KindnessInfinity

Changes in version 129.0.6668.54.0:

• update to Chromium 129.0.6668.54

A full list of changes from the previous release (version 128.0.6613.146.0) is available through the Git commit log between the releases.

This update is available to GrapheneOS users via our app repository and will also be bundled into the next OS release. Vanadium isn't yet officially available for users outside GrapheneOS, although we plan to do that eventually. It won't be able to provide the WebView outside GrapheneOS and will have missing hardening and other features.

Changes in version 137:

• update max supported version of Play services to 24.36
• update max supported version of Play Store to 42.7

A full list of changes from the previous release (version 136) is available through the Git commit log between the releases (only changes to the gmscompat_config text file and config-holder/ directory are part of GmsCompatConfig).

This update is available to GrapheneOS users via our app repository and will also be bundled into the next OS release.

Changes in version 128.0.6613.146.0:

• update to Chromium 128.0.6613.146

A full list of changes from the previous release (version 128.0.6613.127.0) is available through the Git commit log between the releases.

This update is available to GrapheneOS users via our app repository and will also be bundled into the next OS release. Vanadium isn't yet officially available for users outside GrapheneOS, although we plan to do that eventually. It won't be able to provide the WebView outside GrapheneOS and will have missing hardening and other features.

Our Android 15 port is increasingly solid. It can currently be tested by building the OS via https://grapheneos.org/build. Since there aren't stable releases of Android 15 available yet, we currently support using the firmware, etc. from the Pixel Android 15 Beta releases for Pixels.

Changes in version 136:

• update max supported version of Play Store to 42.6
• add stub for BluetoothDevice.setPairingConfirmation()
• update SDK to 35 (Android 15)
• update target API level to 35 (Android 15)

A full list of changes from the previous release (version 135) is available through the Git commit log between the releases (only changes to the gmscompat_config text file and config-holder/ directory are part of GmsCompatConfig).

This update is available to GrapheneOS users via our app repository and will also be bundled into the next OS release.

Notable changes in version 85:

• make remote verification more prominent by moving it to the main screen from the action menu
• use correct theme for attestation activity background color
• add support for Material You
• update NDK to 27.1.12297006
• enable generation of v4 APK signatures to replace fs-verity metadata for updates on Android 15 GrapheneOS

A full list of changes from the previous release (version 84) is available through the Git commit log between the releases.

The Auditor app uses hardware security features on supported devices to validate the integrity of the operating system from another Android device. It will verify that the device is running the stock operating system with the bootloader locked and that no tampering with the operating system has occurred. It will also detect downgrades to a previous version.

It cannot be bypassed by modifying or tampering with the operating system (OS) because it receives signed device information from the device's Trusted Execution Environment (TEE) or Hardware Security Module (HSM) including the verified boot state, operating system variant and operating system version. The verification is much more meaningful after the initial pairing as the app primarily relies on Trust On First Use via pinning. It also verifies the identity of the device after the initial verification. Trust is chained through the verified OS to the app to bootstrap software checks with results displayed in a separate section.

This app is available through the Play Store with the app.attestation.auditor.play app id. Play Store releases go through review and it usually takes around 1 to 3 days before the Play Store pushes out the update to users. Play Store releases use Play Signing, so we use a separate app id from the releases we publish ourselves to avoid conflicts and to distinguish between them. Each release is initially pushed out through the Beta channel followed by the Stable channel.

Releases of the app signed by GrapheneOS with the app.attestation.auditor app id are published in the GrapheneOS App Store. These releases are also bundled as part of GrapheneOS. You can use the GrapheneOS App Store for automatic updates. Each release is initially pushed out through the Alpha channel, followed by the Beta channel and then finally the Stable channel.

Notable changes in version 25:

• add support for using v4 APK signatures instead of fs-verity metadata on Android 15
• enable generation of v4 APK signatures to replace fs-verity metadata for updates on Android 15 GrapheneOS
• skip system package check for static dependencies self checks
• extend workaround for PackageInstaller sessions getting stuck to newer Android versions
• update AndroidX Lifecycle libraries to 2.8.5
• update AndroidX Navigation KTX libraries to 2.8.0
• update AndroidX Fragment library to 1.8.3
• update AndroidX Activity KTX library to 1.9.2
• update Gradle to 8.10
• update Android Gradle plugin to 8.6.0
• update Kotlin to 2.0.20
• update Kotlin Symbol Processing to 1.0.25

A full list of changes from the previous release (version 24) is available through the Git commit log between the releases.

App Store is the client for the GrapheneOS app repository. It's included in GrapheneOS but can also be used on other Android 12+ operating systems. Our app repository currently provides our standalone apps, out-of-band updates to certain GrapheneOS components and a mirror of the core Google Play apps and Android Auto to make it easy for GrapheneOS users to install sandboxed Google Play with versions of the Google Play apps we've tested with our sandboxed Google Play compatibility layer.

GrapheneOS users must either obtain GrapheneOS app updates through our App Store or install it with adb install-multiple with both the APK and fs-verity metadata since fs-verity metadata is now required for out-of-band system app updates on GrapheneOS as part of extending verified boot to them.

Notable changes in version 4:

• use standard top app bar text style
• use steadily decreasing header sizes for release notes
• define night-specific theme to make text selection toolbar and splash screen adapt to the current theme
• update Kotlin to 2.0.20
• update Gradle to 8.10
• update Android Gradle plugin to 8.6.0
• update Android build tools to 35.0.0
• update Android NDK to 27.0.12077973
• update AndroidX Compose BOM to 2024.09.00
• switch AndroidX Compose UI Text library version from AndroidX Compose BOM now that 1.7.0 has a stable release and is included
• update AndroidX Compose Navigation to 2.8.0
• update AndroidX Lifecycle libraries to 2.8.5
• update AndroidX Activity Compose to 1.9.2
• enable generation of v4 APK signatures to replace fs-verity metadata for updates on Android 15 GrapheneOS
• add whitelist of supported languages for resources (currently English)

A full list of changes from the previous release (version 3) is available through the Git commit log between the releases.

Releases of the app are published in the GrapheneOS App Store. These releases are also bundled as part of GrapheneOS. You can use the GrapheneOS App Store on Android 12 or later for automatic updates. Each release is initially pushed out through the Alpha channel, followed by the Beta channel and then finally the Stable channel.

Ad blocking test at https://d3ward.github.io/toolz/adblock is extremely flawed. It tests domains which are not used for ads/tracking and doesn't take into account that mainstream ad blocking is blocking specific paths hosted at those domains. Mainstream ad blockers also cheat at these tests.

Here's where uBlock Origin simply fudges the results for the test by blocking everything tested by d3ward.github.io:

https://github.com/uBlockOrigin/uAssets/blob/master/filters/filters.txt#L14202-L14206

Brave uses uBlock Origin filters as their base set of filters and then extends it, so it's cheating at the test through that too.

Here's where Adguard cheats at the test, which is at least done case-by-case with explanations:

https://github.com/AdguardTeam/AdguardFilters/blob/daba77058c72b983f2a46b97dca5b669710a7414/SpywareFilter/sections/specific.txt#L4491-L4521

Some of the tested domains are simply not used on other sites. In other cases, it is used that way but blocking it would break sites so they don't do it.

Author is willing to fix issues but since ad blockers are cheating it'd need to be moved to another domain after fixing it.

Vanadium will not include rules for cheating at content filtering tests because we think it would be a breach of user trust, regardless of flaws in a test.

Changes in version 128.0.6613.127.0:

• update to Chromium 128.0.6613.127
• mark Vanadium Config as forceQueryable to support reading the configuration from apps using the WebView for feature flags

A full list of changes from the previous release (version 128.0.6613.99.0) is available through the Git commit log between the releases.

This update is available to GrapheneOS users via our app repository and will also be bundled into the next OS release. Vanadium isn't yet officially available for users outside GrapheneOS, although we plan to do that eventually. It won't be able to provide the WebView outside GrapheneOS and will have missing hardening and other features.

Pixel 4a (5G), Pixel 5 and Pixel 5a are end-of-life and shouldn't be used anymore due to lack of security patches for firmware and drivers. We provide extended support for harm reduction.

Tags:

• 2024090400-redfin (Pixel 4a (5G), Pixel 5)
• 2024090400 (Pixel 5a, Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, emulator, generic, other targets)
• 2024090400-caimito (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold)

Changes since the 2024083100 release:

• full 2024-09-05 security patch level
• rebased onto AP2A.240905.003 (generic) and AD1A.240905.004 (caimito) Android Open Source Project releases
• Sandboxed Google Play compatibility layer: add support for using GSF 34 on SDK 35 (Android 15) to handle the case where users have just upgraded the OS but haven't yet updated GSF
• Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold: fix an upstream use-after-free bug present in 2 drivers
• allow Pixel Thermometer and Fitbit to see each other as a special case
• allow current launcher to see the Pixel Thermometer app as a special case
• kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.47
• GmsCompatConfig: update to version 134
• GmsCompatConfig: update to version 135

Our initial port of device-independent GrapheneOS code to Android 15 is done and we're testing it in the emulator. We still need to port the kernels, device-specific repositories, adevtool and generate the new vendor state. Can already be built for emulator from our 15 branch.