From 07b8bc831a254a2a83747b79ce0d1358f1159306 Mon Sep 17 00:00:00 2001 From: 0cwa Date: Mon, 21 Sep 2026 22:11:33 +0000 Subject: [PATCH 1/8] config: default to official Magisk --- src/config_schema.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/config_schema.sh b/src/config_schema.sh index f1bcebcf..10584759 100644 --- a/src/config_schema.sh +++ b/src/config_schema.sh @@ -77,7 +77,7 @@ _config_schema_define magisk_preinit MAGISK_PREINIT build string \ _config_schema_define update_channel 'GRAPHENEOS[UPDATE_CHANNEL]' device string \ GRAPHENEOS array UPDATE_CHANNEL GRAPHENEOS_UPDATE_CHANNEL '' true existing-or-default _config_schema_define magisk_repository 'MAGISK[REPOSITORY]' device string \ - MAGISK array REPOSITORY '' pixincreate/Magisk false caller-or-default + MAGISK array REPOSITORY '' topjohnwu/Magisk false caller-or-default _config_schema_define afsr 'ADDITIONALS[AFSR]' build boolean \ ADDITIONALS array AFSR ADDITIONALS_AFSR true true caller-or-existing-or-default _config_schema_define alterinstaller 'ADDITIONALS[ALTERINSTALLER]' build boolean \ From ccd252a19e628ce297e576e6fffecbae1780ac20 Mon Sep 17 00:00:00 2001 From: 0cwa Date: Mon, 21 Sep 2026 22:11:36 +0000 Subject: [PATCH 2/8] docs: show official Magisk repository default From 3148e4372082063560b8924e4b335cda374568a7 Mon Sep 17 00:00:00 2001 From: 0cwa Date: Mon, 21 Sep 2026 22:12:09 +0000 Subject: [PATCH 3/8] build: bind rooted identity to Magisk repository --- src/rom_profiles.sh | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/rom_profiles.sh b/src/rom_profiles.sh index 44c1cc7e..3ed3d523 100644 --- a/src/rom_profiles.sh +++ b/src/rom_profiles.sh @@ -150,6 +150,7 @@ function module_selection_fingerprint() { local lock_digest="disabled" local profile_digest="disabled" local magisk_preinit="disabled" + local magisk_repository="disabled" local boot_animation_digest="disabled" local entry local -a module_entries=( @@ -184,10 +185,15 @@ function module_selection_fingerprint() { if [[ "${ADDITIONALS[ROOT]}" == 'true' ]]; then magisk_preinit="${MAGISK[PREINIT]}" + magisk_repository="${MAGISK[REPOSITORY]}" if [[ ! "${magisk_preinit}" =~ ^[A-Za-z0-9._-]+$ ]]; then echo "Error: rooted profiles require a canonical Magisk preinit device." >&2 return 1 fi + if [[ ! "${magisk_repository}" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]; then + echo "Error: rooted profiles require a canonical Magisk repository." >&2 + return 1 + fi fi if [[ "${ADDITIONALS[FDROID_PRIVILEGED_EXTENSION]}" == 'true' ]]; then @@ -207,6 +213,7 @@ function module_selection_fingerprint() { SELECTION_OUTPUT_SCOPE="${OUTPUT_SCOPE}" SELECTION_ROOT="${ADDITIONALS[ROOT]}" SELECTION_MAGISK_PREINIT="${magisk_preinit}" + SELECTION_MAGISK_REPOSITORY="${magisk_repository}" SELECTION_DEBUG="${ADDITIONALS[DEBUG]}" SELECTION_COMPATIBLE_SEPOLICY="${ADDITIONALS[MAS_COMPATIBLE_SEPOLICY]}" SELECTION_CLEAR_VBMETA_FLAGS="${ROM_PROFILE[CLEAR_VBMETA_FLAGS]}" From a3c6e637e6fa70a4e6e3b603aec20f9df12023b9 Mon Sep 17 00:00:00 2001 From: 0cwa Date: Mon, 21 Sep 2026 22:12:12 +0000 Subject: [PATCH 4/8] build: include Magisk source in rooted variant identity --- src/ci/selection_variant.sh | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/ci/selection_variant.sh b/src/ci/selection_variant.sh index 6f994cbf..df710817 100755 --- a/src/ci/selection_variant.sh +++ b/src/ci/selection_variant.sh @@ -16,6 +16,7 @@ function selection_variant_manifest() { SELECTION_OUTPUT_SCOPE SELECTION_ROOT SELECTION_MAGISK_PREINIT + SELECTION_MAGISK_REPOSITORY SELECTION_DEBUG SELECTION_COMPATIBLE_SEPOLICY SELECTION_CLEAR_VBMETA_FLAGS @@ -97,6 +98,14 @@ function selection_variant_manifest() { "module.msd=${SELECTION_MODULE_MSD}" \ "module.oemunlockonboot=${SELECTION_MODULE_OEMUNLOCKONBOOT}" + if [[ "${SELECTION_ROOT}" == 'true' ]]; then + if [[ ! "${SELECTION_MAGISK_REPOSITORY}" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]; then + echo "Error: rooted selection identity has an invalid Magisk repository." >&2 + return 1 + fi + printf '%s\n' "magisk_repository=${SELECTION_MAGISK_REPOSITORY}" + fi + if [[ "${SELECTION_BOOT_ANIMATION}" == 'true' ]]; then printf '%s\n' \ 'boot_animation=true' \ From 04cce43efd874bf50de2c11876b8d17bbae4c39b Mon Sep 17 00:00:00 2001 From: 0cwa Date: Mon, 21 Sep 2026 22:12:31 +0000 Subject: [PATCH 5/8] test: distinguish rooted Magisk repository selection --- tests/rom_contract_test.sh | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/tests/rom_contract_test.sh b/tests/rom_contract_test.sh index fc5b3284..dd97d3e4 100644 --- a/tests/rom_contract_test.sh +++ b/tests/rom_contract_test.sh @@ -77,6 +77,12 @@ test_profiles_are_stable() { https://download.lineageos.org/api/v2 } +test_magisk_repository_default() ( + load_contract + assert_equals "topjohnwu/Magisk" "${MAGISK[REPOSITORY]}" \ + "default Magisk repository" +) + test_unknown_rom_fails_closed() ( load_contract ROM_FAMILY="unknown-rom" @@ -126,6 +132,7 @@ fingerprint() { test_selection_fingerprint() ( local baseline repeated afsr_on afsr_off root_changed rom_changed module_changed local boot_changed second_boot_changed fingerprint_input + local rootless_repo_changed rooted_repo_changed load_contract set_selection_fixture @@ -145,6 +152,12 @@ test_selection_fingerprint() ( assert_equals "${afsr_on}" "$(fingerprint)" \ "AFSR-on selection did not preserve the exact identity" + MAGISK[REPOSITORY]="pixincreate/Magisk" + rootless_repo_changed="$(fingerprint)" + assert_equals "${baseline}" "${rootless_repo_changed}" \ + "rootless selection must not depend on the Magisk repository" + MAGISK[REPOSITORY]="topjohnwu/Magisk" + fingerprint_input="${TEST_ROOT}/fingerprint-input-${BASHPID}" sha256sum() { tee "${fingerprint_input}" | command sha256sum @@ -161,6 +174,12 @@ test_selection_fingerprint() ( [[ "${root_changed}" != "${baseline}" ]] || fail "root selection did not change the fingerprint" + MAGISK[REPOSITORY]="pixincreate/Magisk" + rooted_repo_changed="$(fingerprint)" + [[ "${rooted_repo_changed}" != "${root_changed}" ]] || + fail "Magisk repository selection did not change the rooted fingerprint" + MAGISK[REPOSITORY]="topjohnwu/Magisk" + MAGISK[PREINIT]="sda47" local preinit_changed preinit_changed="$(fingerprint)" @@ -263,6 +282,7 @@ test_output_policy() ( ) test_profiles_are_stable +test_magisk_repository_default test_unknown_rom_fails_closed test_invalid_compatible_sepolicy_fails_closed test_selection_fingerprint From 0a1bc45511ff3902acb316646a430e333ab65bb6 Mon Sep 17 00:00:00 2001 From: 0cwa Date: Mon, 21 Sep 2026 22:12:34 +0000 Subject: [PATCH 6/8] docs: use official Magisk with external Zygisk compatibility --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 95f78fe8..fb7e4990 100644 --- a/README.md +++ b/README.md @@ -177,7 +177,7 @@ It is easier to use the web installer to flash GrapheneOS. However, it is recomm Root changes the device security model and can introduce compatibility breakage across ROM updates. Use it only when you understand the trade-offs for your device and selected ROM. -PixeneOS defaults to the GrapheneOS-oriented `pixincreate/Magisk` fork. The repository is configurable through `MAGISK[REPOSITORY]` in `env.toml`; use another source only after confirming compatibility with the selected ROM. Magisk/Zygisk behavior can change across releases, so rooted builds should be revalidated after ROM or Magisk updates. +ModOS defaults to the official `topjohnwu/Magisk` repository. The source remains configurable through `MAGISK[REPOSITORY]` in `env.toml`, but alternate Magisk forks are opt-in rather than part of the GrapheneOS build contract. If you use Zygisk Next for GrapheneOS compatibility, install and manage it separately from the OTA build. Magisk/Zygisk behavior can change across releases, so rooted builds should be revalidated after ROM, Magisk, or Zygisk changes. A Magisk-patched OTA is only the boot-image half of a working Magisk installation. On a clean install, after a data wipe, or whenever Magisk reports that additional setup is required, install/open the **matching Magisk manager APK**, accept **Additional setup / Environment fix**, and allow the device to reboot. That step provisions the runtime binaries (including `su`) under `/data/adb/magisk`; those files are device state and cannot be embedded in or verified from an OTA image. From 1ffc78cbf07a9fe64266263222d87865e96589eb Mon Sep 17 00:00:00 2001 From: 0cwa Date: Mon, 21 Sep 2026 22:13:39 +0000 Subject: [PATCH 7/8] docs: align env example with official Magisk default --- env.toml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/env.toml b/env.toml index 122838cc..7fc53059 100644 --- a/env.toml +++ b/env.toml @@ -7,9 +7,9 @@ ROM_FAMILY = "grapheneos" # For rooted builds, append the Magisk preinit device to every entry. # DEVICES = "bramble:sda10, shiba:sda10" -# The maintained GrapheneOS-oriented default is pixincreate/Magisk. -# Override this only when the selected ROM is compatible with another fork. -# 'MAGISK[REPOSITORY]' = "pixincreate/Magisk" +# The default is official Magisk from topjohnwu/Magisk. +# Override this only when intentionally selecting another Magisk fork. +# 'MAGISK[REPOSITORY]' = "topjohnwu/Magisk" [build] # Legacy single-output switch: false = rootless, true = Magisk. From 105e24288a2f86680c35760b0b310b6315954f5a Mon Sep 17 00:00:00 2001 From: 0cwa Date: Mon, 21 Sep 2026 22:14:29 +0000 Subject: [PATCH 8/8] test: require official Magisk default --- tests/upstream_integration_test.sh | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tests/upstream_integration_test.sh b/tests/upstream_integration_test.sh index 65fb5601..68250339 100644 --- a/tests/upstream_integration_test.sh +++ b/tests/upstream_integration_test.sh @@ -12,7 +12,10 @@ grep -Fq 'VERSION[BCR]="${VERSION[BCR]:-3.9}"' src/declarations.sh || fail "BCR grep -Fq 'VERSION[CUSTOTA]="${VERSION[CUSTOTA]:-6.5}"' src/declarations.sh || fail "Custota pin is not 6.5" grep -Fq 'VERSION[AVBROOT_SETUP]="634e6185cf70ea3ec9229ae957ddf2304f52e9e8"' src/declarations.sh || fail "maintained helper pin is unexpected" grep -Fq '"version": "2.0.0"' locks/executable-tools-v1.json || fail "AFSR 2.0 lock entry is missing" -grep -Fq "pixincreate/Magisk" src/config_schema.sh || fail "GrapheneOS-oriented Magisk default is missing" +grep -Fq "topjohnwu/Magisk" src/config_schema.sh || fail "official Magisk default is missing" +if grep -Fq "pixincreate/Magisk" src/config_schema.sh; then + fail "pixincreate Magisk must remain opt-in rather than the default" +fi if grep -Fq "Charge Limit" README.md; then fail "README still advertises unsupported Charge Limit integration"