2.9 KiB
Reproducible Phase 6 build toolchain
Installed and missing
Present: Temurin OpenJDK 21.0.11 (java, javac, jar, keytool), Python
3.12.6 and ADB 37.0.1. Missing from PATH: apktool, jadx, smali/baksmali, d8/r8,
zipalign and apksigner. No Philips source tree, Android 12 API-31 build stubs,
vendor build configuration, platform private key, AVB private key or accepted
firmware packer is available. Tools must be version-pinned and hashed before a
binary build; none should be downloaded or trusted blindly.
Per-component pipeline
| Target | Golden input | Controlled pipeline | Output gate |
|---|---|---|---|
| Channels | diagnostics/raw/storage/channels.apk |
verify hash → decode four DEX/resources → apply EPG source/smali change → assemble DEX → rebuild preserving manifest/resources → zipalign → sign with exact accepted platform signer | APK/DEX parse, only target methods changed, signer lineage exact, install/image test, regenerate ART |
| GEL | diagnostics/raw/storage/gel.apk |
verify hash → implement outbox and schema migration in source/DEX → rebuild → align → platform-sign | migration/action matrix, bounded WorkDB, signer/shared UID, ART |
| TPTvService | diagnostics/raw/TPTvService.apk |
verify hash → replace monitor state machine/resources → rebuild → align → platform-sign | core/persistent start, policy tests, UI strings, ART |
| tvfw | diagnostics/phase4/reference-binaries/tvfw.jar |
verify hash → unpack one DEX → patch exact method → rebuild JAR deterministically | DEX reparse, registered-library client linkage, image integration, regenerated preopt |
Never overwrite golden files. Build in a new versioned directory and record tool hashes, command lines, input/output hashes and SOURCE_DATE_EPOCH. Java pseudodiffs are specifications; a release build must integrate them into Philips source or a fully verified DEX assembly.
Signing, ART and image integration
All target APKs use android.uid.system and the same Philips platform signer.
Only that accepted private key/signing lineage can produce an updated package.
Signing with a new key or copying META-INF/signature blocks does not work: any
content change invalidates v1/v2/v3 cryptographic digests.
Do not ship golden ODEX/VDEX next to changed DEX. Use the matching vendor build
to regenerate ARM32 preopt artifacts, or an explicitly tested image policy that
omits them and allows ART compilation. For tvfw, validate every client
class-loader context. It is a registered shared library, not bootclasspath.
System-image changes require filesystem image regeneration and an AVB/vbmeta chain signed with a key accepted by the locked/green device. A root shell alone does not solve verified boot or platform signing. No binary was built in Phase 6 because the required private material and vendor build/recovery path are absent; producing a randomly signed artifact would be misleading and unsafe.