The Auditor app (attestation.app/about) can also verify alternative operating systems on a Pixel 2, Pixel 2 XL, Pixel 3 or Pixel 3 XL as long as the OS preserves verified boot support. The app needs to be built with the verified boot key fingerprint added to the internal list.
Conversation
Replying to
The SampleOS support in the sources uses the fingerprints of my AOSP verified boot keys: github.com/AndroidHardeni. It would be easy to expand this to other operating systems, but there aren't any left keeping the security model intact. It can support my future OS releases though.
1
1
The Pixel 3 StrongBox implementation uses a different algorithm to calculate the verified boot key fingerprint, so depending on how StrongBox support is implemented there may end up being separate lists for TEE-based and StrongBox-based keys. I wish QR codes could fit more data.
1