0

What is the list of popular Android ROMs whose releases are cryptographically signed?

Today I learned that LineageOS (arguably the most-popular open-source Android ROM) does not cryptographically sign their releases with PGP. As such, they do not provide a safe way for users to download and install copies of LineageOS.

There is an issue open to fix this, but it's been unanswered for months

Generally speaking, the Android open-source ecosystem is a security nightmare: most ROMs will point you to download a .zip on some (often third party) web server with no crypographic signature -- LineageOS is not an exception here.

So what ROMs are available to the Android user that cares about their security? Which ROM developers care enough to sign their releases with GPG?

Improve this question
3
  • Lineages releases are cryptographically signed, but not with PGP. Please read wiki.lineageos.org/verifying-builds.html BTW: cross posting a question to multiple sites just makes you unpopular.
    – Robert
    Commented Jun 29, 2021 at 18:44
  • Additionally signing a custom ROM in most cases does not make sense if the developer and builder is an anonymous person in a forum. You sound like someone who have just fount his "hammer" and now everything in the world looks like a nail...
    – Robert
    Commented Jun 29, 2021 at 18:49
  • I think the question is not whether some file is signed or not, but what a "valid" signature is worth. It's a bit like having a certificate from "some CA".
    – U. Windl
    Commented Feb 7, 2023 at 13:32

1 Answer 1

Reset to default
0

The following Android ROMs have releases that are cryptographically signed.

  1. Graphene OS
  2. CalyxOS

All other Android ROMs are vulnerable to Supply Chain Attacks because the user has no safe way to verify the authenticity of the release after they download it. The release that they downloaded could be maliciously altered on the server itself or in-transit.

For a list of instances where this has happend to other open-source projects historically, see this list (specifically taking note where the Type of compromise = Publishing Infrastructure)

Note that, while LineageOS's releases include a signature inside the release .zip, the authenticity of the tool (and its dependencies) for verifying the signature itself cannot be verified. Therefore, this is still vulnerable to supply chain attacks.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.