yashsingh1/xdaforums huggingface dataset:
[LineageOS News & Discussion] elirada:
I share your enthusiasm and also your frustration. :)

Here's the thing. Enabling signature spoofing is a patch, so you apply it before building the image. This means a zip would have to provide a drop-in replacement for the files affected by the patch, in this case I believe it's only 1 file: framework.jar. I have no idea how often framework.jar changes, but it would be useful to know – the more often it changes, the more often the zip will have to be updated and distributed again, and the less probable it is that someone will want to do that job.

So here is an approach I was thinking of:

1. Extend the microG patch to not blindly disable signature spoofing, but instead disable it conditionally when a certain flag is enabled in the settings (disabled by default, obviously). Don't provide any UI, just that test in the code.

2. Include that patch in mainstream LineageOS (and other ROMs). By default it's a no-op, so that's completely harmless. This is the key point.

3. Provide a zip (OP's idea) that surfaces the modification of that flag through a "Disable signature spoofing" option in the Developer Settings.

Ideally, 3 would also be baked into mainstream LineageOS, since Developer Settings are already fairly opt-in. However, in light of what happened recently to root access, I'm assuming 3 would have to follow the same approach and live as an external zip too, which is fair enough and would still represent a huge step forward, as OP pointed out.

Thoughts?
[LineageOS News & Discussion] zifnab06:
Official answer:

We will not be enabling signature spoofing. It's a huge security hole, and breaking android's security model (for any reason) is never acceptable.

Feel free to build it yourself (it is open source) if this is a feature you want, or use one of the plethora of other roms people have generated. Our main goal is to continue passing CTS and have a production-shippable OS available for anyone who wants to use it.
[LineageOS News & Discussion] enban:
[MENTION=7720152]elirada[/MENTION]

I like the idea and, frankly, I'm less concerned about the method to achieve it than on actually having signature spoofing.

Unluckily, as you can see, the official response is "No, never". Now, while I'm grateful to LineageOS developers for their hard work, I feel that their position on this point is plainly wrong. Allowing root is a bigger security issue than allowing on-demand signature spoofing for *one single* app, which would offer much more privacy to LineageOS users.
[LineageOS News & Discussion] invisiblek:
As zifnab said, we most certainly will not open up security holes like this. It would be an incredible disservice to our users.

Opening attack vectors such as this on millions of devices is "plainly wrong" as you put it.

But hey, its OSS, so fork and do it yourself! :good:
[LineageOS News & Discussion] enban:
What disservice? You clearly didn't read the OP. One should voluntarily flash a zip and then explicitly enable the feature. It's not something that would happen by chance and would be an explicit choice of each user. And frankly, while I certainly may learn how to get the source and compile it, I (and most people willing to use microG) have not the hardware resources and the time to compile each build. To call this solution impractical would be an euphemism.
[LineageOS News & Discussion] invisiblek:
Even if its something we'd remotely consider, its not as simple as providing a zip with a su binary in it like the root addon. This stuff is in framework which makes it a lot more difficult to supply a "bolt on" zip to do this.

Here's the patch when it was put on gerrit. You can read the comments to see the stance and reasoning on it.

It's something that will not ever be accepted in this project.
[LineageOS News & Discussion] seba3651:
hey guys, thanks for this discussion.

i easily patched the first lineageos-build (kenzo device) with tingle. this was possible because "pre-optimization" wasnt yet enabled when built. patching took only 1 minute.

would it be possible to make any second build (or once a month) without this "pre optimization"-flag?

This way security isnt touched and everyone who wants could easily patch it himself!
[LineageOS News & Discussion] h8rift:
We will not shipped compromised builds. It doesn't matter about how much you think it convenient...we are trusted to keep users safe.

The moment you have to use the words "spoof", "make the system think it's something else" or anything if that nature, you are lying to the system about an app, which will compromise thebuser's trust in the system.

If you think for one second that "experienced people who know what they are doing" would be the only ones to flash whatever the heck is available, you have not been on this forum or working with Android for very long.

If you "are experienced and know what you are doing", build it yourself. That's the safest bet against users not harming themselves with our stamp (release-keys) on it.

tl;dr: Nope. Not even once.
[LineageOS News & Discussion] elirada:
Fair enough. Signature verification is clearly an important component of Android's security model.

I think one should never have to choose between security and convenience. Give users the choice for long enough and they'll end up falling for the latter. The minute someone provides a poorly crafted yet job-doing image, everybody will start using it. The "I won't solve your problem" answer, rather than help people, will end up pushing them into randomness.

As someone mentioned, maybe there would be a way to allow the overriding of signature checking only for a given app, in favor of another given app? This is very from just disabling the whole thing, yet would let microG work.

That idea is just an arbitrary suggestion. Generally my point is that people are expressing a use case to solve and if nobody cares they will end up doing something silly,

eli
[LineageOS News & Discussion] alkesander:
Hi, I've finally manage to enable signature spoofing using tingle. The procedure is straightforward and very easy to follow (download script, make sure you have all needed programs, connect to rooted phone, execute the script, boom - done).

After that I was able to install microg and with Mozilla location backend it's working very well. So currently I'm running lineageos without gapps on oneplus 3t and can install apps from play store.

If any of you want I can write short instruction but all needed information can be found easily.
[LineageOS News & Discussion] EinsteinXXL:
[MENTION=7999664]alkesander[/MENTION]

Is the patch only for LineageOS? Need patch for OxygenOS 4.0.3.
[LineageOS News & Discussion] mmoyar:
About the security implications of signature spoofing

I'm wondering why no one pointed to microG Signature Spoofing and its Security Implications before.
[LineageOS News & Discussion] bobby.newmark:
Interesting, glad I found this thread, that link, and the responses from CM/Lineage devs. Seems pretty clear that user privacy is not a priority, probably been the case since that Microsoft money started flowing in 2015..

Time to start looking elsewhere I guess :(
[LineageOS News & Discussion] kelusia:
Well exactly this attitude from Linage towards signature spoofing is insecure.

Let me explain:

1.) Why do people move from stock roms to custom roms?

Because they care about their data privacy, want to get away from the claws of google and want to have more control what is shared with whom (or which app). They want to have a google-free environment. If not they can keep on sticking with the stock rom of the phone vendor because its optimized for the hardware and there is warranty for the device + the rom - so if you don't care about privacy and security there is no need to change to a custom rom.

2.) Taking 1.) into account and still denying the integration of signature spoofing to give the users freedom to secure their data from getting spied and analyzed by 3rd parties like google is INSECURE. In order to get away from google and get better data security you need to install microg for GCM-Messaging and yalp/fdroid as play substitute. Microg needs signature spoofing to fake the google services, so signature spoofing is needed to get security!

3.) The Linage statement "we leave the integration of signature spoofing up to the user" (which is no problem by using e.g. tingle) is INSECURE, because then the users integrate it themselves on a system-wide basis, so every app could spoof signatures without any control. It is then NOT integrated into the ROM's security and permission concept.

If you look at other custom roms like CarbonROM and OmniROM: They did the integration of signature spoofing into the security and permission concept. So the user can allow siganture spoofing only to certain apps (like microg) and have full control.

So finally:

Its not signature spoofing that is insecure but the way you integrate it into the rom. By denying the proper integration of signature spoofing into Linage you leave users alone patching something into the framework without any control (and in a lot of cases without any knowledge what they are doing and what consequences this has for the overall security)

Because of this i switched to CarbonROM cause they have integrated signature spoofing securely and controllable into the ROM
[LineageOS News & Discussion] ale5000:
The "security" is clear an excuse to hide behind (in my opinion) since the patch only spoof signature to other apps, not to the OS.

And they could also limit spoofing to allow only the official microG signed packages to do it.

The real reason is, in my opinion, political; I think they just don't want to displease Google to pass SafetyNet.
[LineageOS News & Discussion] ale5000:
Edit: Post removed
[LineageOS News & Discussion] anarchotaoist:
microg but no sig spoof

So I flashed nanodroid through Magisk. I now have microg but no sig spoof. I installed nano patcher 17.2 -failed. I then used the xposed installer from F-Droid. Fail. What can I check/do to get sig spoof working in LOS 15? Thanks!

---------- Post added at 05:36 AM ---------- Previous post was at 04:38 AM ----------

ok, so now I flashed xposed in TWRP, rebooted and in the xposed installer app it said it was active - but no sig spoof still.

I clicked install in the xposed installer app - fail.

I clicked install from recovery in the xposed installer app. That seemed to work - but still no signature spoofing.

:confused:

UPDATE:

So, I got xposed installed. Flashed it in TWRP then in the xposed app I installed it via recovery.

I then eventually installed the FakeGapps app.

Microg gives self check now gives 'System spoofs signature' a tick - it did not before.

Another app 'Signature Spoofing Checker' however says 'Disabled' -???

I was trying to get the emergency/rideshare app 'Cell411' working. Previously it booted up and said play service were required. That message is now gone! Yay - except the map will not load!

So..

In microg there is a check box unchecked -'UnifiedNlp do not have location to test Geocoder'

In configure location backends I have 6 things ticked on.

nb The FOSS weather apps now load faster!

How do I get the map to load in Cell411 (and Uber)??

Am I missing some setting?

re: log in into Play Store enable google device registration in MicroG settings.

I have been using F-droid, Yalp and Aptoide. Will enabling device registration give me any functionality for maps?

What of google cloud messaging and SafetyNet - do I need those for any reason - map related or otherwise? ps I am trying to avoid as much a possible all google service, foremost for privacy and secondarily for FLOSS reasons.

Thank you!
[LineageOS News & Discussion] kurtn:
Yes, it is a hard piece of work in Oreo. MicroG woks better in nougat. You don't need gcm or safety net for apps from f-droid.
[LineageOS News & Discussion] orgl:
, 8 da

Gesendet von meinem SM-G950F mit Tapatalk
[LineageOS News & Discussion] DeniTx:
Anyone has a ready rom for note 5 SM-N920T android 6.0.1 Arm64 Marshmallow
[LineageOS News & Discussion] kurtn:
Get a stable ROM without GApps. We will find a solution for signature spoofing.
[Samsung Galaxy 5 I5500] mertcanhekim:
I wanted to update the OS of my i5500. I first tried the method here but the phone got stuck in bootloop. Then, I attempted to install the version here. Still bootloop. Can you guys help me? I can't use my phone anymore.
[Samsung Galaxy 5 I5500] Vagelis1608:
Flash the recovery (CWM) again and format /system , /data and /cache . Then flash the packages mentioned in the second link (which is better than the first, if you ask me).
[Samsung Galaxy 5 I5500] mertcanhekim:
Just did it. Still bootloop.
[Samsung Galaxy 5 I5500] Vagelis1608:
Try flashing CM11 from madteam.co
[Samsung Galaxy 5 I5500] mertcanhekim:
I'm having difficulty finding the right version of CM11 for my phone since madteam.co is inaccessable due to database errors. Do you know somewhere else I can download it?
[Samsung Galaxy 5 I5500] mertcanhekim:
Madteam.co is no more :(
[Samsung Galaxy 5 I5500] jacomail95:
Found some days ago a mirror, there are links to Google Drive pages with CM11 and Gapps here

http://vinloren.blogspot.it/?m=1

Inviato dal mio Nexus 5 con Tapatalk 2
[Samsung Galaxy 5 I5500] mertcanhekim:
Finding update package...

Opening update package...

Installing update...

E:Error in /sdcard/cm-11.0.0-GT-I5500-galaxy5.zip

(Status 0)

Installation aborted.

I did not understand how to use recovery-clockworkmod-6.0.5.2 so I tried installing with ClockworkMod-Galaxy5-v0.7 . Most likely that is why it failed.

What am I supposed to do with recovery-clockworkmod-6.0.5.2 file? It's not in .tar format so Odin does not accept it. The page is not in English and I did not understand.
[Samsung Galaxy 5 I5500] Vagelis1608:
It's flashable. Flash it in recovery. Then reboot into recovery (so that the new recovery gets loaded).

Also, you have to flash it in order to able to use the ROM.
[Samsung Galaxy 5 I5500] mertcanhekim:
I understood very little from that. You mean I need another recovery? I know only clockworkmod that is applicable to my phone.
[Samsung Galaxy 5 I5500] jacomail95:
You have an old CWM. Using that old CWM install the flashable zip of the new CWM then reboot. Simple
[Samsung Galaxy 5 I5500] Vagelis1608:
Flash clockwordmod-6.0.5.2 in recovery (like a ROM). Then reboot. Then flash the ROM.
[Samsung Galaxy 5 I5500] mertcanhekim:
Thanks. When you put it that way I understood clearly.

I installed CM11 and this time instead of the word Android the Cyanogenmod logo appeared and for a second I thought it really worked. Then, the scumbag phone decided to go into a bootloop.

:crying:
[Samsung Galaxy 5 I5500] Vagelis1608:
Did you wipe /data after flashing the ROM?
[Samsung Galaxy 5 I5500] mertcanhekim:
I wiped data, wiped cache, and wiped dalvik cache all BEFORE flashing the ROM. I was supposed to do it after? Wouldn't that delete the installed data of the ROM?
[Samsung Galaxy 5 I5500] mertcanhekim:
I tried wiping data AFTER flashing the ROM. It bootloops the exact same way.
[Samsung Galaxy 5 I5500] Vagelis1608:
How did you get into recovery?
[Samsung Galaxy 5 I5500] mertcanhekim:
You mean AFTER flashing the Rom? I was already in recovery to flash the Rom so I wiped /data before rebooting. Was I supposed to reboot first?
[Samsung Galaxy 5 I5500] Vagelis1608:
No. After the bootloop, how did you get in recovery?
[Samsung Galaxy 5 I5500] mertcanhekim:
1- I loaded clockworkmod 6.0.1.2 with Odin

2- I flashed clockworkmod 6.0.5.2

3- I wiped data, cache, and dalvik cache

4- I flashed CM11 again

5- I wiped data again

6- Rebooted

Bootloop happened once more.
[Samsung Galaxy 5 I5500] Vagelis1608:
You need to reboot into recovery between 2 and 3 (so that the new recovery gets loaded).
[Samsung Galaxy 5 I5500] mertcanhekim:
That's what I did. Without the new recovery, CM11 cannot be flashed after all.
[Samsung Galaxy 5 I5500] Vagelis1608:
Try to grab a logcat during the bootloop.
[Samsung Galaxy 5 I5500] mertcanhekim:
I installed Android Studio to get logcat but it does not see my device bacause the bootloop always interrupts the recognization of the phone regardless of how long I wait.

I got a connection error message after 15 minutes.
[Samsung Galaxy 5 I5500] Vagelis1608:
I expected that.

Try to flash another ROM (you might need the old recovery)
[Samsung Galaxy 5 I5500] mertcanhekim:
I've tried some stock Roms but they always fail this way
[Samsung Galaxy 5 I5500] Vagelis1608:
I meant custom ROMs.
[Samsung Galaxy 5 I5500] mertcanhekim:
I've tried 8 custom Roms so far. All except for the last one show Android text for half a second before rebooting. But with the 8th Rom I tried, the Android text stays on screen way longer before it reboots. I thought by using that additional time, my device could be recognized by my computer and I could grap a logcat.

I tried and the phone ID showed up as you can see on the picture. But when I enter the "monitor" command, it gives the error you see above.

What can I do in this situation?
[Samsung Galaxy 5 I5500] jacomail95:
Try to wipe for good all the partitions of the phone using another recovery and then go back to CM7

http://www.mediafire.com/file/zpkmcc7vg3y5a97/cm-7-20131216-MADTEAM-galaxy5.zip

or CyanMobile eXperience 2.3.8 here

http://www.mediafire.com/?a3cy74d39tne4me
[Samsung Galaxy 5 I5500] jacomail95:
Also i upload here some things i found. Try also the boot menu, it has to be flashed on every ROM flash but it can save you some time if it works. Credits all to the original developers of all of this. I hope the many remaining users of the Samsung Galaxy 5 can find this post useful :)
[Samsung Galaxy 5 I5500] Vagelis1608:
I was gonna recommend using another recovery, but you beat me to it :highfive: ;)
[Samsung Galaxy 5 I5500] mertcanhekim:
I've tried many many combinations of recoveries and Roms. So far, nothing worked.

Interestingly, using a different recovery made a difference in same cases. Some Roms that would bootloop with CWM did not bootloop with another recovery. Instead, they got stuck on the Android text infinately.

CM11 and CM10.1 bootlooped regardless of the recovery.

I could not flash the boot menu.

And Aromafm is not a recovery as far as I can tell.
[Samsung Galaxy 5 I5500] Vagelis1608:
Why couldn't you flash the boot menu?

Did it display an error?

Also, AromaFM is a file manager for recoveries (TWRP has a file manager built-in).
[Samsung Galaxy 5 I5500] mertcanhekim:
Oh, it's for starting the phone in clockwork mode. I think I had misunderstood it's purpose.

I tried cleaning cache folder with Aromafm manually on top of the recovery's clean cache command, but it did not make a difference.

Any more ideas?
[Samsung Galaxy 5 I5500] mertcanhekim:
UPDATE: After countless tries, I've finally managed to flash an android 2.2 stock rom. Not a Cyanogen mod, but it's better than an unusable bootlooping phone.
[Samsung Galaxy 5 I5500] Vagelis1608:
I believe that your issue was caused by the fact that Samsung used a different filesystem than custom ROMs.

You have to actively format /system /data and /cache as ext4 (a simple wipe isn't enough).
[Samsung Galaxy 5 I5500] mertcanhekim:
How do I format as ext4?
[Samsung Galaxy 5 I5500] Vagelis1608:
TWRP has a option for that in the Wipe menu.
[Samsung Galaxy 5 I5500] mertcanhekim:
What if that doesn't work? Does it have the option to format back to the Samsung filesystem? I presume after formatting, I no longer will be able to flash the stock ROM back since the filesystems won't match.
[Samsung Galaxy 5 I5500] Vagelis1608:
I am not 100% sure about this, but I believe that ODIN formats those partitions when it flashes them.

EDIT: This is the tutorial I used (years ago) to get CM7.2

http://xdaforums.com/showthread.php?t=1416190&p=20782937

(The recovery on this is modified to format partitions as ext4)

Remember, you are responsible with what you do on your phone, not me. But, I will try to help you out, should anything go wrong, of course. :)
[Samsung Galaxy 5 I5500] mertcanhekim:
I appreciate your help but after going through all that trouble, I'm not very willing to go through all that trouble, I'm not very willing to do that if I don't know with a certainty I can go back to my current Rom.

Is there a way to learn if Odin formats the partititions during flashing? Or an alternative way to format back to the Samsung filesystem?
[Samsung Galaxy 5 I5500] brb8two:
Hi Feduss,

I recently played with a i5500 and installed CM11 (Kit Kat 4.4) after first not following the instructions and needing to go back to stock firmware.

Most of my troubles was locating to files online since all the links I followed pointed to removed files and CM is dead as are a few teams that worked on this device.

I needed to use "Odin_Multi_Downloader_v4.28.exe" as the "Odin3_v3.12.3" didn't appear to work.

I found that "EUROPA_v1.0.ops" file worked with stock firmware "GT-I5500_ITV_1_20110427111816.zip" (followed a link on XDA to find and download all Samsung firmware) (It starts up in Italian, however very easy to change to English)

Next "recovery-clockworkmod-6.0.5.2-swaptls-galaxy5.tar" works as expected (also found a V5) but the TeamWinRecovery one I couldn't locate. Also needed is the "com.koushikdutta.rommanager-5.5.3.7-5537-minAPI8.apk" or similar as this is the only way to get in to recovery mode, as the i5500 was before combination keys to boot recovery being common.

The Two custom ROM's I located were "CleanROM-2.3.6.zip" (I havn't tried) and "cm-11.0.0-GT-I5500-galaxy5.zip" which works great however I'm having difficulties getting gapps (tried Pico and Nano) working, when I've tried installing the latest, the "free space" of the ROM isn't changed and then I get Forced closed issues for the keyboard, I ended up formatting and installing again to get back to a mode that I could use the keyboard. Later I read that there was a possibility to have fixed it with file permissions. (I'll try this next time)

I've kept a copy of all the files just in case they are needed.

I haven't linked to anything as I didn't keep track of the current alive locations and I found the most helpful information was the filename when searching for things when links are dead.

I'm not on XDA often, but I might check back to see if this information has helped.

BTW, I wasn't able to use my Windows 10 64bit machine (drivers wouldn't load indicating USB malfunction?), so I used Windows 7 32bit and it worked right away.

I had just played with this as an experiment to see how far I could push this tiny old thing.
[Samsung Galaxy 5 I5500] feduss:
Wow! Thx man, i would try if you could upload the necessary files :)

edit: i found the files on google :D

edit2: nothing to do....it stucks at odin mode :(
[Samsung Galaxy 5 I5500] brb8two:
Hi Feduss,

The only thing that I didn't write about was to be in "Odin" mode - download mode with the phone;

"press and hold 3 buttons: Volume Down + Home button + Power button."

You had probably done this but it's the last thing to verify.
[Samsung Galaxy 5 I5500] feduss:
Yes, i used the download mode

Edit: maybe it's a problem of the pit file
[LG G5 Questions & Answers] akkay1:
Dear All,

I just got my self LG G5 F700 Korean variant, i have searched on forum and could not find any thing related to my device, even rooting method is not mentioned for this. Guys please confirm if there are any custom roms or recoveries for this varient.
[LG G5 Questions & Answers] aboto:
same question! looking forward to seeing the news!
[LG G5 Questions & Answers] aboto:
Just get a notification to upgrade the Korean LG G5. After finish:

[IMG="OTA upgrade for Korean LG G5 March 2017"]http://sv1.upsieutoc.com/2017/03/21/G5-OTAupgradeMach2017.jpg[/IMG]
[LG G5 Questions & Answers] hero_p113:
I don't think there's any possible root now for Korean variant :( been trying to find a way to root it so I can get the annoying shutter sound off
[LG G5 Questions & Answers] villagermd:
I have same problem. Anybody help us?

Device: G5 F700S
[LG G5 Questions & Answers] hackintoish12945:
Check the all one thread.Take a look that debug kernel can have a limited root environment.Or take a shot at kingroot。

我從使用 Tapatalk 的 LG-F700L 發送