fix: merge cert for system

Signed-off-by: WindSpiritSR <simon343riley@gmail.com>

Author: WindSpiritSR

.github/workflows/release.yml

@@ -18,7 +18,7 @@ jobs:
         id: tag
         run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
 
-      - name: Update update.json
+      - name: Update update.json and module.prop
         env:
           VERSION: ${{ steps.tag.outputs.VERSION }}
           REPO: ${{ github.repository }}
@@ -30,13 +30,15 @@ jobs:
              --arg cl "https://github.com/${REPO}/releases/tag/${VERSION}" \
              '.version=$v | .versionCode=$c | .zipUrl=$z | .changelog=$cl' \
              update.json > tmp.json && mv tmp.json update.json
+          sed -i "s/^version=.*/version=${VERSION}/" module.prop
+          sed -i "s/^versionCode=.*/versionCode=${NEW_CODE}/" module.prop
 
-      - name: Commit update.json
+      - name: Commit update.json and module.prop
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add update.json
-          git diff --cached --quiet || git commit -m "Update update.json for ${{ steps.tag.outputs.VERSION }}"
+          git add update.json module.prop
+          git diff --cached --quiet || git commit -m "Update update.json and module.prop for ${{ steps.tag.outputs.VERSION }}"
           git push origin HEAD:main
 
       - name: Build zip

post-fs-data.sh

@@ -20,38 +20,47 @@ set_context() {
     fi
 }
 
-chown -R 0:0 ${MODDIR}/system/etc/security/cacerts
-set_context /system/etc/security/cacerts ${MODDIR}/system/etc/security/cacerts
+merge_ca_certs() {
+    target_path="$1"
+    tmpfs_path="$2"
 
-# Android 14 support
-# Since Magisk ignore /apex for module file injections, use non-Magisk way
-if [ -d /apex/com.android.conscrypt/cacerts ]; then
-    # Clone directory into tmpfs
-    rm -f /data/local/tmp/sys-ca-copy
-    mkdir -p /data/local/tmp/sys-ca-copy
-    mount -t tmpfs tmpfs /data/local/tmp/sys-ca-copy
-    cp -f /apex/com.android.conscrypt/cacerts/* /data/local/tmp/sys-ca-copy/
-
-    # Do the same as in Magisk module
-    cp -f ${MODDIR}/system/etc/security/cacerts/* /data/local/tmp/sys-ca-copy
-    chown -R 0:0 /data/local/tmp/sys-ca-copy
-    set_context /apex/com.android.conscrypt/cacerts /data/local/tmp/sys-ca-copy
-
-    # Mount directory inside APEX if it is valid, and remove temporary one.
-    CERTS_NUM="$(ls -1 /data/local/tmp/sys-ca-copy | wc -l)"
+    rm -f "${tmpfs_path}"
+    mkdir -p "${tmpfs_path}"
+    mount -t tmpfs tmpfs "${tmpfs_path}"
+    cp -f "${target_path}"/* "${tmpfs_path}/"
+
+    cp -f ${MODDIR}/system/etc/security/cacerts/* "${tmpfs_path}"
+    chown -R 0:0 "${tmpfs_path}"
+    set_context "${target_path}" "${tmpfs_path}"
+
+    CERTS_NUM="$(ls -1 "${tmpfs_path}" | wc -l)"
     if [ "$CERTS_NUM" -gt 10 ]; then
-        mount --bind /data/local/tmp/sys-ca-copy /apex/com.android.conscrypt/cacerts
+        mount --bind "${tmpfs_path}" "${target_path}"
         for pid in 1 $(pgrep zygote) $(pgrep zygote64); do
             nsenter --mount=/proc/${pid}/ns/mnt -- \
-                mount --bind /data/local/tmp/sys-ca-copy /apex/com.android.conscrypt/cacerts
+                mount --bind "${tmpfs_path}" "${target_path}"
         done
     else
-        echo "Cancelling replacing CA storage due to safety"
+        echo "Cancelling replacing ${target_path} due to safety"
     fi
     for pid in 1 $(pgrep zygote) $(pgrep zygote64); do
         nsenter --mount=/proc/${pid}/ns/mnt -- \
-            umount /data/local/tmp/sys-ca-copy
+            umount "${tmpfs_path}"
     done
-    umount /data/local/tmp/sys-ca-copy
-    rmdir /data/local/tmp/sys-ca-copy
+    umount "${tmpfs_path}"
+    rmdir "${tmpfs_path}"
+}
+
+chown -R 0:0 ${MODDIR}/system/etc/security/cacerts
+set_context /system/etc/security/cacerts ${MODDIR}/system/etc/security/cacerts
+
+# Android 14+ APEX Conscrypt store
+# Since Magisk ignores /apex for module file injections, use non-Magisk way
+if [ -d /apex/com.android.conscrypt/cacerts ]; then
+    merge_ca_certs /apex/com.android.conscrypt/cacerts /data/local/tmp/sys-ca-copy
+fi
+
+# System CA store (for Flutter/dart:io HttpClient and other legacy clients)
+if [ -d /system/etc/security/cacerts ]; then
+    merge_ca_certs /system/etc/security/cacerts /data/local/tmp/sys-ca-copy-system
 fi