Hacker News new | ask | show | jobs
by izacus 16 days ago
How would you "use AOSP attestation"?

The point is that the signatures are compared against a database of certified builds - and that exists on Google servers.

If you want AOSP attestation, you need to build your own database to compare against.
2 comments
literalAardvark 16 days ago
https://grapheneos.org/articles/attestation-compatibility-gu...

It exists on Google's servers for lock in reasons alone.

link
izacus 16 days ago
GrapheneOS guy went on a very extensive rant on Mastodon when someone wanted to create an independent, European, list that could be used by apps to verify attestation. They want apps to hardcode theirs specifically.

Which makes sense for them - after all, that makes their competitors break and their ROM doens't.

link
roundabout-host 16 days ago
Even with the "independent European" list, you would still be unable to use a custom OS not in it.
link
roundabout-host 16 days ago
Even if they did that, it would not be OK. Free software is no longer free if it has to be on a list.
link