[Galaxy S 4 i9505 Original Android Development] goosnarrggh:
It's been a while since I started this whole thing, so I may not remember all the steps I took to get where I am today. I'll try to reconstruct as much as I can.

I originally started out by trying to use the CyanogenMod 13 target tailored specifically for jfltecan. However, I noted that they were no longer being built automatically since the jflte* family had previously been unified and then subsequently split back up into separate builds. (At the time, in fact, there weren't any official builds for the Galaxy S4 coming out at all; CM13 for jfltexx hadn't yet reached a stable release and they appeared to have stopped producing builds of CM12.1 for jfltexx.)

So, I tried to check out all the sources and build jfltecan for myself, to be installed using the existing jfltecan build of TWRP. That didn't go well. I suspect that there had been too much divergence in the source code since jfltecan lost its maintainer. In any event, the thing just booted into a blank white screen and started getting very hot.

So I reverted back to stock and re-evaluated my options. I had read that the various jflte* devices had previously been unified because they had extremely similar hardware, so I figured I should look into trying out the "Optimized CyanogenMod 13" project, which was underway at the time, because they were advertising compatibility with all the unified hardware models. I used the recommended build of TWRP, official 3.0.2.0 for jfltexx. It was problematic as well: The touchscreen would lock up every time the screen went to sleep.

Eventually, official jfltexx builds of CM13 started to emerge. I jumped back on the bandwagon when the first snapshot build of CM13 for jfltexx was released, along with the same official jfltexx 3.0.2.0 build of TWRP. They worked well. At the time, SafetyNet was not as highly visible as it is today; there was no such thing as the "Device Certification" property in the Play Store, and NFC payments really hadn't taken off in Canada yet. For all I know, at the time SafetyNet might have actually been failing due to CyanogenMod's practice of installing the su binary by default.

When LineageOS 14.1 came out, I waited a fairly long time, hopeful that snapshot builds would come along. When it became apparent that they were not going to happen, and I realized that I was now several months out of date on security patches, I decided that the best approach would be to start using the weekly LOS14.1 builds. I'm pretty sure I switched over to the jfltexx build of TWRP 3.1.0.0 at about the same time. I followed suit on to jfltexx TWRP 3.1.1.0 after it was released.

As soon as the whole "Device Certification" issue started to become visible in the Google Play Store, I checked and my device was already showing up as Certified. Googling about SafetyNet, I tracked down the SafetyNet attest app from the Play Store, and it consistently reports that all tests were passing.

And now I am using TWRP 3.1.1.0 with the official December 6 build of LineageOS 14.1. Everything still seems fine.

One thing to note: Back while I was running the stock OS, I never opted-in to the KNOX device protection features. That may make a difference. Did you?

[EDIT] Interestingly enough, I note that Samsung released a patch to the stock Samsung OS for the Canadian Galaxy S4 for the Bell Canada group of carriers on March 1, 2017. It is possible that patch might have updated the bootloader to a version that is more restrictive with respect to SafetyNet compliance. I never installed that patch, because by then I was already fully committed to CyanogenMod/LineageOS. So any negative consequences that may have come from that update would never have affected me. [/EDIT]