search

RattlesnakeOS / microg

Community supported patches and prebuilts to include microG into the RattlesnakeOS build process
18 stars 18 forks source link

More restrictive sigspoof #4

Open pgera opened 4 years ago

pgera commented 4 years ago

CalyxOS uses a more restrictive form of signature spoofing. https://gitlab.com/calyxos/platform_frameworks_base/commit/dccce9d969f11c1739d19855ade9ccfbacf8ef76

Opened this issue so that if someone has the time/inclination to adapt it, it would be useful. I'll see if I can get to it at some point.

nickrbogdanov commented 3 years ago

I'm using this with Android 11:

https://gist.github.com/nickrbogdanov/5390d0ee1a84c5fc5b09a5ec98f0c63d https://gist.github.com/nickrbogdanov/922ecda2e557499c22a9e5d084d74554

The hardcoded SHA matches the official microg APKs, so packages that aren't signed by the microg developers can't use the spoofing capability. I would rather do it this way than go through the trouble of building microg into my ROM, or create a new Android permission that any random package can try to use.

dan-v commented 3 years ago

@nickrbogdanov - this seems like a nice approach. Have you bumped into any downsides at all? You can just update through F-Droid with no issues?

nickrbogdanov commented 3 years ago

Too early to tell, although it passes initial sanity tests. The 10->11 transition on my daily driver has been slow going.

codethief commented 3 years ago

@nickrbogdanov Instead of running the check against the GrapheneOS certificate (or one's own), would it also be possible to use the MicroG developer's certificate? That way, one could still update the MicroG apps independently of the ROM through, say, the MicroG F-Droid repo.