[Magisk] Daniel_Laixer:
To whom this may concen or find helpful. This is my verified setup for passing Play Integrity API check and get the app CaixaBank Sign 1.29 to work (1.30 DOES NOT WORK with this fix, you have to avoid updating).

Set up and steps in order:

Device: Redmi Note 9 Pro.

LineageOS, Gapps and Magisk used:

lineage-18.1-20220902-nightly-miatoll-signed.zip (not available for download anymore, but I keep a local copy).

MindTheGapps-11.0.0-arm64-20220217_100228.zip. (seems to work with open_gapps-arm64-11.0-pico-20220215.zip too)

Magisk-v25.2.zip.

Installed/downgraded to: CaixaBank Sign 1.29.0 (CBS in short)

Installed Play Integrity API Checker for testing purposes.

Magisk setup:

The only modules installed:

USNF v2.4.0-MOD_1.2.

Shamiko v0.6.

SystemUI Bootloop Saver 1.0.0 (not crucial for PI, but always helpful).

Config:

Zygisk enabled.

Enforce DenyList disabled (required by Shamiko IIRC).

DenyList items (Google Play Services is NOT denied):

es.caixabank.caixabanksign

com.android.vending

com.google.android.gsf

Cleared DATA of:

CaixaBank Sign.

Play Integrity API Checker (important for testing in case the check has previously failed).

Google Services Framework (com.google.android.gsf).

Google Play Store (com.android.vending).

Google Play Services (com.google.android.gms).

Finally: rebooted phone and succesfully launched the CaixaBank Sign app. Play Integrity API check also works. Keep in mind that CBS 1.29.0 won't work without Shamiko, I've specifically tested that scenario.

Concerns and thoughts:

I'm worried that my bank may force me to update the app in the future by making rendering CBS 1.29.0 useless.

I wonder if adding Google Play Services to the DenyList could help with with CBS 1.30.0. EDIT: AFAIK, it doesn't make any difference.

I haven't tested installing LSPosed via Magisk could break PI or CBS 1.29.0. EDIT: LSPosed doesn't seem to break 1.29.0.

On the other side, maybe using XPrivacyLua could help with CBS 1.30.0. EDIT: never mind, I actually removed XPrivacyLua and deleted the folder /data/system/xlua to avoid unwanted detections.

UPDATE 2023-11-04: If the app was previously working and starts saying that it closed itself because the device is not safe, try clearing only the DATA of CaixaBank Sign and check again. I faced this issue today, maybe because I recently updated CaixaBank Now, I'm not sure.

UPDATE 2024-04-04: I've just discovered that CBS 1.29.0 works even when passing "MEETS_BASIC_INTEGRITY" only, or at least that's the case if not passing "MEETS_DEVICE_INTEGRITY" is caused by a banned kernel name.

Besides: I'm pretty sure later CBS versions don't work just because of some internal root check. For instance: version 1.35.1 + Magisk 27.0 = suck on "Conectando de forma segura..." for a while, then crashes.

However, if I add to that the LSPosed module ByPassRootCheckPro enabled for CBS 1.35.1, it crashes way faster, so that means blocking root detection interferes with the app, because they're trying to detect root! We need to find a way to "neutralize" their root detection if we want to use later verions. Magisk Delta (AKA Kitsune Magisk) hasn't helped in my tests and KernelSU doesn't easily suppory my LKM kernel...

I may create a new post or edit this one if I have any update.