Not everyone using an aftermarket OS wants to roll back the security model and disable security features. Proper verified boot is a small part of what we expect potential hardware partners to implement. It's not proper verified boot if firmware bypasses aren't fixed like this.
Conversation
You're welcome to use something other than GrapheneOS if you don't want the standard security model and hardware-based security features intact. Rollback protection is a basic security feature and has already been used for years, just not for the early SoC boot chain in practice.
2
Pixels were in theory supposed to be doing this already but were not doing it in practice due to the conflict between them being secure devices and being development devices where someone might want to flash an obsolete, insecure OS version to test app compatibility with it, etc.
2
Newer runs of the devices will shipped with updated firmware/OS.
We consider it a problem that it takes us a couple weeks to move to new major OS versions we intend to solve that by getting partner access eventually such as via a hardware partner so that we can port earlier.
1
On our own hardware, we'll also get to decide when we move to a new major OS version. On existing hardware, when a device moves to a new major OS version, we have to move to the new major OS version to continue providing basic privacy and security updates for the firmware, etc.
1
1
That's true regardless of whether there's anti-rollback protection for the boot chain firmware. On August 15th, Android 13 was released for Pixels. There was no August release for Android 12.1. The maximum obtainable patch level on Android 12.1 is 2022-08-01. We have to upgrade.
2
1
Also note, the last 12.1 release was on Aug 3rd.
So there's less than 2 weeks of (possible) security fixes difference right now.
1
1
The only August 2022 release for Pixels is Android 13:
developers.google.com/android/images
AOSP only has monthly and quarterly releases for the actively maintained release. There is no August 2022 monthly release of AOSP 12,1. There are 2 years left of monthly security patches for 12.1.
2
curl -I dl.google.com/dl/android/aos
...
last-modified: Wed, 03 Aug 2022 14:10:47 GMT
It may have been frozen on June 1, but it wasn't actually published until a month later. :/
1
This is a carrier support update for the 2022-06-01 patch level release for the Pixel 4a. The build date is likely July but the release has the 2022-06-01 patch level. Look at the BUILD_ID. It's just a minor carrier support update (B2) to the previous release, not a new release.
SD2A.220601.004.B2
That means it was created for a 2022-06-01 release, it is the 4th major variant since then and B2 is a minor variant which they used to ship some carrier support changes while not making any significant changes to avoid needing to test and recertify it.