yashsingh1/xdaforums huggingface dataset:
[Magisk] osm0sis:
Ah, yup! That's exactly what I was thinking of:

Signing Builds | LineageOS Wiki

wiki.lineageos.org

Official custom ROMs switching to proper signing will need to adapt that for themselves to make migration builds most likely to keep it simplest for people.
[Magisk] joeyhuab:
Reset all package signatures on boot · LineageOS/android_frameworks_base@f43e36b

Can be used to make a special build that resets all package signatures without wiping any data. Change-Id: Iff65f2ed3c9d0f80be7221ff90803eda4732cac0

github.com

Here's a commit as well to those who don't want to use scripts. Just include this in frameworks/base and you should be able to install signed builds from unsigned ones like normal. But it needs adapting to a14.

Sorry this is no longer needed in A14.
[Magisk] cmstlist:
I don't know if this is related to the fingerprint change, but my Files app on Pixel 6a has gone bonkers now. Every folder shows as empty. Other file managers work fine.
[Magisk] immortalwon:
would this work for evolutionx rom? I have a signed build ready, but I just don't know how to migrate to it from the unsigned build.
[Magisk] joeyhuab:
It should but needs adapting to a14.
[Magisk] Dkpost3:
Tell me what to do if 2048 bit keys are registered in the tree, and when signing the firmware, apex asks for a 4096 bit key. I tried to rewrite it in the tree at 4096 - it does not load the system. If you leave it as is, the same thing.

# Verified Boot

BOARD_AVB_ENABLE := true

BOARD_AVB_MAKE_VBMETA_IMAGE_ARGS += --flags 3

BOARD_AVB_RECOVERY_KEY_PATH := external/avb/test/data/testkey_rsa2048.pem

BOARD_AVB_RECOVERY_ALGORITHM := SHA256_RSA2048

BOARD_AVB_RECOVERY_ROLLBACK_INDEX := $(PLATFORM_SECURITY_PATCH_TIMESTAMP)

BOARD_AVB_RECOVERY_ROLLBACK_INDEX_LOCATION := 1

BOARD_AVB_VBMETA_SYSTEM := system system_ext product

BOARD_AVB_VBMETA_SYSTEM_KEY_PATH := external/avb/test/data/testkey_rsa2048.pem

BOARD_AVB_VBMETA_SYSTEM_ALGORITHM := SHA256_RSA2048

BOARD_AVB_VBMETA_SYSTEM_ROLLBACK_INDEX := $(PLATFORM_SECURITY_PATCH_TIMESTAMP)

BOARD_AVB_VBMETA_SYSTEM_ROLLBACK_INDEX_LOCATION := 1
[Magisk] deepongi:
View attachment 6106656

Yeah baby, one signed and passing integrity build out of the oven..

Regards.
[Magisk] chiteroman:
external/avb/test/data/testkey_rsa4096.pem (It's better to use your own private key)

SHA256_RSA4096
[Magisk] joeyhuab:
Reset all package signatures on boot · EAZYBLACK/evoframeworks_base@d439862

Basically this is to make a migration build to migrate from unsigned build to signed.

github.com

Here's an updated commit. Thanks to @EAZY BLACK ! You just need to pick that one time for initial migration build to signed. Subsequent builds won't need it.

EDIT: Commit is missing some imports. needs fixing.
[Magisk] DylanAkp:
I don't know if anyone experienced something similar

I signed a few builds and I noticed that devices that used EDL in the past, even with a rom signed, won't pass DEVICE
[Magisk] DylanAkp:
Here is a little bit more details about what different users reported when I asked them :

Pong 1: Never used EDL, signed : BASIC, DEVICE

Pong 2: Never used EDL, signed : BASIC, DEVICE

Pong 3: Used EDL in the past, signed: BASIC

lemonadep: Used EDL in the past, signed: BASIC

It may be a coincidence but seems like EDL has done something to the device

And I have someone testing on his device that has been EDL restored by the OEM (I will update this message)
[Magisk] chiteroman:
I flashed my Poco X3 Pro in EDL using paid service and it gets Device verdict on userdebug, avb disabled Lineage signed build.

That's odd.
[Magisk] Jayant_Deshmukh:
Did the commit work properly for migrating from unsigned? I can see a fix up commit following this one.
[Magisk] DylanAkp:
Oh that breaks my theory then

Maybe the leaked EDL tools of nothing and/or OnePlus broke something

Maybe it's something totally unrelated

I will try to dig a bit more, but considering how close these 3 Pong devicese environnements are.

For example, the Pong and lemonadep not passing weren't even after a clean flash

So I don't really know what else it could be

If you want me to test anything just tell me
[Magisk] Flr Power:
But how long ago was the EDL done?
[Magisk] immortalwon:
I tried to implement this changes to my rom source but it wouldn't build with those changes.
[Magisk] Mateoalfaro:
Device integrity was passing for my signed build this morning using the Sailfish Pif, if I check it now it's back to failing
[Magisk] fbirraque:
Sailfish still BASIC and DEVICE certified.

So double check it in your side.
[Magisk] hackthis02:
You were right, a few days later stuff started flipping. :(
[Magisk] Suvo developer:
This errors comes after all singing complete
[Magisk] MaXAiRO:
kebab: Used EDL in 2021, stock latest OOS 13 (unlocked) passes both BASIC and DEVICE.

So this theory is probably not valid.
[Magisk] Depressed T.Bear:
Never used EDL, rom (Jaguar) is signed, using PIF fork v8 with latest pif. Only passing basic, not device.
[Magisk] osm0sis:
In my experience OnePlus' MSM tools completely reset to factory locked state, including their ro.is_ever_orange unlock counter I discovered, so I doubt it leaves any traces.

What's the output of unzip -l /system/etc/security/otacerts.zip and uname -r ?
[Magisk] joeyhuab:
Ignore this for now. Some users have reported no issues in dirty flashing their signed updates over unsigned ones.
[Magisk] Vgl12258:
Thank you, this may help, since most system apps started to crash due to different signatures here after a dirty flash 😆
[Magisk] alekyiv:
View attachment 6106840

Please send message @coduxer who make los 20 for update rom for Redmi Note 11 spes/spesn

https://sourceforge.net/projects/lineageos-spes/reviews/ or his telegram. Thanks!
[Magisk] DylanAkp:
Got 2 others users that never used EDL and pass only BASIC

And another that used it and pass only BOTH

This is still the same build

Another difference I could notice is the phone variant (for Pong at least)

Phones that pass DEVICE seems to be EEA, while others seems to be IND variant

I don't really know I'm just a bit lost at this point

EDIT: not that either
[Magisk] Depressed T.Bear:
After a talk in my group, I switched from @osm0sis fork to the latest chiteroman release. I'm now passing both, basic and device again. 😲 very strange
[Magisk] osm0sis:
Did you try with my autopif.sh in the v9 RC? Maybe you just had a print format issue. PM me and I'll troubleshoot with you to work out what's going on. 👍
[Magisk] Depressed T.Bear:
I'll do so in the evening. Grill party starts 👍
[Magisk] D€INOS:
Kebab user here, PIF working with osm0sis fork, retrieved with autopif.sh, stock OOS14, having used MSM tools at least twice, the latest time about a month ago when leaving crDroid for stock OOS14.
[Magisk] Cristiano Lira:
Where's your PIFork v9? Can't find it in your github project page.
[Magisk] EAZY BLACK:
View attachment 6106860

seems like you can dirty flash unsigned to signed in android 13+

migration stuff needed for android 12 and below still
[Magisk] osm0sis:
The RCs are just the Actions builds from when I decide it's ready:

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com
[Magisk] immortalwon:
i tried to do this on evolution x a13 rom, not working. I also tried to dirty flash a signed rom unto the original test keys unsigned rom, all apps crashing and many bugs no wifi, etc.

Can someone give me proper instructions how to sign all the apks and apexes in this rom with 256 sha, 4096RSA?
[Magisk] thecoolkid:
There are some tools to resign an already built ROM, would that work too? I have a couple of devices that no longer receive updates, even custom ROM :/
[Magisk] wilsonhlacerda:
For cases like that it would be very helpful to find how Google is getting the ROM sign and spoof it if possible. Just like we already doing with fingerprint.

This could also help if Google start banning custom ROMs, then spoof with a stock ROM sign.
[Magisk] fbirraque:
Seems like a bad joke, but it's not.

My NFC Payments are broke again even though they are Play Integrity certified. Nothing changed but in the past two weeks every approximately 72 hours something seems to be checked on Google's side and the Wallet will be blocked at least for me.

Maybe more to come tomorrow like in the recent weeks, I hope not.

- Poco F3 (alioth), MIUI14.0.8.0 by XiaomiEU, Play Integrity Fork CI #223, Sailfish (public)

EDITED: Tested with the Sailfish and a private PIF and the Wallet failed in both.
[Magisk] CZ.Kostra:
I'm also on Xiaomi.EU ROM and no problem.

Poco F5 Pro (mondrian)

MIUI 14.0.28.0 (A13)

PIFork CI #222+Sailfish

Magisk Canary 27002

Shamiko 1.0.1
[Magisk] thecoolkid:
That's a good idea 👏
[Magisk] fbirraque:
Seems I'm always the lucky one... 😂

Thanks for your input.
[Magisk] osm0sis:
You might be our canary in the coal mine. Things seem to roll out to you first. 🤔

Perhaps the end-of-month May DG updates aren't finished yet. 😶
[Magisk] beardedwonder:
I have done the upgrade, I was relying on Titanium Backup which was a massive mistake (I didn't realise how out of date it was). Luckily Swift Backup saved me.

I am now passing BASIC and DEVICE, until the print gets nuked by Google.
[Magisk] TestaMic:
Can anyone help? I am also facing this exact issue...
[Magisk] osm0sis:
Happy to report all was working fine once we tried the updated v9 autopif.sh generated custom.pif.json file out. 👌
[Magisk] TotallyAnxious:
But v10 is better than v9.
[Magisk] osm0sis:
My goal has always been to make sure there doesn't need to be a next version. 😛
[Magisk] TotallyAnxious:
I think you need to through AI at this problem. A lot of it. Like a couple tons of AI. Oh you're Canadian? So that's like 15 poutines worth of AI.
[Magisk] chiteroman:
Oh, transient error. I remember that in old (good) days, when Strong exploit was possible, I had the same issue in my vayu running LineageOS, I fixed it hooking all GMS processes function and not only unstable one.

If I'm not wrong, in persist process it checks for fingerprint.

I can give you the module with "global spoof" and try again. But it's weird, nobody reported an issue like that. 🤔

Maybe it's because that walleye fingerprint and actual one have something in common, compare them 😜
[Magisk] fbirraque:
I didn't change anything in my device settings, apps or root. Not even in my Banking Cards (Wallet).

The Poco F3 (alioth) is still Play Integrity certified as always but like previously happened to me in the past couple weeks when PIF were banned by Google the NFC Payments stopped working. I spend my whole Sunday troubleshooting if something like AdGuard was trapping DroidGuard internet access, recently Google updates, GPay Checker (APK), modules... but couldn't handle a solution.

I give up and will keep the physical wallet & card in my pocket tomorrow.

Let's see what Google will have for us this week and I pm you if the gms module be needed.

Thanks! 👍
[Magisk] austinjklim:
You're not the only one mate. Same F3 Alioth with Xiaomi.eu HyperOS 1.0.3.0.

Basic and Device integrity passed but unable to make payments via NFC/Gwallet. Usually if the fingerprint is banned, gwallet would pop out a red cross stating unable to make payment. But now there's seems to be a different "handshake", where no error / vibration comes out from the phone, but the payment terminal would just reject/not accept it.

Intially used the Xiaomi.eu module, then move on to PIF for more than 24 hours but payment is still a no-go. Currently rolled back to the Xiaomi.eu module and giving it a full 24 hours to see whether anything changes.

I also would like to apologize that i'm not really kept up with everything that was discussed here, so if i wrote anything wrong, do forgive me mate.
[Magisk] immortalwon:
I am gonna try this again, but the custom rom I did it with the lineage guide and results in broken os / apps crashing
[Magisk] fbirraque:
The NFC Payments broken seems to be solved for me now. GPay Checker (APK) uninstalled and a few hours later things are back to normal.

GPay Checker: monitor of Google Pay availability

Google Play Protect now triggers onto app (that's honor for me), but here nothing criminal. You can safely skip warning. There is non-zero theoretical possibility, that using this app increases risk of banning your personal fingerprint. There...

xdaforums.com

Thanks @osm0sis @chiteroman and all XDA users that help to troubleshoot it.
[Magisk] austinjklim:
I did not had the apk installed. But i'll try paying in abit to see whether it works or not. But so far, after multiple troubleshooting of clearing caches, reinstalling wallet etc, payment seems to not work.

Edit: Tried to pay but was unable. still having the same issue @chiteroman would you be able to help?
[Magisk] TestaMic:
I tried to sign crDroid, but i get the error in the inage. Can anyone help?
[Magisk] immortalwon:
A follow up to this, my compiled custom evox rom works fine, but when I sign / encrypt it, it doesn't boot at all. Any help?
[Magisk] martinsegura84:
How did you do the + Phonesky part? I've tried MinMicrog modules patching system, and then through Magisk. And it changed from CANNOT_BIND_BLAHBLAH BLAH (with fakestore) to "PLAY_STORE_NOT_FOUND Play Store app either not installed or not the official version" (with MinMicrog+playstore).

Xperia Z3 Compact + LineageOS18.1 (A11) + MinMicroG + Magisk 27 + Zygisk ON + PIF 15.9.9

I've read some comments about people getting it to work with Fakestore, but I have no idea how that is possible, @pndwal seems to know something about it. I've been using SN till 2 weeks ago, and all the bank apps that I use work perfectly, SN check passes with flying colors with Shamiko + USNF but I read that SN will stop working at the end of this year, so I'm trying to get ahead and make PI work to no bail, I've been reading and testing for 2 weeks, and still can't even get the test app to give me a result about basic integrity, etc. It always stops before checking to tell me something is wrong with Playstore o Play services. People are dealing with fingerprints, and I can't even get the test apps to tell me if my FP works yet.
[Magisk] EAZY BLACK:
minmicrog standard : works

minmicrog minimal : nope

minmicrog nogoolag : nope

minmicrog MinimalIAP/Phonesky : works

in safetynet, the droidguard runtime was in gms (microG)

but in play integrity , droidguard is in play store so it needs play store to function
[Magisk] martinsegura84:
That one is the one I tried, even with a clean flash, right after flashing the ROM, and still telling me "PLAY_STORE_NOT_FOUND Play Store app either not installed or not the official version". It is so frustrating, I don't know what I'm missing.
[Magisk] Dkpost3:
thanks
[Magisk] Bladius:
The Xiaomi.eu module does not work on root devices. Or rather, it works partially (because, for example, LP does not cause verification problems). Either way, a new version of Play Integrity Fix is needed
[Magisk] CZ.Kostra:
It works but doesn't hide root. You have to use next module to hide root.
[Magisk] InvisibleKiller:
Can someone please help me figure out what i need to do to pass device integrity again? I have been using the Playintegrity_fixv15.9.9 and Playcurl both flashed with Magisk 27.

Today, i lost my ability to use Google wallet and so has my wife on her phone. I have used the ClearGMS app to download a new fingerprint but it hasn't helped and it's been a good long while since i've had to dive into doing this ****. If someone could please advise me on the best way to approach this issue so i can pass the integrity checks and start using Google wallet again, i would be very grateful.
[Magisk] beeshyams:
This should help
[Magisk] markdewet:
Good day all,

Firstly, total noob here, so please forgive any mistakes made.

I installed LineageOS 21, and Magisk on a SM-G955F.

1: Google Wallet simply will not work (will not allow me to add a card, keeps telling me I have custom ROM), no matter which Magisk module I install. I tried Shamiko (Play Store and Wallet simply would not open with that module installed). I currently have the playintegrityfix v15.9.9 and playcurl v10.6 installed , along with AutoPIF Next (FP Downloader seems not to work).

I also have YASNAC installed and the CTS profile match always fails. I am not sure if this is the issue why Google Wallet will not work but I simply cannot get it to pass. Any assistance with this would be greatly appreciated.
[Magisk] InvisibleKiller:
Thank you for your quick reply. Ok, so i actually reflashed the ROM thinking it would help the situation, and as you might have guessed, it hasn't, lol.

So when i first boot the ROM i fail EVERYTHING in the integrity check. I imagine it may be something to do with me running CR Droid as my ROM instead of the stock ROM. Then i flashed Magisk 27 and the Playintegrity_fix_v15.9.9 as per the link you posted for me, and after reboot I managed to pass MEETS_BASIC_INTEGRITY but none of the others. I ran the command uname -r in Termux and i'm running the Quicksilver kernel and that's not blacklisted as far as i could determine viva the linked page in the instructions. I also noticed that i fail the CTS profile match in YASNAC.

Do you have any suggestions on what else i can do to fix this? I'm running a clean fresh install with none of my regular apps even installed yet.
[Magisk] casouzaj:
I don't know if my case would suit others here. I acknowledge that Sony is much more developers friendly than many OEMs out there. Anyway, I'm running official LineageOS 21 (A14) on an Xperia 1 II. Instead of Magisk, I use KerrnelSU (v11838, if it matters). Regarding Play Integrity, I use osmOsis' PlayIntegrityFix CI #224 and Shamiko v1.0.1. Zygisk Maphide v2.0 might play its part too. For them to run, I have ZygiskNext v1.0.5. Both basic and device integrity tests pass. Google Wallet (including contactless payments) and MS Intune Company Portal (and all the apps which run under its umbrella) work flawlessly too.

Just my 2 cents.
[Magisk] InvisibleKiller:
You know what mate, you're the second person to recommend KernelSU to me over Magisk this week. Do you have any tips on getting it set up or what i need to do if there's any special hoops to jump through?
[Magisk] casouzaj:
Which phone is yours?
[Magisk] InvisibleKiller:
Xiaomi 11 Lite 5G NE (Lisa)
[Magisk] beeshyams:
I am sorry, I don't have any idea for you.

Maybe wait for somebody knowledgeable?
[Magisk] wilsonhlacerda:
If any of Magisk flavor is working fine for you, stay with it. It is easier to install, update, mature.

Otherwise you can try APatch, that is kind of a middle term between Magisk and KSU. Just follow its official site/Github instructions.

And then you have KSU: also follow its official instructions, what may endup in you needing to compile your own Kernel on every install/update or trust one from someone else.
[Magisk] Bladius:
I have HMA to hide the root. However, the root module from Xiaomi.eu does not help. After rotating the device, verification does not work. Only Play Integrity Fix helps in this case, which currently requires a new version.
[Magisk] osm0sis:
Wait, what? Then why does PIF work when it only targets .gms.unstable?

My PIFork module disables the Xiaomi.eu injector (and all other known ROM injector) apps correctly, where chit's PIF has seemingly given up on it. Mine's also customizable so you can easily add more injector apps and files in the future as needed. Feel free to give it a try.
[Magisk] Captain_Throwback:
HMA does not hide root. It's literally "Hide My Applist", not 'Hide My Root'. The current version of Play Integrity Fix works perfectly fine, as does @osm0sis' Fork with any remaining working print. As was stated, you may be better off using the Fork if the potential exists for a conflict between the Xiaomi.eu module and PIF.
[Magisk] casouzaj:
Which kernel version does your current ROM have?
[Magisk] Nexus1725:
Xiaomi eu rom

Thoughts?
[Magisk] InvisibleKiller:
I'm running the Quicksilver 5.4.233 kernel.

So i actually got KernelSU working and i have root access now, which i'm delighted with. Now, if you could tell me how to pass the integrity checks so i can use Google wallet again, i'd be eternally grateful.
[Magisk] casouzaj:
Try my current setup, in my "2 cents" post, above .If it doesn't work for you, we could try other settings.
[Magisk] InvisibleKiller:
Well, that's the thing. I searched for, and installed all of the modules you mentioned, but I still can't pass device integrity. Could you maybe screenshot your exact modules and the relative settings you have for any of them that need settings changed please?
[Magisk] casouzaj:
I can think of two possibilities: 1 - check if your kernel string name is blacklisted; and/or 2 - check if your ROM is unsigned. If any of these two conditions are true, you won't be able to pass device integrity.
[Magisk] InvisibleKiller:
How do I check if the ROM is unsigned?

I checked the kernel string and nowhere on that list does it mention the quicksilver kernel. It does mention CR Droid, but I'm using the quicksilver kernel.
[Magisk] casouzaj:
Ask the ROM maintainer.
[Magisk] InvisibleKiller:
Ok. I'll do that now. I'll report back with the answer I get
[Magisk] osm0sis:
The list also says it's likely not complete and that you should let me know of any potentially new banned strings.

So I can check, give me the output of: uname -r

Just check directly yourself by showing us the output of: unzip -l /system/etc/security/otacerts.zip

If it says testkey, that's unsigned/testkey-signed and therefore banned.
[Magisk] InvisibleKiller:
Yep. It's a test key 😔
[Magisk] osm0sis:
That's definitely it then, but please also give me your uname output so I can check on quicksilver kernel. 👍
[Magisk] InvisibleKiller:
:/data/data/com.termux/files/home # uname -r

5.4.233-QuicksilveR-lisa-5260767f
[Magisk] dmitrydahmer:
I checked and I'm also having the same testkey.x509

is there something we can do about it?
[Magisk] sawdoctor:
Ask your ROM maintainer to rebuild it with signed keys unless you can compile it yourself. ATM i don't think there's any other option for custom roms
[Magisk] dmitrydahmer:
I have unofficial lineage 21 and the developer says it reports release keys, I don't quite understand what that means after all and I don't think he's gonna rebuild it:(
[Magisk] Bladius:
it just doesn't work everywhere. It only works partially (1/3) on a PixelOS phone. You were right with Xiaomi.eu and the module. Turning it off helped.
[Magisk] DylanAkp:
Do we know how PlayIntegrity works more or less ?

Is the play integrity response from Google is signed with a private key or something similar ?

This may be the dumbest question, but can't we proxy the stuff to another phone/fake Google server that could return STRONG etc
[Magisk] Nergal di Cuthah:
Kinda not it's a blackbox but there are things developers over the years have learned realized. I think @osm0sis talks about that in the FAQ thread.
[Magisk] DylanAkp:
Will definitly take a look at this FAQ, ty
[Magisk] InvisibleKiller:
I know that support for my device has been abandoned, at least officially. I may be able to compile it myself if I can learn how to do that. First time for everything I guess...
[Magisk] HippoMan:
Proxying to another phone (if that even turns out to be do-able) would be no different from the point of view of Googlefrinchian Play-Integrity checking than using the fingerprint from another phone via Play Integrity Fix or Play Integrity Next.

In both cases, your phone would be set up to to resemble a different phone with regard to Play Integrity checks.
[Magisk] DylanAkp:
EDIT:

This may still be useful in case a ROM needs to change to another maintainer using his own keys

Found this commit from Jake Weinstein that seems to be complete

https://gerrit.aospa.co/c/AOSPA/android_frameworks_base/+/35916