<danielrf[m]>
Another option (or something you could do in addition) would be to make a "robotnix module"
<danielrf[m]>
Kindof like how you can include nixos modules from flakes into your nixos system, we ought to be able to do the same with robotnix
<danielrf[m]>
So your pyxis module could use `mkIf` to check if the device = "pyxis" and if flavor = "lineageos"
<danielrf[m]>
then apply the `source.dirs` arguments automatically
<danielrf[m]>
Then for an end-user, they could have their own robotnix configuration, and just including your module for pyxis support
<danielrf[m]>
It might require me to add an "imports = []" configuration option like is in NixOS
<matthewcroughan_>
Too cool :D
<danielrf[m]>
that github link you sent if 404 for me
<matthewcroughan_>
yeah it doesn't exist, it was just an idea
<danielrf[m]>
ah, sure thing
<danielrf[m]>
Thinking about it a bit more, using external "robotnix modules" would seem to be the solution for unofficial devices / additional flavors that would be supported outside the main project
<samueldr>
+1 for the concept
<samueldr>
also allows users to distribute something out of tree
<samueldr>
e.g. if someone was to package magisk and you don't want it :)
<danielrf[m]>
yes, that was one example I had in mind
<matthewcroughan_>
danielrf[m]: So, next step is implementing the updater right? :D
<matthewcroughan_>
for lineage
<matthewcroughan_>
Also, how would I go about building GrapheneOS for this device?
<matthewcroughan_>
is GrapheneOS more like Vanilla? If a device supports Vanilla, will it support GrapheneOS?
<danielrf[m]>
Only pixels are supported on GrapheneOS
<danielrf[m]>
They do a bunch of device-specific security hardening in (for example) the kernel
<danielrf[m]>
At best, we could build a "generic" target that could work on non-pixel phones, but as mentioned at that link, that's only intended for testing/development
<danielrf[m]>
But yes, GrapheneOS is closer to vanilla with respect to some things like AVB support
<danielrf[m]>
LineageOS tends to disable vanilla AOSP security features while GrapheneOS retains them
<matthewcroughan_>
danielrf[m]: wasn't there a way with robotnix to embed apps in the image without apks?
<matthewcroughan_>
like compiling them from fdroid source?
<danielrf[m]>
The hard part is just getting them to build inside Nix
<matthewcroughan_>
why would henri set the apv.buildID for Bacon? What would it be used for here?
<matthewcroughan_>
That's the Oneplus One, I can't think of it being used for anything.
<danielrf[m]>
yeah, I wouldn't set apv.buildID for that
<danielrf[m]>
it's not necessary
<samueldr>
it's possible camera apps *may* need heightened privileges
<samueldr>
at least, in the ol' time of my asus-z00t, their camera app required to be privileged
<samueldr>
(but it didn't use the fancy camera2 API, which were new at the time... it instead had its own custom API for its weird-but-more-featured camera)
<matthewcroughan_>
I didn't set ccache.enable = true, that means it's gonna have to recompile android from scratch just to add microg and fdroid, right? :D
<danielrf[m]>
Doesn't look to be privileged Google's upstream factory image: ./product/app/GoogleCamera/GoogleCamera.apk
<danielrf[m]>
Otherwise it would be at product/priv-app/GoogleCamera/GoogleCamera.apk
<danielrf[m]>
matthewcroughan_: yes
<danielrf[m]>
even with ccache it will still take a while for each rebuild unfortunately
<matthewcroughan_>
so if I install google play services, you think it'll work?
<danielrf[m]>
beats me!
<matthewcroughan_>
danielrf[m]: So am I supposed to relock the bootloader and stuff when signing releases?
<matthewcroughan_>
if I want it to be "secure"
<samueldr>
unless you find documentation stating otherwise, OEMs other than google assume that locked bootloader == OEM's own keys only
<samueldr>
so what would happen is that when booting, the bootloader would check against the keys (the OEM's) and find the signed (or unsigned) image doesn't match
<samueldr>
stopping
<danielrf[m]>
also not sure what benefits relocking the bootloader provides if avb/dm-verity is disabled like it is in LineageOS
<danielrf[m]>
Just pushed grapheneos-2021.03.20.16 tag, based on upstream GrapheneOS 2021.03.19.14
<danielrf[m]>
Tested working on my crosshatch and sunfish
<danielrf[m]>
The one NixOS test we have in robotnix for the attestation-server actually caught an issue :)