling All of these sections were reviewed & sorted Signed-off-by: Tad <tad@spotco.us>
2022-12-14 21:23:13 -05:00
#excluding above: grep PAGE_POISONING_ENABLE_DEFAULT Build/*/kernel/*/*/mm/Kconfig.debug -l
Promotions 16.0 santoni/land to 20.0 Mi8937 unified 17.1 griffin to 18.1 17.1 star*/crownlte to 20.0 20.0 add pro1x Signed-off-by: Tad <tad@spotco.us>
2023-04-17 13:06:09 -04:00
oldKernels=('essential/msm8998' 'fairphone/sdm632' 'fxtec/msm8998' 'google/msm-4.9' 'oneplus/msm8998' 'oneplus/sdm845' 'oneplus/sm7250' 'razer/msm8998' 'razer/sdm845' 'sony/sdm660' 'sony/sdm845' 'xiaomi/msm8937' 'xiaomi/sdm660' 'xiaomi/sdm845' 'xiaomi/sm6150' 'yandex/sdm660' 'zuk/msm8996');
Page sanitization improvements This ensures init_on_alloc/free is used instead of page poisioning where available. 3.4 through 3.18 have a patch without a toggle for page sanitization. Signed-off-by: Tad <tad@spotco.us>
2022-04-02 02:18:30 -04:00
for kernelOld in "${oldKernels[@]}"; do
if [[ "$1" == *"/$kernelOld"* ]]; then
optionsYes+=("PAGE_POISONING_ENABLE_DEFAULT");
fi;
done;
Dramatically deduplicate scripts
2018-04-04 07:52:11 -04:00
for option in "${optionsYes[@]}"
do
Optimize hardenDefconfig
2021-09-18 21:38:43 -04:00
#If the option is disabled, enable it
sed -i 's/# CONFIG_'"$option"' is not set/CONFIG_'"$option"'=y/' $defconfigPath &>/dev/null || true;
Potential, but ugly, fix for Mi8937 Reported boot issues Notably this device went from 3.18 to 4.9 and likely has rough edges Signed-off-by: Tad <tad@spotco.us>
2023-04-23 23:29:34 -04:00
if [[ "$1" != *"kernel/oneplus/msm8996"* ]] && [[ "$1" != *"kernel/xiaomi/msm8937"* ]]; then
Optimize hardenDefconfig
2021-09-18 21:38:43 -04:00
#If the option isn't present, add it enabled
sed -zi '/CONFIG_'"$option"'=y/!s/$/\nCONFIG_'"$option"'=y/' $defconfigPath &>/dev/null || true;
Dramatically deduplicate scripts
2018-04-04 07:52:11 -04:00
fi;
done
#Disable supported options
Make hardenDefconfig more manageable No functional changes Signed-off-by: Tad <tad@spotco.us>
2022-10-03 08:24:34 -04:00
#debugging
declare -a optionsNo=("ACPI_APEI_EINJ" "ACPI_CUSTOM_METHOD" "ACPI_TABLE_UPGRADE");
optionsNo+=("CHECKPOINT_RESTORE" "MEM_SOFT_DIRTY");
optionsNo+=("CP_ACCESS64" "WLAN_FEATURE_MEMDUMP");
optionsNo+=("DEVKMEM" "DEVMEM" "DEVPORT" "EARJACK_DEBUGGER" "PROC_KCORE" "PROC_VMCORE" "X86_PTDUMP");
optionsNo+=("HWPOISON_INJECT" "NOTIFIER_ERROR_INJECTION");
optionsNo+=("INPUT_EVBUG");
Many fixes to get bluejay booting & working proper - Enable APEX for Pixel 6/7, necessary for camera and pKVM - Also drop hack removing pKVM for Pixel 6/7 - patch from GrapheneOS - Extend hmalloc workaround to /apex - Deblobber: - actually handle wildcard f/w/b overlays - move some stuff around - remove some more Pixel blobs - flag and disable removal of camera extensions, being able to use the second camera is nice - Adjust what hardenDefconfig disables, caused boot issues minimal impact as most of these are already default-disabled can be narrowed down in future - Disable some of the bionic hardening patches, causing more boot issues annoying to lose, but having a phone that boots is more important - Add LTE only mode to 17.1, 18.1, 19.1, and 20.0, credit GrapheneOS - Remove Pixel 2 ramdisk compression reverts, fixed upstream And yes, I know I should've split up this commit... Signed-off-by: Tad <tad@spotco.us>
2022-12-23 22:00:31 -05:00
optionsNo+=("LOG_BUF_MAGIC");
optionsNo+=("L2TP_DEBUGFS");
Make hardenDefconfig more manageable No functional changes Signed-off-by: Tad <tad@spotco.us>
2022-10-03 08:24:34 -04:00
optionsNo+=("PAGE_OWNER");
optionsNo+=("TIMER_STATS" "ZSMALLOC_STAT");
optionsNo+=("UPROBES");
Many fixes to get bluejay booting & working proper - Enable APEX for Pixel 6/7, necessary for camera and pKVM - Also drop hack removing pKVM for Pixel 6/7 - patch from GrapheneOS - Extend hmalloc workaround to /apex - Deblobber: - actually handle wildcard f/w/b overlays - move some stuff around - remove some more Pixel blobs - flag and disable removal of camera extensions, being able to use the second camera is nice - Adjust what hardenDefconfig disables, caused boot issues minimal impact as most of these are already default-disabled can be narrowed down in future - Disable some of the bionic hardening patches, causing more boot issues annoying to lose, but having a phone that boots is more important - Add LTE only mode to 17.1, 18.1, 19.1, and 20.0, credit GrapheneOS - Remove Pixel 2 ramdisk compression reverts, fixed upstream And yes, I know I should've split up this commit... Signed-off-by: Tad <tad@spotco.us>
2022-12-23 22:00:31 -05:00
#optionsNo+=("SLUB_DEBUG" "SLUB_DEBUG_ON");
Make hardenDefconfig more manageable No functional changes Signed-off-by: Tad <tad@spotco.us>
2022-10-03 08:24:34 -04:00
#optionsNo+=("STACKLEAK_METRICS" "STACKLEAK_RUNTIME_DISABLE"); #GCC only
Many fixes to get bluejay booting & working proper - Enable APEX for Pixel 6/7, necessary for camera and pKVM - Also drop hack removing pKVM for Pixel 6/7 - patch from GrapheneOS - Extend hmalloc workaround to /apex - Deblobber: - actually handle wildcard f/w/b overlays - move some stuff around - remove some more Pixel blobs - flag and disable removal of camera extensions, being able to use the second camera is nice - Adjust what hardenDefconfig disables, caused boot issues minimal impact as most of these are already default-disabled can be narrowed down in future - Disable some of the bionic hardening patches, causing more boot issues annoying to lose, but having a phone that boots is more important - Add LTE only mode to 17.1, 18.1, 19.1, and 20.0, credit GrapheneOS - Remove Pixel 2 ramdisk compression reverts, fixed upstream And yes, I know I should've split up this commit... Signed-off-by: Tad <tad@spotco.us>
2022-12-23 22:00:31 -05:00
#optionsNo+=("MMIOTRACE" "MMIOTRACE_TEST");
#optionsNo+=("IOMMU_DEBUG" "IOMMU_DEBUG_TRACKING" "IOMMU_NON_SECURE" "IOMMU_TESTS");
#optionsNo+=("DEBUG_ATOMIC_SLEEP" "DEBUG_BUS_VOTER" "DEBUG_MUTEXES" "DEBUG_KMEMLEAK" "DEBUG_PAGEALLOC" "DEBUG_STACK_USAGE" "DEBUG_SPINLOCK");
#if [[ $kernelVersion == "4."* ]] || [[ $kernelVersion == "5."* ]]; then
# #optionsNo+=("DEBUG_FS");
# optionsNo+=("FTRACE" "KPROBE_EVENTS" "UPROBE_EVENTS" "GENERIC_TRACER" "FUNCTION_TRACER" "STACK_TRACER" "HIST_TRIGGERS" "BLK_DEV_IO_TRACE" "FAIL_FUTEX" "DYNAMIC_DEBUG" "PREEMPT_TRACER");
#fi;
#if [[ "$1" != *"kernel/oneplus/sm8250"* ]]; then
# optionsNo+=("CORESIGHT_CSR" "CORESIGHT_CTI_SAVE_DISABLE" "CORESIGHT_CTI" "CORESIGHT_DBGUI" "CORESIGHT_ETM" "CORESIGHT_ETMV4" "CORESIGHT_EVENT" "CORESIGHT_FUNNEL" "CORESIGHT_FUSE" "CORESIGHT_HWEVENT" "CORESIGHT_QPDI" "CORESIGHT_REMOTE_ETM" "CORESIGHT_REPLICATOR" "CORESIGHT_STM_DEFAULT_ENABLE" "CORESIGHT_STM" "CORESIGHT_TMC" "CORESIGHT_TPDA" "CORESIGHT_TPDM_DEFAULT_ENABLE" "CORESIGHT_TPDM" "CORESIGHT_TPIU" "CORESIGHT" "OF_CORESIGHT");
#fi;
Make hardenDefconfig more manageable No functional changes Signed-off-by: Tad <tad@spotco.us>
2022-10-03 08:24:34 -04:00
#legacy
optionsNo+=("BINFMT_AOUT" "BINFMT_MISC");
optionsNo+=("COMPAT_BRK" "COMPAT_VDSO");
optionsNo+=("LDISC_AUTOLOAD" "LEGACY_PTYS");
optionsNo+=("MODIFY_LDT_SYSCALL");
optionsNo+=("OABI_COMPAT");
optionsNo+=("USELIB");
optionsNo+=("X86_IOPL_IOPERM" "X86_VSYSCALL_EMULATION");
#unnecessary
optionsNo+=("BLK_DEV_FD" "BT_HS" "IO_URING" "IP_DCCP" "IP_SCTP" "VIDEO_VIVID" "FB_VIRTUAL" "RDS" "RDS_TCP");
optionsNo+=("HIBERNATION");
optionsNo+=("KEXEC" "KEXEC_FILE");
Add a toggle for KSM Signed-off-by: Tad <tad@spotco.us>
2023-07-14 15:45:35 -04:00
optionsNo+=("UKSM");
KSM tuning - Only enable on Linux 3.0 through 4.9 - Always enable defer option - Only run twice a second, instead of fifty times a second Signed-off-by: Tad <tad@spotco.us>
2023-07-14 17:35:48 -04:00
if [ "$DOS_USE_KSM" = false ] || [ "$ksmNotNeeded" = true ]; then optionsNo+=("KSM"); fi;
Make hardenDefconfig more manageable No functional changes Signed-off-by: Tad <tad@spotco.us>
2022-10-03 08:24:34 -04:00
optionsNo+=("LIVEPATCH");
Small tweaks
2021-01-29 20:37:43 -05:00
optionsNo+=("WIREGUARD"); #Requires root access, which we do not provide
Make hardenDefconfig more manageable No functional changes Signed-off-by: Tad <tad@spotco.us>
2022-10-03 08:24:34 -04:00
if [ "$DOS_DEBLOBBER_REMOVE_IPA" = true ]; then optionsNo+=("IPA" "RMNET_IPA"); fi;
#unsafe
optionsNo+=("GCC_PLUGIN_RANDSTRUCT_PERFORMANCE");
optionsNo+=("HARDENED_USERCOPY_FALLBACK");
optionsNo+=("SECURITY_SELINUX_DISABLE" "SECURITY_WRITABLE_HOOKS");
Add a toggle for KSM Signed-off-by: Tad <tad@spotco.us>
2023-07-14 15:45:35 -04:00
if [ "$DOS_USE_KSM" = false ]; then optionsNo+=("SLAB_MERGE_DEFAULT"); fi;
20.0: fixes + r11 churn Signed-off-by: Tad <tad@spotco.us>
2022-10-16 11:06:48 -04:00
if [[ "$DOS_VERSION" != "LineageOS-20.0" ]]; then optionsNo+=("USERFAULTFD"); fi;
Make hardenDefconfig more manageable No functional changes Signed-off-by: Tad <tad@spotco.us>
2022-10-03 08:24:34 -04:00
#optionsNo+=("CFI_PERMISSIVE");
Many fixes to get bluejay booting & working proper - Enable APEX for Pixel 6/7, necessary for camera and pKVM - Also drop hack removing pKVM for Pixel 6/7 - patch from GrapheneOS - Extend hmalloc workaround to /apex - Deblobber: - actually handle wildcard f/w/b overlays - move some stuff around - remove some more Pixel blobs - flag and disable removal of camera extensions, being able to use the second camera is nice - Adjust what hardenDefconfig disables, caused boot issues minimal impact as most of these are already default-disabled can be narrowed down in future - Disable some of the bionic hardening patches, causing more boot issues annoying to lose, but having a phone that boots is more important - Add LTE only mode to 17.1, 18.1, 19.1, and 20.0, credit GrapheneOS - Remove Pixel 2 ramdisk compression reverts, fixed upstream And yes, I know I should've split up this commit... Signed-off-by: Tad <tad@spotco.us>
2022-12-23 22:00:31 -05:00
#misc
Make hardenDefconfig more manageable No functional changes Signed-off-by: Tad <tad@spotco.us>
2022-10-03 08:24:34 -04:00
optionsNo+=("FB_MSM_MDSS_XLOG_DEBUG" "MSM_BUSPM_DEV" "MSMB_CAMERA_DEBUG" "MSM_CAMERA_DEBUG" "MSM_SMD_DEBUG");
optionsNo+=("NEEDS_SYSCALL_FOR_CMPXCHG");
optionsNo+=("TSC" "TSPP2");
#breakage
optionsNo+=("HARDENED_USERCOPY_PAGESPAN");
#optionsNo+=("IKCONFIG"); #breaks recovery
#optionsNo+=("KALLSYMS"); #breaks boot on select devices
#optionsNo+=("MAGIC_SYSRQ"); #breaks compile
#optionsNo+=("MSM_DLOAD_MODE"); #breaks compile
#optionsNo+=("MSM_SMP2P_TEST" "INET_DIAG");
#optionsNo+=("PROC_PAGE_MONITOR"); #breaks memory stats
#optionsNo+=("SCHED_DEBUG"); #breaks compile
Breakup hardenDefconfig for readbility and debugging purposes Signed-off-by: Tad <tad@spotco.us>
2021-08-13 22:40:12 -04:00
Many fixes to get bluejay booting & working proper - Enable APEX for Pixel 6/7, necessary for camera and pKVM - Also drop hack removing pKVM for Pixel 6/7 - patch from GrapheneOS - Extend hmalloc workaround to /apex - Deblobber: - actually handle wildcard f/w/b overlays - move some stuff around - remove some more Pixel blobs - flag and disable removal of camera extensions, being able to use the second camera is nice - Adjust what hardenDefconfig disables, caused boot issues minimal impact as most of these are already default-disabled can be narrowed down in future - Disable some of the bionic hardening patches, causing more boot issues annoying to lose, but having a phone that boots is more important - Add LTE only mode to 17.1, 18.1, 19.1, and 20.0, credit GrapheneOS - Remove Pixel 2 ramdisk compression reverts, fixed upstream And yes, I know I should've split up this commit... Signed-off-by: Tad <tad@spotco.us>
2022-12-23 22:00:31 -05:00
if [ "$DOS_DEFCONFIG_DISABLER" = true ]; then
for option in "${optionsNo[@]}"
do
#If the option is enabled, disable it
sed -i 's/CONFIG_'"$option"'=y/CONFIG_'"$option"'=n/' $defconfigPath &>/dev/null || true;
#If the option isn't present, add it disabled
sed -zi '/CONFIG_'"$option"'=n/!s/$/\nCONFIG_'"$option"'=n/' $defconfigPath &>/dev/null || true;
done
fi;
Breakup hardenDefconfig for readbility and debugging purposes Signed-off-by: Tad <tad@spotco.us>
2021-08-13 22:40:12 -04:00
Dramatically deduplicate scripts
2018-04-04 07:52:11 -04:00
#Extras
Globbing fixes
2018-06-23 01:08:42 -04:00
sed -i 's/CONFIG_ARCH_MMAP_RND_BITS=8/CONFIG_ARCH_MMAP_RND_BITS=16/' $defconfigPath &>/dev/null || true;
sed -i 's/CONFIG_ARCH_MMAP_RND_BITS=18/CONFIG_ARCH_MMAP_RND_BITS=24/' $defconfigPath &>/dev/null || true;
sed -i 's/CONFIG_DEFAULT_MMAP_MIN_ADDR=4096/CONFIG_DEFAULT_MMAP_MIN_ADDR=32768/' $defconfigPath &>/dev/null || true;
Optimize hardenDefconfig
2021-09-18 21:38:43 -04:00
sed -zi '/CONFIG_DEFAULT_MMAP_MIN_ADDR/!s/$/\nCONFIG_DEFAULT_MMAP_MIN_ADDR=32768/' $defconfigPath &>/dev/null || true;
14.1: Add grouper
2018-06-26 05:57:22 -04:00
sed -i 's/CONFIG_LSM_MMAP_MIN_ADDR=4096/CONFIG_LSM_MMAP_MIN_ADDR=32768/' $defconfigPath &>/dev/null || true;
Optimize hardenDefconfig
2021-09-18 21:38:43 -04:00
sed -zi '/CONFIG_LSM_MMAP_MIN_ADDR/!s/$/\nCONFIG_LSM_MMAP_MIN_ADDR=32768/' $defconfigPath &>/dev/null || true;
Dramatically deduplicate scripts
2018-04-04 07:52:11 -04:00
editKernelLocalversion "-dos";
echo "Hardened defconfig for $1";
Overhaul variable names
2018-06-29 00:55:21 -04:00
cd "$DOS_BUILD_BASE";
Dramatically deduplicate scripts
2018-04-04 07:52:11 -04:00
}
export -f hardenDefconfig;
Reference in New Issue Copy Permalink