From f9038420542efb683b6897c1d7430f4c025bf892 Mon Sep 17 00:00:00 2001 From: oxmc7769 Date: Sat, 11 Jul 2026 16:33:48 -0700 Subject: [PATCH] Add bg-upd sepolicy dir and a security patch date variable MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit bg-upd's own sepolicy domain (packages/apps/BgUpd/sepolicy, in its own repo) now gets pulled into BOARD_SEPOLICY_DIRS unconditionally alongside its PRODUCT_PACKAGES entry, since it's a core PawletOS system app. PAWLET_SECURITY_PATCH/PLATFORM_SECURITY_PATCH didn't exist anywhere before — device previously just inherited whatever default date came from upstream. Paired with PawletOS-Build/docs/security-patch-process.md and scripts/check_security_patch.py. --- config/common.mk | 4 ++++ config/version.mk | 11 +++++++++++ 2 files changed, 15 insertions(+) diff --git a/config/common.mk b/config/common.mk index 51feb85..f175568 100644 --- a/config/common.mk +++ b/config/common.mk @@ -94,6 +94,10 @@ PRODUCT_PACKAGES += \ PawletSetupWizard \ BgUpd +# bg-upd's own sepolicy domain — lives in its own repo (packages/apps/BgUpd/sepolicy), +# included unconditionally since it's a core PawletOS system app, not an optional one. +BOARD_SEPOLICY_DIRS += packages/apps/BgUpd/sepolicy + # --------------------------------------------------------------------------- # Day-one default WebView provider (com.android.webview / "chromium"), so the # device boots with a working WebView before bg-upd's first check ever runs. diff --git a/config/version.mk b/config/version.mk index 6b08e40..de655f3 100644 --- a/config/version.mk +++ b/config/version.mk @@ -42,6 +42,17 @@ PAWLET_VERSION := $(PAWLET_MAJOR_VERSION).$(PAWLET_MINOR_VERSION)-$(PAWLET_VERSI # Short display version (major-suffix, like LineageOS 23-) PAWLET_DISPLAY_VERSION := $(PAWLET_MAJOR_VERSION)-$(PAWLET_VERSION_SUFFIX) +# --------------------------------------------------------------------------- +# Security patch level +# --------------------------------------------------------------------------- +# Bumped manually whenever a monthly AOSP security bulletin's patches are +# actually backported into the tree — this is a record of work done, not +# something CI infers automatically. See PawletOS-Build/docs/security-patch-process.md +# and PawletOS-Build/scripts/check_security_patch.py (run the latter to see +# how far behind this date is against the latest published AOSP bulletin). +PAWLET_SECURITY_PATCH := 2026-07-05 +PLATFORM_SECURITY_PATCH := $(PAWLET_SECURITY_PATCH) + # --------------------------------------------------------------------------- # System properties written into /product/build.prop # ---------------------------------------------------------------------------