Harden Kitsune release and System Mode lifecycle

.github/actions/setup/action.yml

@@ -4,26 +4,26 @@ runs:
   using: "composite"
   steps:
     - name: Set up JDK 17
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
       with:
         distribution: "temurin"
         java-version: "17"
 
     - name: Set up Python 3
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
-        python-version: "3.x"
+        python-version: "3.13"
 
     - name: Set up sccache
-      uses: hendrikmuhs/ccache-action@v1.2
+      uses: hendrikmuhs/ccache-action@d62db5f07c26379fc4b4e0916f098a92573c3b03 # v1.2.23
       with:
         variant: sccache
         key: ${{ runner.os }}-${{ github.sha }}
         restore-keys: ${{ runner.os }}
         max-size: 10000M
 
     - name: Cache Gradle dependencies
-      uses: actions/cache@v4
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: |
           ~/.gradle/caches
@@ -33,7 +33,7 @@ runs:
         restore-keys: ${{ runner.os }}-gradle-
 
     - name: Cache build cache
-      uses: actions/cache@v4
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: |
           ~/.gradle/caches/build-cache-*

.github/workflows/android.yml

@@ -8,12 +8,6 @@ on:
       - kitsune
       - next-system
   workflow_dispatch:
-    inputs:
-      publish_canary:
-        description: Publish the tested release APKs as an experimental canary
-        required: false
-        type: boolean
-        default: false
 
 permissions:
   contents: read
@@ -28,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -72,35 +66,71 @@ jobs:
       SCCACHE_DIRECT: false
     steps:
       - name: Check out
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: recursive
           fetch-depth: 0
 
       - name: Set up build environment
         uses: ./.github/actions/setup
 
+      - name: Create isolated ephemeral release signer
+        shell: bash
+        run: |
+          set -euo pipefail
+          umask 077
+          signing_pass="$(openssl rand -hex 24)"
+          signing_store="$RUNNER_TEMP/kitsune-ci-release.jks"
+          signing_config="$RUNNER_TEMP/kitsune-ci-release.prop"
+          keytool -genkeypair -noprompt \
+            -keystore "$signing_store" \
+            -storepass "$signing_pass" \
+            -keypass "$signing_pass" \
+            -alias kitsune-ci \
+            -keyalg RSA \
+            -keysize 4096 \
+            -validity 2 \
+            -dname "CN=Ephemeral Kitsune CI"
+          {
+            printf 'keyStore=%s\n' "$signing_store"
+            printf 'keyStorePass=%s\n' "$signing_pass"
+            printf 'keyAlias=kitsune-ci\n'
+            printf 'keyPass=%s\n' "$signing_pass"
+          } > "$signing_config"
+          printf 'RELEASE_CONFIG=%s\n' "$signing_config" >> "$GITHUB_ENV"
+
       - name: Build release
-        run: ./build.py -vr all
+        run: ./build.py -vr -c "$RELEASE_CONFIG" all
 
       - name: Build debug
         run: ./build.py -v all
 
-      - name: Run JVM unit-test tasks
+      - name: Run JVM unit tests and Android lint
         run: >-
           ./gradlew
           :app:testDebugUnitTest
-          :app:shared:testDebugUnitTest
-          :native:testDebugUnitTest
-          :stub:testDebugUnitTest
-          -PconfigPath="$PWD/config.prop"
+          :app:lintDebug
+          :app:shared:lintDebug
+          :stub:lintDebug
+          -PconfigPath="$RUNNER_TEMP/no-config.prop"
+
+      - name: Verify APK signer and 16 KiB ELF/ZIP contracts
+        run: >-
+          python3 -m tools.security_lab.artifact_contract
+          --apksigner "$ANDROID_SDK_ROOT/build-tools/34.0.0/apksigner"
+          --apk out/app-debug.apk
+          --apk out/stub-debug.apk
+          --apk out/app-release.apk
+          --apk out/stub-release.apk
+          --reject-certificate a9342f305e5d7ecc0245f86c931226267389358c48139f5d7ed6a80cd4329629
+          --output out/artifact-contract.json
 
       - name: Stop Gradle daemon
         if: always()
         run: ./gradlew --stop
 
       - name: Upload build artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ github.sha }}
           path: out
@@ -109,7 +139,7 @@ jobs:
           retention-days: 14
 
       - name: Upload mapping and native debug symbols
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ github.sha }}-symbols
           path: app/build/outputs
@@ -128,17 +158,17 @@ jobs:
 
     steps:
       - name: Check out
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Set up Python 3
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: 3.x
+          python-version: "3.13"
 
       - name: Download build artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: ${{ github.sha }}
           path: out
@@ -170,44 +200,3 @@ jobs:
           test "$STATIC_RESULT" = success
           test "$BUILD_RESULT" = success
           test "$EMULATOR_RESULT" = success
-
-  publish-canary:
-    name: Publish tested canary
-    if: ${{ github.event_name == 'workflow_dispatch' && inputs.publish_canary }}
-    runs-on: ubuntu-latest
-    needs:
-      - build
-      - product-gate
-    permissions:
-      contents: write
-    steps:
-      - name: Download tested artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: ${{ github.sha }}
-          path: out
-
-      - name: Compute canary tag
-        id: version
-        run: echo "tag=kitsune-canary-${GITHUB_SHA::8}" >> "$GITHUB_OUTPUT"
-
-      - name: Publish experimental canary
-        uses: softprops/action-gh-release@v2
-        with:
-          tag_name: ${{ steps.version.outputs.tag }}
-          target_commitish: ${{ github.sha }}
-          name: KitsuneMagisk ${{ steps.version.outputs.tag }}
-          prerelease: true
-          fail_on_unmatched_files: true
-          body: |
-            Experimental KitsuneMagisk canary built from `${{ github.sha }}`.
-
-            This artifact passed source checks, debug/release compilation, JVM test tasks,
-            and the existing API 23/29/35 normal-Magisk AVD smoke matrix. That matrix does
-            not yet qualify persistent Direct-System/System Mode on commercial emulators.
-
-            `31.0-kitsune` is an inherited compatibility value, not a claim that this tree
-            contains a newer Magisk core than official Magisk.
-          files: |
-            out/app-release.apk
-            out/stub-release.apk

.github/workflows/security-lab.yml

@@ -8,8 +8,15 @@ on:
       - ".gitmodules"
       - "**/*.gradle.kts"
       - "**/Cargo.toml"
+      - "app/shared/src/main/java/com/topjohnwu/magisk/utils/APKInstall.java"
+      - "app/src/main/java/com/topjohnwu/magisk/core/Info.kt"
+      - "app/src/main/java/com/topjohnwu/magisk/core/JobService.kt"
+      - "app/src/main/java/com/topjohnwu/magisk/core/download/**"
       - "app/src/main/java/com/topjohnwu/magisk/core/di/Networking.kt"
       - "app/src/main/java/com/topjohnwu/magisk/core/repository/UpdateCheckResult.kt"
+      - "app/src/main/java/com/topjohnwu/magisk/core/tasks/HideAPK.kt"
+      - "app/src/main/java/com/topjohnwu/magisk/core/tasks/MagiskInstaller.kt"
+      - "app/src/main/res/raw/manager.sh"
       - "app/src/test/java/com/topjohnwu/magisk/core/repository/UpdateChannelPolicyTest.kt"
       - "app/gradle/libs.versions.toml"
       - "build.py"
@@ -19,12 +26,17 @@ on:
       - "native/src/Application.mk"
       - "native/src/Cargo.lock"
       - "native/src/boot/**"
+      - "native/src/core/db.cpp"
+      - "native/src/core/db_migrations.hpp"
+      - "native/src/core/package.cpp"
+      - "native/src/core/su/**"
       - "native/src/external/**"
       - "native/src/sepolicy/**"
       - "scripts/avd_test.sh"
       - "scripts/security_avd_test.sh"
       - "scripts/util_functions.sh"
       - "security/**"
+      - "stub/src/main/java/com/topjohnwu/magisk/**"
       - "tests/security_lab/**"
       - "tools/security_lab/**"
       - "tools/termux-elf-cleaner"
@@ -46,7 +58,7 @@ jobs:
     timeout-minutes: 90
     steps:
       - name: Check out complete fork history
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           submodules: recursive
@@ -90,7 +102,7 @@ jobs:
         run: >-
           ./gradlew :app:dependencies
           --configuration debugRuntimeClasspath
-          -PconfigPath="$PWD/config.prop"
+          -PconfigPath="$RUNNER_TEMP/no-config.prop"
           > "$RUNNER_TEMP/gradle-runtime.txt"
 
       - name: Verify dependency license evidence
@@ -111,11 +123,12 @@ jobs:
       - name: Verify package-signature and hidden-manager recovery contract
         run: python3 -m tools.security_lab.signature_contract --check
 
-      - name: Run host security/property/fault tests
+      - name: Run scheduled host security/property/fault tests
+        if: ${{ github.event_name != 'pull_request' }}
         run: python3 -m unittest discover -s tests -p 'test_*.py' -v
 
       - name: Upload upstream and submodule evidence
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: upstream-security-ledger-${{ github.sha }}
           path: ${{ runner.temp }}/submodule-availability.json
@@ -124,11 +137,12 @@ jobs:
 
   sanitized-device-corpus:
     name: UBSan Android parser corpus
+    if: ${{ github.event_name != 'pull_request' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
       - name: Check out
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           submodules: recursive
@@ -153,7 +167,7 @@ jobs:
 
       - name: Upload architecture-specific corpus evidence
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: security-corpus-${{ github.sha }}
           path: out/security-corpus-*.json

.gitignore

@@ -16,6 +16,7 @@ native/out
 /.idea
 /build
 /captures
+.DS_Store
 
 # Python host tooling and tests
 __pycache__/