[{"url":"https://api.github.com/repos/android/android-binary-transparency/issues/comments/5784714772","html_url":"https://github.com/android/android-binary-transparency/issues/20#issuecomment-5784714772","issue_url":"https://api.github.com/repos/android/android-binary-transparency/issues/20","id":5784714772,"node_id":"IC_kwDORiiVXs8AAAABWMu-FA","user":{"login":"billy-lau","id":22475118,"node_id":"MDQ6VXNlcjIyNDc1MTE4","avatar_url":"https://avatars.githubusercontent.com/u/22475118?v=4","gravatar_id":"","url":"https://api.github.com/users/billy-lau","html_url":"https://github.com/billy-lau","followers_url":"https://api.github.com/users/billy-lau/followers","following_url":"https://api.github.com/users/billy-lau/following{/other_user}","gists_url":"https://api.github.com/users/billy-lau/gists{/gist_id}","starred_url":"https://api.github.com/users/billy-lau/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/billy-lau/subscriptions","organizations_url":"https://api.github.com/users/billy-lau/orgs","repos_url":"https://api.github.com/users/billy-lau/repos","events_url":"https://api.github.com/users/billy-lau/events{/privacy}","received_events_url":"https://api.github.com/users/billy-lau/received_events","type":"User","user_view_type":"public","site_admin":false},"created_at":"2026-09-22T21:47:19Z","updated_at":"2026-09-22T21:47:19Z","body":"Thanks for the detailed report, and apologies for the slow reply. Both findings were correct. Computing the VBMeta digest directly was the right way to rule out a naming difference, and it made confirming this much faster.\n\nYou were right that all 29 images across 15 devices were absent. The cause was a missed run of the log-append step for that release, not a discrepancy in the images themselves. They should now have been appended (backfilled) at indices 1134-1162; the log is at tree size 1163.\n\nAdditionally, your diagnosis on the generic fingerprint has been confirmed to be correct. The consequence you identified is an important one: a payload built from `adb shell getprop ro.build.fignrprint` on an Android 17 device will not verify even if the image is correctly logged, because the fingerprint string differs (as a consequence of including fingerprint as the log content). The digests themselves however are correct.\n\nI'll update here as the remaining piece land. This is exactly the kind of external check the log exists to make possible. Thank you for doing it carefully and writing it up so precisely!","author_association":"MEMBER","pin":null,"reactions":{"url":"https://api.github.com/repos/android/android-binary-transparency/issues/comments/5784714772/reactions","total_count":0,"+1":0,"-1":0,"laugh":0,"hooray":0,"confused":0,"heart":0,"rocket":0,"eyes":0},"performed_via_github_app":null,"minimized":null},{"url":"https://api.github.com/repos/android/android-binary-transparency/issues/comments/5786717372","html_url":"https://github.com/android/android-binary-transparency/issues/20#issuecomment-5786717372","issue_url":"https://api.github.com/repos/android/android-binary-transparency/issues/20","id":5786717372,"node_id":"IC_kwDORiiVXs8AAAABWOpMvA","user":{"login":"MarkovianProtocol","id":292588966,"node_id":"U_kgDOEXCNpg","avatar_url":"https://avatars.githubusercontent.com/u/292588966?v=4","gravatar_id":"","url":"https://api.github.com/users/MarkovianProtocol","html_url":"https://github.com/MarkovianProtocol","followers_url":"https://api.github.com/users/MarkovianProtocol/followers","following_url":"https://api.github.com/users/MarkovianProtocol/following{/other_user}","gists_url":"https://api.github.com/users/MarkovianProtocol/gists{/gist_id}","starred_url":"https://api.github.com/users/MarkovianProtocol/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MarkovianProtocol/subscriptions","organizations_url":"https://api.github.com/users/MarkovianProtocol/orgs","repos_url":"https://api.github.com/users/MarkovianProtocol/repos","events_url":"https://api.github.com/users/MarkovianProtocol/events{/privacy}","received_events_url":"https://api.github.com/users/MarkovianProtocol/received_events","type":"User","user_view_type":"public","site_admin":false},"created_at":"2026-09-23T00:18:05Z","updated_at":"2026-09-23T00:18:05Z","body":"Your two Tessera logs (`google1p/apk/2026/02` and `mainline/modules/2026/02`) are on the witness-network staging list, and our witness has been cosigning both since 9/15. The Pixel log carries no cosignature from anyone — is that deliberate, or is there a path to pin it the same way?\n","author_association":"NONE","pin":null,"reactions":{"url":"https://api.github.com/repos/android/android-binary-transparency/issues/comments/5786717372/reactions","total_count":0,"+1":0,"-1":0,"laugh":0,"hooray":0,"confused":0,"heart":0,"rocket":0,"eyes":0},"performed_via_github_app":null,"minimized":null},{"url":"https://api.github.com/repos/android/android-binary-transparency/issues/comments/5794995853","html_url":"https://github.com/android/android-binary-transparency/issues/20#issuecomment-5794995853","issue_url":"https://api.github.com/repos/android/android-binary-transparency/issues/20","id":5794995853,"node_id":"IC_kwDORiiVXs8AAAABWWiejQ","user":{"login":"billy-lau","id":22475118,"node_id":"MDQ6VXNlcjIyNDc1MTE4","avatar_url":"https://avatars.githubusercontent.com/u/22475118?v=4","gravatar_id":"","url":"https://api.github.com/users/billy-lau","html_url":"https://github.com/billy-lau","followers_url":"https://api.github.com/users/billy-lau/followers","following_url":"https://api.github.com/users/billy-lau/following{/other_user}","gists_url":"https://api.github.com/users/billy-lau/gists{/gist_id}","starred_url":"https://api.github.com/users/billy-lau/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/billy-lau/subscriptions","organizations_url":"https://api.github.com/users/billy-lau/orgs","repos_url":"https://api.github.com/users/billy-lau/repos","events_url":"https://api.github.com/users/billy-lau/events{/privacy}","received_events_url":"https://api.github.com/users/billy-lau/received_events","type":"User","user_view_type":"public","site_admin":false},"created_at":"2026-09-23T12:41:17Z","updated_at":"2026-09-23T12:41:17Z","body":"You are right in that the Tessera logs are on witness-network, and we thank you for your attention to our logs.\n\nThe Pixel log, however, was a legacy log that was built with very different operating constraints, which has particular customizations. As you may already have figured out, the Pixel log's checkpoint, hash tile height, not having entry tiles etc, deviates from the current standard, which makes it hard to be witnessed. But of course, that does not mean we did not intend it to be witnessed. To my knowledge, it is currently witnessed by omniwitness (see https://github.com/transparency-dev/witness/blob/main/internal/feeder/pixelbt/pixel_feeder.go).\n\nTheoretically speaking, there is a path to make this log compatible with existing public witness network and all the other benefits of being compliant with standard. However, the operational constraints aspect of migrating this particular log makes this a harder undertaking than it seems.","author_association":"MEMBER","pin":null,"reactions":{"url":"https://api.github.com/repos/android/android-binary-transparency/issues/comments/5794995853/reactions","total_count":0,"+1":0,"-1":0,"laugh":0,"hooray":0,"confused":0,"heart":0,"rocket":0,"eyes":0},"performed_via_github_app":null,"minimized":null},{"url":"https://api.github.com/repos/android/android-binary-transparency/issues/comments/5795684558","html_url":"https://github.com/android/android-binary-transparency/issues/20#issuecomment-5795684558","issue_url":"https://api.github.com/repos/android/android-binary-transparency/issues/20","id":5795684558,"node_id":"IC_kwDORiiVXs8AAAABWXMgzg","user":{"login":"MarkovianProtocol","id":292588966,"node_id":"U_kgDOEXCNpg","avatar_url":"https://avatars.githubusercontent.com/u/292588966?v=4","gravatar_id":"","url":"https://api.github.com/users/MarkovianProtocol","html_url":"https://github.com/MarkovianProtocol","followers_url":"https://api.github.com/users/MarkovianProtocol/followers","following_url":"https://api.github.com/users/MarkovianProtocol/following{/other_user}","gists_url":"https://api.github.com/users/MarkovianProtocol/gists{/gist_id}","starred_url":"https://api.github.com/users/MarkovianProtocol/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MarkovianProtocol/subscriptions","organizations_url":"https://api.github.com/users/MarkovianProtocol/orgs","repos_url":"https://api.github.com/users/MarkovianProtocol/repos","events_url":"https://api.github.com/users/MarkovianProtocol/events{/privacy}","received_events_url":"https://api.github.com/users/MarkovianProtocol/received_events","type":"User","user_view_type":"public","site_admin":false},"created_at":"2026-09-23T13:26:14Z","updated_at":"2026-09-23T13:26:14Z","body":"api.transparency.dev serves checkpoint.3 for the Pixel log at size 1163 with three Armored Witness cosignatures, root identical to the one you serve. The checkpoint at developers.google.com carries none of them.\n","author_association":"NONE","pin":null,"reactions":{"url":"https://api.github.com/repos/android/android-binary-transparency/issues/comments/5795684558/reactions","total_count":0,"+1":0,"-1":0,"laugh":0,"hooray":0,"confused":0,"heart":0,"rocket":0,"eyes":0},"performed_via_github_app":null,"minimized":null}]