Repository navigation

feat: harden Jaguar Screen Waydroid with host SELinux - #52

Open

ajlennon wants to merge 82 commits into

mainfrom

feat/r26-waydroid-selinux

Commits on Sep 6, 2026
- fix(waydroid): lxc ThinLTO configure and python3-gbinder Cython 3
  
  authored and
  ajlennon
  committed
  57d4102
- feat(waydroid): provision Android images outside OSTree
  ajlennon
  committed
  f2778ce
- fix(waydroid): require Etnaviv on Jaguar screen
  ajlennon
  committed
  aade8ff
- fix(waydroid): allow Etnaviv without Vulkan on Jaguar screen
  ajlennon
  committed
  871146d
- fix(waydroid): use executable LXC stop hook
  ajlennon
  committed
  e391784
- feat(waydroid): boot Android UI on Jaguar screen
  ajlennon
  committed
  b949eaa
Commits on Sep 7, 2026
- fix(waydroid): use landscape splash for rotated output
  ajlennon
  committed
  dc04e74
- feat(demo): add Jaguar Waydroid GPU baseline
  ajlennon
  committed
  41df2bb
- docs(release): distinguish functional and source baselines
  ajlennon
  committed
  935b490
- docs(release): reject target 2888 watchdog experiment
  ajlennon
  committed
  f760695
- docs(release): record bounded reboot validation
  ajlennon
  committed
  306e43c
Commits on Sep 12, 2026
- bsp: fix existing Jaguar U-Boot patches
  ajlennon
  committed
  6202824
Commits on Sep 13, 2026
- ci: enforce layer adoption regression gate
  ajlennon
  committed
  7c184c7
- ci: fix layer gate expressions
  ajlennon
  committed
  82f2c51
- ci: bound layer gate build concurrency
  ajlennon
  committed
  6b8e574
- ci: use current Actions runtimes
  ajlennon
  committed
  71c01cd
- ci: emit layer matrix without jq
  ajlennon
  committed
  c73dd4b
- ci: route Yocto jobs to capable runner
  ajlennon
  committed
  58bb309
- ci: strengthen layer adoption evidence
  ajlennon
  committed
  ce0b9da
- ci: preserve protected layer adoption tuples
  ajlennon
  committed
  372d90c
- ci: test protected layer adoption matrix
  ajlennon
  committed
  9d6bb5a
- ci: protect exact product feature tuples
  ajlennon
  committed
  06f1536
- ci: exercise signing in layer adoption gate
  ajlennon
  committed
  b9207b9
- ci: use valid job-level key path
  ajlennon
  committed
  303978b
- ci: bound layer gate disk usage
  ajlennon
  committed
  4b2cfa7
- ci: consolidate layer adoption regression on ai-tools
  ajlennon
  committed
  5cf9737
- ci: run container steps with bash
  ajlennon
  committed
  28be102
- ci: keep kas overlay inside worktree
  ajlennon
  committed
  0ba5fa3
- ci: quote layer state normalisation safely
  ajlennon
  committed
  dc1079d
- ci: replay captured command failures
  ajlennon
  committed
  d58b88a
- ci: initialize protected layer submodules
  ajlennon
  committed
  4998160
- ci: initialize protected layer worktrees
  ajlennon
  committed
  4e07c3b
- ci: share kas worktree preparation
  ajlennon
  committed
  aba0a4d
- ci: track current bitbake dependency graph
  ajlennon
  committed
  c423642
- ci: diagnose selected environment mismatches
  ajlennon
  committed
  67e9f6d
- ci: use inode-aware disk thresholds
  ajlennon
  committed
  62e7455
- ci: bind local kas changes to adoption gate
  ajlennon
  committed
  f7bdd20
- ci: validate kernel signing identity
  ajlennon
  committed
  b5380f5
- ci: force test signing paths
  ajlennon
  committed
  b08700e
- ci: canonicalise layer adoption evidence
  ajlennon
  committed
  fc72fbd
- ci: keep adoption gate on controlled runner
  ajlennon
  committed
  fbc6f4d
- ci: key baseline cache by capture schema
  ajlennon
  committed
  531a6c2
- ci: source warnings from cooker logs
  ajlennon
  committed
  9093e7a
- ci: normalise encoded checkout provenance
  ajlennon
  committed
  88a53cd
- ci: audit immutable baseline repair
  ajlennon
  committed
  f7c6d6e
- ci: include packaging baseline repair
  ajlennon
  committed
  014a301
- ci: include Handheld DTS baseline repair
  ajlennon
  committed
  d767d4c
- ci: include Handheld DTS baseline repair
  ajlennon
  committed
  25e4e8a
- ci: retain repaired empty package baseline
  ajlennon
  committed
  9e66b1b
- ci: include remaining DTS baseline repairs
  ajlennon
  committed
  cc48e39
- ci: make kernel warnings sstate-independent
  ajlennon
  committed
  459641f
- ci: include Phasora SPDX baseline repair
  ajlennon
  committed
  28311cb
- ci: match renamed license repair surface
  ajlennon
  committed
  843ab3b
- ci: treat removed warnings as improvements
  ajlennon
  committed
  6c4a0aa
- ci: shard layer adoption tuples
  ajlennon
  committed
  b47dc37
- feat(security): confine Waydroid with host SELinux
  ajlennon
  committed
  d3be861
- test(ci): add R26 Jaguar SELinux preflight tuple
  ajlennon
  committed
  66b76bf
- fix(ci): isolate local SELinux preflight signing
  ajlennon
  committed
  fc8a2a5
- ci: materialize LFS-backed KAS configs
  ajlennon
  committed
  e47e9da
- merge: combine Waydroid SELinux with layer adoption gate
  ajlennon
  committed
  d8c44b5
- ci: protect exact Foundries product tuples
  ajlennon
  committed
  d0f8e75
- fix(selinux): avoid unused target toolchain
  ajlennon
  committed
  3cd52a1
- ci: retire Jaguar inst and Phasora tuples
  ajlennon
  committed
  e8c94ce
- ci: focus adoption gate on Jaguar screen
  ajlennon
  committed
  079fe76
- feat(selinux): make Waydroid policy enforcing by default
  ajlennon
  committed
  2b98666
- merge: align focused Jaguar screen adoption gate
  ajlennon
  committed
  667516b
- test(selinux): guard Waydroid enforcing default
  ajlennon
  committed
  f4a81fa
- chore: allow unified diff context whitespace
  ajlennon
  committed
  004cc88
- test(waydroid): capture R26 board acceptance evidence
  ajlennon
  committed
  2e5575e
- test(waydroid): require direct confinement evidence
  ajlennon
  committed
  ab79aa4
- merge: adopt authoritative Jaguar screen gate
  ajlennon
  committed
  826a56b
- fix(selinux): isolate Waydroid policy discovery mode
  ajlennon
  committed
  7e015b9
- ci(screen): lock SELinux discovery tuple
  ajlennon
  committed
  432afb0
- feat(screen): retain CRA audit evidence in SELinux image
  ajlennon
  committed
  f966469
- test(screen): retain CRA audit evidence path
  ajlennon
  committed
  10f515a
- fix(ci): validate audited distro by gitlink
  ajlennon
  committed
  7ed1c58
- ci: add focused tuple validation dispatch [skip ci]
  ajlennon
  committed
  c132b61
- ci: use stable connectivity probe [skip ci]
  ajlennon
  committed
  34cfc0c
- ci: make bison docs dependency hermetic [skip ci]
  ajlennon
  committed
  e18ada2
- ci: run focused tuple on DD Hetzner [skip ci]
  ajlennon
  committed
  e2bf6f6
- ci: mirror pinned oauth2 source [skip ci]
  ajlennon
  committed
  9c7f323
- ci: fail fast on docker compose fetch [skip ci]
  ajlennon
  committed
  358cd2a

Commits

Commits on Sep 6, 2026

Commits on Sep 7, 2026

Commits on Sep 12, 2026

Commits on Sep 13, 2026