I used Android-prepare from grapheneos for blobs extraction. They have switched to adevtool now but you can reset the commits and use it for sunfish. As a matter of fact never faced this sepolicy error from sunfish-sepolicyHello there!
I would like to know how you managed to "extract" the binary blobs for the Pixel 4a (sunfish) that you provides atContribute to SuperiorOS-Devices/vendor_google development by creating an account on GitHub.github.com
Did you use android-prepare-vendor project or adevtool project?
I'm asking because I'm trying to build AOSP for this device, and it sees I don't manage to extract these blobs properly (I get an error during AOSP build about sepolicy) with none of these projects.
For reference about ths sepolicy bug, I opened an issue here for adevtool: https://github.com/kdrag0n/adevtool/issues/19