oxmc
a86ad3298e
This checkout is PawletOS's fork (git.oxmc.me/PawletOS/profiled), so its own identity should read PawletOS, not VesperOS: binary/package name, AIDL package+interface (me.oxmc.vesperos.profile -> os.pawlet.profiled), D-Bus service/object/error names, C++ namespace (vesperos::profile -> pawletos::profile), sepolicy types, data paths (/data/system/vesperos -> /data/system/pawletos, /etc/vesperprofiled -> /etc/pawletprofiled), the vendored OpenSSL static-lib module names, and the ZTE protocol string. Also drops generated build output (obj-x86_64-linux-gnu/, debian/.debhelper, debian staging dir, debhelper log/substvars files) that had been committed by mistake, and adds a .gitignore so they don't come back. The stock/upstream vesperprofiled at git.oxmc.me/VesperOS/vesperprofiled is untouched -- this commit only goes to the pawletos remote.
Vendored OpenSSL (Android, static, pawletprofiled-only)
AOSP's system libcrypto/libssl is BoringSSL, which has no CMS/PKCS#7
support. Rather than touch the platform's crypto stack (used by Keystore,
the TLS stack, other HALs — swapping it breaks far more than it fixes),
pawletprofiled statically links its own copy of real OpenSSL, scoped to
just this one binary. Nothing else on the system links against it or even
knows it's there.
This directory holds the prebuilt static libs + headers and the Soong
modules that expose them. The lib/*/ and include/ directories are
empty placeholders — populate them by cross-compiling OpenSSL yourself
(steps below) before m pawletprofiled will link on Android. Nothing here
fabricates or ships a prebuilt binary sight-unseen.
Building OpenSSL for Android
Needs the Android NDK (r26+) on your PATH as $ANDROID_NDK_ROOT, and
OpenSSL source (3.x recommended — CMS support is stable there).
git clone --branch openssl-3.2 --depth 1 https://github.com/openssl/openssl.git
cd openssl
export ANDROID_NDK_ROOT=/path/to/android-ndk
export PATH="$ANDROID_NDK_ROOT/toolchains/llvm/prebuilt/linux-x86_64/bin:$PATH"
# Repeat per ABI. android-arm64 shown; swap target/API for the others.
for target in android-arm64 android-arm android-x86_64 android-x86; do
case $target in
android-arm64) abi=arm64-v8a ;;
android-arm) abi=armeabi-v7a ;;
android-x86_64) abi=x86_64 ;;
android-x86) abi=x86 ;;
esac
./Configure "$target" -D__ANDROID_API__=26 no-shared no-tests \
--prefix="$(pwd)/build-$abi"
make clean
make -j"$(nproc)"
make install_sw
mkdir -p "../lib/$abi"
cp "build-$abi/lib/libcrypto.a" "../lib/$abi/"
cp "build-$abi/lib/libssl.a" "../lib/$abi/"
done
# Headers are identical across ABIs — copy from any one build.
cp -r build-arm64-v8a/include/openssl ../include/
no-shared is what makes these static (.a) — deliberate, so nothing
depends on an OpenSSL .so being present on-device at runtime. no-tests
just skips building OpenSSL's own test suite to save time.
Verifying
third_party/openssl-android/
├── include/openssl/*.h (same for every ABI)
└── lib/
├── arm64-v8a/{libcrypto,libssl}.a
├── armeabi-v7a/{libcrypto,libssl}.a
├── x86_64/{libcrypto,libssl}.a
└── x86/{libcrypto,libssl}.a
Once populated, m pawletprofiled picks these up via Android.bp in this
directory — see libcrypto_pawlet_static / libssl_pawlet_static /
pawletprofiled_openssl_headers, referenced from
pawletprofiled/Android.bp's Android static_libs.
Updating
OpenSSL ships security fixes regularly — treat these .a files as a
dependency you're responsible for rebuilding on new releases, same as any
other vendored library. Nothing here auto-updates them.