From 66618bf322c08248e166b7fbf036b63c8203a32a Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 18 Jul 2026 05:57:11 +0000 Subject: [PATCH] fix(googlenews): spoof the real Google News signing certificate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The GmsCore patch reported SPOOFED_PACKAGE_SIGNATURE 24bb24c05e47e0aefa68a58a766179d9b613a600, which is NOT the certificate that signs com.google.android.apps.magazines. Extracted the actual signer from the shipped APK's v2 signing block: subject = O=Google Inc., CN=Android (Google "Android" master cert, 2008) cert SHA-1 = 38918a453d07199354f8b19af05ec6562ced5788 The old value matches no representation of the real cert (cert SHA-1, MD5, or pubkey SHA-1) — it was wrong, likely copied from another app's patch. MicroG RE reports this signature to Google's auth backend so a renamed install keeps the original package identity. A wrong signature makes the backend reject the token grant *after* a successful login, so the callback never returns and sign-in loops — on a fresh install only, because an update reuses the already-cached token. Using the app's real signing cert fixes the fresh-install sign-in loop. Also reverts the earlier aang-events-action change, whose premise (a MicroG-RE service gap) was disproven by this finding; that action is transformed again as before, isolating the signature as the only change. Co-Authored-By: Claude Opus 4.6 Claude-Session: https://claude.ai/code/session_01J6PqqntTLoAeRvUnLqj659 --- .../googlenews/gms/GmsCoreSupportPatch.kt | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/patches/src/main/kotlin/app/docbt/patched_up/googlenews/gms/GmsCoreSupportPatch.kt b/patches/src/main/kotlin/app/docbt/patched_up/googlenews/gms/GmsCoreSupportPatch.kt index 82938d2..36836ae 100644 --- a/patches/src/main/kotlin/app/docbt/patched_up/googlenews/gms/GmsCoreSupportPatch.kt +++ b/patches/src/main/kotlin/app/docbt/patched_up/googlenews/gms/GmsCoreSupportPatch.kt @@ -30,8 +30,12 @@ private val COMPAT = Compatibility( ), ) -// SHA-1 of Google's release signing certificate (shared across Google apps). -private const val SPOOFED_PACKAGE_SIGNATURE = "24bb24c05e47e0aefa68a58a766179d9b613a600" +// SHA-1 of the certificate that actually signs Google News (com.google.android.apps.magazines): +// O=Google Inc., CN=Android — the Google "Android" master release cert. Verified against the +// v2 APK signing block of the shipped APK. MicroG RE reports this signature to Google's auth +// backend so a renamed install keeps the original package identity; a wrong value makes the +// backend reject the token grant after login (fresh-install sign-in loop). +private const val SPOOFED_PACKAGE_SIGNATURE = "38918a453d07199354f8b19af05ec6562ced5788" private val gmsCoreSupportResourcePatch = resourcePatch { execute { @@ -111,13 +115,7 @@ private val ACTIONS = setOf( "com.google.android.gms.asterism.service.START", "com.google.android.gms.audiomodem.service.AudioModemService.START", "com.google.android.gms.audit.service.START", - // NOTE: com.google.android.gms.auth.aang.events.services.START is deliberately - // NOT transformed. The AANG events service (bound via getStartServiceAction() in - // the aang auth client) has no counterpart in MicroG RE, so rewriting it to - // "app.revanced.*" points the bind at a non-existent service and breaks the - // fresh-install account-add return flow (sign-in loops after login). Leaving it - // as "com.google.*" restores the behaviour of the first working releases. - // See regression from commit 7342da2. + "com.google.android.gms.auth.aang.events.services.START", "com.google.android.gms.auth.account.authapi.START", "com.google.android.gms.auth.account.authenticator.auto.service.START", "com.google.android.gms.auth.account.authenticator.chromeos.START",