oxmc
3007839721
- VesperProfileBinderService + main_android.cpp: real Android AIDL Binder service backing IVesperProfileService, wired into Android.bp's srcs (previously declared but never implemented). - SignatureVerifier: real CMS verification on Android too, via a vendored static OpenSSL (see third_party/openssl-android/README.md) since BoringSSL has no CMS/PKCS#7 support. - ProfileStore: Android-appropriate data paths. - Every payload handler split into src/platform/<Name>.h (shared contract) + src/platform/linux/<Name>.cpp + src/platform/android/<Name>.cpp, so the build system picks the platform instead of #ifdef. Android side is an honest "not implemented yet" stub per handler, logged rather than silent. - content-cache payload + handler: PawletOS-fork-specific, talks to PawletCache/pawletcache-server. Not part of vesperprofiled's own upstream default.
Vendored OpenSSL (Android, static, vesperprofiled-only)
AOSP's system libcrypto/libssl is BoringSSL, which has no CMS/PKCS#7
support. Rather than touch the platform's crypto stack (used by Keystore,
the TLS stack, other HALs — swapping it breaks far more than it fixes),
vesperprofiled statically links its own copy of real OpenSSL, scoped to
just this one binary. Nothing else on the system links against it or even
knows it's there.
This directory holds the prebuilt static libs + headers and the Soong
modules that expose them. The lib/*/ and include/ directories are
empty placeholders — populate them by cross-compiling OpenSSL yourself
(steps below) before m vesperprofiled will link on Android. Nothing here
fabricates or ships a prebuilt binary sight-unseen.
Building OpenSSL for Android
Needs the Android NDK (r26+) on your PATH as $ANDROID_NDK_ROOT, and
OpenSSL source (3.x recommended — CMS support is stable there).
git clone --branch openssl-3.2 --depth 1 https://github.com/openssl/openssl.git
cd openssl
export ANDROID_NDK_ROOT=/path/to/android-ndk
export PATH="$ANDROID_NDK_ROOT/toolchains/llvm/prebuilt/linux-x86_64/bin:$PATH"
# Repeat per ABI. android-arm64 shown; swap target/API for the others.
for target in android-arm64 android-arm android-x86_64 android-x86; do
case $target in
android-arm64) abi=arm64-v8a ;;
android-arm) abi=armeabi-v7a ;;
android-x86_64) abi=x86_64 ;;
android-x86) abi=x86 ;;
esac
./Configure "$target" -D__ANDROID_API__=26 no-shared no-tests \
--prefix="$(pwd)/build-$abi"
make clean
make -j"$(nproc)"
make install_sw
mkdir -p "../lib/$abi"
cp "build-$abi/lib/libcrypto.a" "../lib/$abi/"
cp "build-$abi/lib/libssl.a" "../lib/$abi/"
done
# Headers are identical across ABIs — copy from any one build.
cp -r build-arm64-v8a/include/openssl ../include/
no-shared is what makes these static (.a) — deliberate, so nothing
depends on an OpenSSL .so being present on-device at runtime. no-tests
just skips building OpenSSL's own test suite to save time.
Verifying
third_party/openssl-android/
├── include/openssl/*.h (same for every ABI)
└── lib/
├── arm64-v8a/{libcrypto,libssl}.a
├── armeabi-v7a/{libcrypto,libssl}.a
├── x86_64/{libcrypto,libssl}.a
└── x86/{libcrypto,libssl}.a
Once populated, m vesperprofiled picks these up via Android.bp in this
directory — see libcrypto_vesper_static / libssl_vesper_static /
vesperprofiled_openssl_headers, referenced from
vesperprofiled/Android.bp's Android static_libs.
Updating
OpenSSL ships security fixes regularly — treat these .a files as a
dependency you're responsible for rebuilding on new releases, same as any
other vendored library. Nothing here auto-updates them.