Discussion
GrapheneOS version 2026102100 released:
https://grapheneos.org/releases#2026102100
See the linked release notes for a summary of the improvements over the previous release.
Forum discussion thread:
https://discuss.grapheneos.org/d/43012-grapheneos-version-2026102100-released
@GrapheneOS, thank you for this release! How much time usually passes between this announcement and the update being offered on phones?
@tirf It's usually quickly available in the Alpha channel and then becomes available in the Beta channel within a few hours. It generally takes at least 16 hours for a release to reach the Stable channel after reaching Beta. It can be quicker when there are only a few changes and especially when it's a follow up release to one which didn't make it through public testing.
The vast majority of releases reach the Stable channel. The main exception are releases based on new major Android versions.
@GrapheneOS as long as this update is not yet installed, is there a risk regarding the eMudhra certs not yet removed?
@bartavi Vanadium received the root store update via an out-of-band component update. That's the standard Chrome Root Store component distributed via our servers using a caching reverse proxy. We don't modify it right now.
Other Chromium-based browsers keeping component updates intact also would have received it this way.
Android has a configuration system for apps to limit the set of trusted roots or pin keys in the chain of trust. Our apps pin Let's Encrypt keys and backup leaf keys.
@bartavi Android 17 has enforced Certificate Transparency (CT) enabled by default for apps targeting Android 17. Many apps are targeting Android 17 already but it's not mandatory for Play Store apps yet. Since the roots were untrusted by CT logs, it stopped being possible to make new certificates which would be trusted by Android's TLS implementation when CT is enforced.
Browsers ship revocations but operating systems currently don't do that for apps and leave it up to apps which rarely check.
@bartavi Very few apps reduce the trusted root set. Many apps do pin keys but the vast majority don't do it. A lot of apps are targeting Android 17 so CT enforcement blocks new certificates issued with the root with the insecure intermediates. Most apps don't perform revocation checking but rather it's nearly entirely exclusive to browsers through distributing bundles of revocations. Android will likely start distributing the root store and bundles of revocations dynamically in the near future.
Install Fedizen
Get the full app experience
@GrapheneOS
Thanks for the fast reaction with those root certificates !!! 👍😎👍