fix(googlenews): spoof the real Google News signing cert (fresh-install sign-in loop)#45
Open
docbt wants to merge 1 commit into
Open
fix(googlenews): spoof the real Google News signing cert (fresh-install sign-in loop)#45docbt wants to merge 1 commit into
docbt wants to merge 1 commit into
Conversation
The GmsCore patch reported SPOOFED_PACKAGE_SIGNATURE 24bb24c05e47e0aefa68a58a766179d9b613a600, which is NOT the certificate that signs com.google.android.apps.magazines. Extracted the actual signer from the shipped APK's v2 signing block: subject = O=Google Inc., CN=Android (Google "Android" master cert, 2008) cert SHA-1 = 38918a453d07199354f8b19af05ec6562ced5788 The old value matches no representation of the real cert (cert SHA-1, MD5, or pubkey SHA-1) — it was wrong, likely copied from another app's patch. MicroG RE reports this signature to Google's auth backend so a renamed install keeps the original package identity. A wrong signature makes the backend reject the token grant *after* a successful login, so the callback never returns and sign-in loops — on a fresh install only, because an update reuses the already-cached token. Using the app's real signing cert fixes the fresh-install sign-in loop. Also reverts the earlier aang-events-action change, whose premise (a MicroG-RE service gap) was disproven by this finding; that action is transformed again as before, isolating the signature as the only change. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J6PqqntTLoAeRvUnLqj659
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Root cause (directly verifiable — not a control-flow hypothesis)
Der GmsCore-Patch spooft
SPOOFED_PACKAGE_SIGNATURE = 24bb24c05e47e0aefa68a58a766179d9b613a600. Das ist nicht das Zertifikat, mit dem Google News signiert ist.Aus dem v2-Signaturblock der ausgelieferten APK extrahiert:
O=Google Inc., CN=Android(Google-„Android"-Master-Cert, 2008)38918a453d07199354f8b19af05ec6562ced5788Der alte Wert entspricht keiner Darstellung des echten Certs (Cert-SHA-1, MD5, Pubkey-SHA-1) — er war schlicht falsch, vermutlich aus einem anderen Patch kopiert.
Warum es das Symptom erklärt: MicroG RE meldet diese Signatur an Googles Auth-Backend, damit die umbenannte Installation die Original-Identität behält. Bei falscher Signatur lehnt das Backend den Token-Grant nach erfolgreichem Login ab → Rückmeldung kommt nie zurück → Login-Schleife. Nur bei Fresh-Install, da ein Update den gecachten Token wiederverwendet.
Enthält außerdem das Zurücksetzen der aang-Events-Änderung (deren Prämisse durch diesen Befund widerlegt ist), damit die Signatur die einzige getestete Variable ist.
patches-pr) ladenIch kann den Login-Flow hier nicht selbst ausführen (kein Gerät/MicroG). Der Wert ist aber nachweislich das echte Signing-Cert der App — im Gegensatz zum alten falschen Wert. Ob es die Schleife final behebt, zeigt dein Fresh-Install-Test.
Generated by Claude Code