The following Android ROMs have releases that are cryptographically signed.

1. Graphene OS
2. CalyxOS

All other Android ROMs are vulnerable to Supply Chain Attacks because the user has no safe way to verify the authenticity of the release after they download it. The release that they downloaded could be maliciously altered on the server itself or in-transit.

For a list of instances where this has happend to other open-source projects historically, see this list (specifically taking note where the Type of compromise = Publishing Infrastructure)

• https://github.com/cncf/tag-security/tree/main/supply-chain-security/compromises

The following Android ROMs have releases that are cryptographically signed.

1. Graphene OS
2. CalyxOS

All other Android ROMs are vulnerable to Supply Chain Attacks because the user has no safe way to verify the authenticity of the release after they download it. The release that they downloaded could be maliciously altered on the server itself or in-transit.

For a list of instances where this has happend to other open-source projects historically, see this list (specifically taking note where the Type of compromise = Publishing Infrastructure)

• https://github.com/cncf/tag-security/tree/main/supply-chain-security/compromises

Note that, while LineageOS's releases include a signature inside the release .zip, the authenticity of the tool (and its dependencies) for verifying the signature itself cannot be verified. Therefore, this is still vulnerable to supply chain attacks.