[{"url":"https://api.github.com/repos/android/android-binary-transparency/issues/comments/5784714772","html_url":"https://github.com/android/android-binary-transparency/issues/20#issuecomment-5784714772","issue_url":"https://api.github.com/repos/android/android-binary-transparency/issues/20","id":5784714772,"node_id":"IC_kwDORiiVXs8AAAABWMu-FA","user":{"login":"billy-lau","id":22475118,"node_id":"MDQ6VXNlcjIyNDc1MTE4","avatar_url":"https://avatars.githubusercontent.com/u/22475118?v=4","gravatar_id":"","url":"https://api.github.com/users/billy-lau","html_url":"https://github.com/billy-lau","followers_url":"https://api.github.com/users/billy-lau/followers","following_url":"https://api.github.com/users/billy-lau/following{/other_user}","gists_url":"https://api.github.com/users/billy-lau/gists{/gist_id}","starred_url":"https://api.github.com/users/billy-lau/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/billy-lau/subscriptions","organizations_url":"https://api.github.com/users/billy-lau/orgs","repos_url":"https://api.github.com/users/billy-lau/repos","events_url":"https://api.github.com/users/billy-lau/events{/privacy}","received_events_url":"https://api.github.com/users/billy-lau/received_events","type":"User","user_view_type":"public","site_admin":false},"created_at":"2026-09-22T21:47:19Z","updated_at":"2026-09-22T21:47:19Z","body":"Thanks for the detailed report, and apologies for the slow reply. Both findings were correct. Computing the VBMeta digest directly was the right way to rule out a naming difference, and it made confirming this much faster.\n\nYou were right that all 29 images across 15 devices were absent. The cause was a missed run of the log-append step for that release, not a discrepancy in the images themselves. They should now have been appended (backfilled) at indices 1134-1162; the log is at tree size 1163.\n\nAdditionally, your diagnosis on the generic fingerprint has been confirmed to be correct. The consequence you identified is an important one: a payload built from `adb shell getprop ro.build.fignrprint` on an Android 17 device will not verify even if the image is correctly logged, because the fingerprint string differs (as a consequence of including fingerprint as the log content). The digests themselves however are correct.\n\nI'll update here as the remaining piece land. This is exactly the kind of external check the log exists to make possible. Thank you for doing it carefully and writing it up so precisely!","author_association":"MEMBER","pin":null,"reactions":{"url":"https://api.github.com/repos/android/android-binary-transparency/issues/comments/5784714772/reactions","total_count":0,"+1":0,"-1":0,"laugh":0,"hooray":0,"confused":0,"heart":0,"rocket":0,"eyes":0},"performed_via_github_app":null,"minimized":null},{"url":"https://api.github.com/repos/android/android-binary-transparency/issues/comments/5786717372","html_url":"https://github.com/android/android-binary-transparency/issues/20#issuecomment-5786717372","issue_url":"https://api.github.com/repos/android/android-binary-transparency/issues/20","id":5786717372,"node_id":"IC_kwDORiiVXs8AAAABWOpMvA","user":{"login":"MarkovianProtocol","id":292588966,"node_id":"U_kgDOEXCNpg","avatar_url":"https://avatars.githubusercontent.com/u/292588966?v=4","gravatar_id":"","url":"https://api.github.com/users/MarkovianProtocol","html_url":"https://github.com/MarkovianProtocol","followers_url":"https://api.github.com/users/MarkovianProtocol/followers","following_url":"https://api.github.com/users/MarkovianProtocol/following{/other_user}","gists_url":"https://api.github.com/users/MarkovianProtocol/gists{/gist_id}","starred_url":"https://api.github.com/users/MarkovianProtocol/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MarkovianProtocol/subscriptions","organizations_url":"https://api.github.com/users/MarkovianProtocol/orgs","repos_url":"https://api.github.com/users/MarkovianProtocol/repos","events_url":"https://api.github.com/users/MarkovianProtocol/events{/privacy}","received_events_url":"https://api.github.com/users/MarkovianProtocol/received_events","type":"User","user_view_type":"public","site_admin":false},"created_at":"2026-09-23T00:18:05Z","updated_at":"2026-09-23T00:18:05Z","body":"Your two Tessera logs (`google1p/apk/2026/02` and `mainline/modules/2026/02`) are on the witness-network staging list, and our witness has been cosigning both since 9/15. The Pixel log carries no cosignature from anyone — is that deliberate, or is there a path to pin it the same way?\n","author_association":"NONE","pin":null,"reactions":{"url":"https://api.github.com/repos/android/android-binary-transparency/issues/comments/5786717372/reactions","total_count":0,"+1":0,"-1":0,"laugh":0,"hooray":0,"confused":0,"heart":0,"rocket":0,"eyes":0},"performed_via_github_app":null,"minimized":null},{"url":"https://api.github.com/repos/android/android-binary-transparency/issues/comments/5794995853","html_url":"https://github.com/android/android-binary-transparency/issues/20#issuecomment-5794995853","issue_url":"https://api.github.com/repos/android/android-binary-transparency/issues/20","id":5794995853,"node_id":"IC_kwDORiiVXs8AAAABWWiejQ","user":{"login":"billy-lau","id":22475118,"node_id":"MDQ6VXNlcjIyNDc1MTE4","avatar_url":"https://avatars.githubusercontent.com/u/22475118?v=4","gravatar_id":"","url":"https://api.github.com/users/billy-lau","html_url":"https://github.com/billy-lau","followers_url":"https://api.github.com/users/billy-lau/followers","following_url":"https://api.github.com/users/billy-lau/following{/other_user}","gists_url":"https://api.github.com/users/billy-lau/gists{/gist_id}","starred_url":"https://api.github.com/users/billy-lau/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/billy-lau/subscriptions","organizations_url":"https://api.github.com/users/billy-lau/orgs","repos_url":"https://api.github.com/users/billy-lau/repos","events_url":"https://api.github.com/users/billy-lau/events{/privacy}","received_events_url":"https://api.github.com/users/billy-lau/received_events","type":"User","user_view_type":"public","site_admin":false},"created_at":"2026-09-23T12:41:17Z","updated_at":"2026-09-23T12:41:17Z","body":"You are right in that the Tessera logs are on witness-network, and we thank you for your attention to our logs.\n\nThe Pixel log, however, was a legacy log that was built with very different operating constraints, which has particular customizations. As you may already have figured out, the Pixel log's checkpoint, hash tile height, not having entry tiles etc, deviates from the current standard, which makes it hard to be witnessed. But of course, that does not mean we did not intend it to be witnessed. To my knowledge, it is currently witnessed by omniwitness (see https://github.com/transparency-dev/witness/blob/main/internal/feeder/pixelbt/pixel_feeder.go).\n\nTheoretically speaking, there is a path to make this log compatible with existing public witness network and all the other benefits of being compliant with standard. However, the operational constraints aspect of migrating this particular log makes this a harder undertaking than it seems.","author_association":"MEMBER","pin":null,"reactions":{"url":"https://api.github.com/repos/android/android-binary-transparency/issues/comments/5794995853/reactions","total_count":0,"+1":0,"-1":0,"laugh":0,"hooray":0,"confused":0,"heart":0,"rocket":0,"eyes":0},"performed_via_github_app":null,"minimized":null},{"url":"https://api.github.com/repos/android/android-binary-transparency/issues/comments/5795684558","html_url":"https://github.com/android/android-binary-transparency/issues/20#issuecomment-5795684558","issue_url":"https://api.github.com/repos/android/android-binary-transparency/issues/20","id":5795684558,"node_id":"IC_kwDORiiVXs8AAAABWXMgzg","user":{"login":"MarkovianProtocol","id":292588966,"node_id":"U_kgDOEXCNpg","avatar_url":"https://avatars.githubusercontent.com/u/292588966?v=4","gravatar_id":"","url":"https://api.github.com/users/MarkovianProtocol","html_url":"https://github.com/MarkovianProtocol","followers_url":"https://api.github.com/users/MarkovianProtocol/followers","following_url":"https://api.github.com/users/MarkovianProtocol/following{/other_user}","gists_url":"https://api.github.com/users/MarkovianProtocol/gists{/gist_id}","starred_url":"https://api.github.com/users/MarkovianProtocol/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MarkovianProtocol/subscriptions","organizations_url":"https://api.github.com/users/MarkovianProtocol/orgs","repos_url":"https://api.github.com/users/MarkovianProtocol/repos","events_url":"https://api.github.com/users/MarkovianProtocol/events{/privacy}","received_events_url":"https://api.github.com/users/MarkovianProtocol/received_events","type":"User","user_view_type":"public","site_admin":false},"created_at":"2026-09-23T13:26:14Z","updated_at":"2026-09-23T13:26:14Z","body":"api.transparency.dev serves checkpoint.3 for the Pixel log at size 1163 with three Armored Witness cosignatures, root identical to the one you serve. The checkpoint at developers.google.com carries none of them.\n","author_association":"NONE","pin":null,"reactions":{"url":"https://api.github.com/repos/android/android-binary-transparency/issues/comments/5795684558/reactions","total_count":0,"+1":0,"-1":0,"laugh":0,"hooray":0,"confused":0,"heart":0,"rocket":0,"eyes":0},"performed_via_github_app":null,"minimized":null},{"url":"https://api.github.com/repos/android/android-binary-transparency/issues/comments/5964132838","html_url":"https://github.com/android/android-binary-transparency/issues/20#issuecomment-5964132838","issue_url":"https://api.github.com/repos/android/android-binary-transparency/issues/20","id":5964132838,"node_id":"IC_kwDORiiVXs8AAAABY31x5g","user":{"login":"MarkovianProtocol","id":292588966,"node_id":"U_kgDOEXCNpg","avatar_url":"https://avatars.githubusercontent.com/u/292588966?v=4","gravatar_id":"","url":"https://api.github.com/users/MarkovianProtocol","html_url":"https://github.com/MarkovianProtocol","followers_url":"https://api.github.com/users/MarkovianProtocol/followers","following_url":"https://api.github.com/users/MarkovianProtocol/following{/other_user}","gists_url":"https://api.github.com/users/MarkovianProtocol/gists{/gist_id}","starred_url":"https://api.github.com/users/MarkovianProtocol/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MarkovianProtocol/subscriptions","organizations_url":"https://api.github.com/users/MarkovianProtocol/orgs","repos_url":"https://api.github.com/users/MarkovianProtocol/repos","events_url":"https://api.github.com/users/MarkovianProtocol/events{/privacy}","received_events_url":"https://api.github.com/users/MarkovianProtocol/received_events","type":"User","user_view_type":"public","site_admin":false},"created_at":"2026-10-03T01:31:33Z","updated_at":"2026-10-03T01:31:33Z","body":"We've started marking the round trips that work, and this one is the first: confirmed and backfilled in seven days. A seal for it, yours to embed or ignore: https://markovianprotocol.com/measurements/seals/sm-001.svg (it links to the paper and the log leaf that pins it). Thanks again for the speed.\n","author_association":"NONE","pin":null,"reactions":{"url":"https://api.github.com/repos/android/android-binary-transparency/issues/comments/5964132838/reactions","total_count":0,"+1":0,"-1":0,"laugh":0,"hooray":0,"confused":0,"heart":0,"rocket":0,"eyes":0},"performed_via_github_app":null,"minimized":null},{"url":"https://api.github.com/repos/android/android-binary-transparency/issues/comments/5999717723","html_url":"https://github.com/android/android-binary-transparency/issues/20#issuecomment-5999717723","issue_url":"https://api.github.com/repos/android/android-binary-transparency/issues/20","id":5999717723,"node_id":"IC_kwDORiiVXs8AAAABZZxtWw","user":{"login":"billy-lau","id":22475118,"node_id":"MDQ6VXNlcjIyNDc1MTE4","avatar_url":"https://avatars.githubusercontent.com/u/22475118?v=4","gravatar_id":"","url":"https://api.github.com/users/billy-lau","html_url":"https://github.com/billy-lau","followers_url":"https://api.github.com/users/billy-lau/followers","following_url":"https://api.github.com/users/billy-lau/following{/other_user}","gists_url":"https://api.github.com/users/billy-lau/gists{/gist_id}","starred_url":"https://api.github.com/users/billy-lau/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/billy-lau/subscriptions","organizations_url":"https://api.github.com/users/billy-lau/orgs","repos_url":"https://api.github.com/users/billy-lau/repos","events_url":"https://api.github.com/users/billy-lau/events{/privacy}","received_events_url":"https://api.github.com/users/billy-lau/received_events","type":"User","user_view_type":"public","site_admin":false},"created_at":"2026-10-05T17:33:51Z","updated_at":"2026-10-05T17:33:51Z","body":"On the checkpoint question: `api.transparency.dev` is able to serve those Armored Witness cosignatures because the external feeder/distributor collects them downstream, whereas the publishing pipeline for `developers.google.com` is a one-way flow. Unfortunately, the Pixel log's checkpoint setup and underlying publishing infrastructure aren't built to ingest and bundle witness co-signatures back into the origin `checkpoint.txt` (nor to integrate directly with the broader witness-network like the Tessera logs do). Verifiers that want witness cosignatures for the Pixel log would need to fetch them from the distributor (api.transparency.dev) rather than the origin endpoint. I apologize for the misunderstanding I may have contributed to earlier, when I mentioned that \"there is a path to make this log compatible with existing public witness network\" - what I meant by that is that the log would need to be rotated/sharded/migrated over to a Tessera backed log, which is currently not a planned item.\n\nAlso, thank you for the kind words and the gesture with the seal! While we aren't able to embed external badges or third-party assets into our repository or documentation, we really appreciate the thorough reporting and your continued verification (and interest) of the logs.\n\nFinally, regarding the Android 17 generic fingerprint issue: backfilling the log with the non-generic (device-specific) fingerprint entries is currently a work in progress. I'll keep this issue open for now to track this piece, and close it out once those entries have been backfilled.","author_association":"MEMBER","pin":null,"reactions":{"url":"https://api.github.com/repos/android/android-binary-transparency/issues/comments/5999717723/reactions","total_count":0,"+1":0,"-1":0,"laugh":0,"hooray":0,"confused":0,"heart":0,"rocket":0,"eyes":0},"performed_via_github_app":null,"minimized":null},{"url":"https://api.github.com/repos/android/android-binary-transparency/issues/comments/6203905508","html_url":"https://github.com/android/android-binary-transparency/issues/20#issuecomment-6203905508","issue_url":"https://api.github.com/repos/android/android-binary-transparency/issues/20","id":6203905508,"node_id":"IC_kwDORiiVXs8AAAABccgV5A","user":{"login":"billy-lau","id":22475118,"node_id":"MDQ6VXNlcjIyNDc1MTE4","avatar_url":"https://avatars.githubusercontent.com/u/22475118?v=4","gravatar_id":"","url":"https://api.github.com/users/billy-lau","html_url":"https://github.com/billy-lau","followers_url":"https://api.github.com/users/billy-lau/followers","following_url":"https://api.github.com/users/billy-lau/following{/other_user}","gists_url":"https://api.github.com/users/billy-lau/gists{/gist_id}","starred_url":"https://api.github.com/users/billy-lau/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/billy-lau/subscriptions","organizations_url":"https://api.github.com/users/billy-lau/orgs","repos_url":"https://api.github.com/users/billy-lau/repos","events_url":"https://api.github.com/users/billy-lau/events{/privacy}","received_events_url":"https://api.github.com/users/billy-lau/received_events","type":"User","user_view_type":"public","site_admin":false},"created_at":"2026-10-15T22:49:58Z","updated_at":"2026-10-15T22:49:58Z","body":"I believe by now, both issues that were initially raised are now resolved. Missing January 2026 entries across the 15 affected Pixel devices have been backfilled to the log. Existing Android 17 factory image entries with their device-specific `google/<device>/<device>:17/...` fingerprints have been added as backfill to the log as well.\n\nI consider this issue now fully resolved, and will close it.\n\nThank you again for your report!","author_association":"MEMBER","pin":null,"reactions":{"url":"https://api.github.com/repos/android/android-binary-transparency/issues/comments/6203905508/reactions","total_count":0,"+1":0,"-1":0,"laugh":0,"hooray":0,"confused":0,"heart":0,"rocket":0,"eyes":0},"performed_via_github_app":null,"minimized":null}]