3.7 KiB
Phase 6 golden baseline
Captured 2026-08-26 for TPM191E_R.211.000.103.000. The four local binaries
are immutable reference inputs. No build step may overwrite them; patched
outputs must use a new path and filename. Full hashes are in hashes.sha256.
| Component | TV path | Local reference | Bytes | Package / SDK | DEX | Runtime importance |
|---|---|---|---|---|---|---|
| Channels | /system/priv-app/channels/channels.apk |
diagnostics/raw/storage/channels.apk |
14,047,493 | org.droidtv.channels, v1/0.0.0.1, min 31, target 30, compile 31 |
4 | privileged UID 1000, android.uid.system, system_app; core TV/EPG |
| GEL | /system/app/gel/gel.apk |
diagnostics/raw/storage/gel.apk |
398,392 | org.droidtv.gel, v58724408/7.2.0.56, min 28, target/compile 33 |
1 | system UID 1000, android.uid.system, system_app; telemetry/WorkManager |
| TV framework | /system/framework/tvfw.jar |
diagnostics/phase4/reference-binaries/tvfw.jar |
3,275,657 | registered Java shared library tvfw, no APK manifest |
1 | broad TV client surface; highest deployment risk |
| TP TV service | /system/app/TPTvService/TPTvService.apk |
diagnostics/raw/TPTvService.apk |
5,471,048 | org.droidtv.tv.tptvservice, v31/12, min 31, target 30, compile 31, coreApp |
1 | persistent system UID 1000, android.uid.system, system_app; storage warning service |
Signing baseline
All three APKs carry the same v1 signer certificate and APK Signature Scheme v2 and v3 blocks (plus verity padding):
- subject/issuer:
EMAILADDRESS=android@android.com, CN=Android, OU=Android, O=Android, L=Mountain View, ST=California, C=US - certificate SHA-256:
D8:FF:E0:AF:40:4E:AB:8E:45:5A:00:74:D4:17:B0:DA:12:D0:67:26:E5:05:B0:2B:7F:DB:18:31:29:C8:90:68 - certificate SHA-1:
43:80:01:76:AC:53:BF:E9:FD:33:4A:EB:86:1D:40:A1:2A:00:AF:C0 - algorithm: SHA1withRSA, RSA-2048; validity 2015-08-10 through 2042-12-26.
The public certificate is present; the private platform signing key is not.
Matching the subject name is not sufficient—Package Manager requires the same
cryptographic signer for the shared UID. tvfw.jar has no JAR signature.
Compiled artifacts on the stock image
All APK/JAR and OAT/VDEX files are root:root, mode 0644, SELinux
u:object_r:system_file:s0, timestamp 2009-01-01. The device has 32-bit ARM
compiled artifacts:
| Input | ODEX bytes | VDEX bytes |
|---|---|---|
| Channels | 66,212 | 131,484 |
| GEL | 21,156 | 7,292 |
| TPTvService | 49,828 | 105,692 |
| tvfw | 37,540 | 51,572 |
Their hashes are recorded in hashes.sha256. A replacement image must either
ship matching regenerated artifacts or deliberately use a tested image-build
path that causes ART to regenerate them. Mixing a modified DEX with stock
ODEX/VDEX is not an acceptable deployment artifact.
Trust and deployment boundary
The active /system is AVB/dm-verity protected and the device is locked/green.
The APKs use the system shared UID; Channels is also privileged and TPTvService
is persistent/core. Therefore a normally installed APK, an ADB overwrite, or a
randomly signed rebuild is not a valid replacement. The viable production
artifact is an OEM/platform-signed APK integrated into a correctly generated
and AVB-signed firmware image. tvfw.jar is not in BOOTCLASSPATH; it is the
registered tvfw shared Java library and still has preoptimization and client
class-loader-context coupling.
Evidence boundary
Local SHA-256, ZIP/DEX layout, manifests and certificates were inspected
offline. TV paths, labels, sizes and compiled-artifact hashes were captured by
read-only pm path, ls, stat, ps and sha256sum; no TV state was
changed. The EPG snapshot is a test input only and remains untouched.