Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Pixel log: January 2026 factory images are missing, and Android 17 entries use the system fingerprint

Aperta
#20 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
48/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
android, python
Ambito
data, security, tooling

Direzione di ricerca

Start with checkpoint.txt and image_info.txt, then run the comparison script in the issue against the factory images page to reproduce the missing January entries and generic Android 17 matches. Inspect the pixel_verification path mentioned in the report. Done means the January images are represented and Android 17 entries use fingerprints that verify correctly for their device images.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

The Pixel log has no entries for the January 2026 release. The factory images page lists 29 images for BP4A.260105.004 (.E1, .A2, .B2, .C2) across 15 devices, and none of them are in image_info.txt at tree size 1109. December 2025 and February 2026 builds are there. To rule out a naming difference I computed the VBMeta digest of tokay-bp4a.260105.004.e1 with avbtool calculate_vbmeta_digest: b1eca34c41d308c91abcea66cf5852814cd526020041a590bd7f865aaa0900b6. It doesn't appear in the log under any fingerprint.

Separately, Android 17 builds are logged under the system partition's fingerprint. Entry 1073 is google/generic_system_google/generic:17/CP2A.260705.006/15641320:user/release-keys with digest c93d26cf284f3c3ba9301fd331b6129a8399ba44242aab9068690732239d2d26, which is tokay's image. That image's OTA metadata (post-build) and every other fingerprint property in its vbmeta say google/tokay/tokay:17/CP2A.260705.006/15641320:user/release-keys. With the same digest, the verifier returns OK for the generic fingerprint and FAILURE for the device one, so a payload built from what the phone reports won't verify. The grep on system.img in pixel_verification still finds the generic line, so the manual path works. It applies to all 103 Android 17 images from the factory page that are in the log.

Missing January 2026 images, and the script
akita     BP4A.260105.004.E1
blazer    BP4A.260105.004.A2 .C2 .E1
caiman    BP4A.260105.004.A2 .E1
comet     BP4A.260105.004.A2 .E1
felix     BP4A.260105.004.E1
frankel   BP4A.260105.004.A2 .C2 .E1
husky     BP4A.260105.004.E1
komodo    BP4A.260105.004.A2 .E1
lynx      BP4A.260105.004.E1
mustang   BP4A.260105.004.A2 .C2 .E1
rango     BP4A.260105.004.A2 .C2 .E1
shiba     BP4A.260105.004.E1
tangorpro BP4A.260105.004.E1
tegu      BP4A.260105.004.B2 .C2 .E1
tokay     BP4A.260105.004.A2 .E1

The script lists every factory zip on developers.google.com/android/images and looks up each (device, build) in image_info.txt, after checking the entry count against the checkpoint. It also prints the September 2026 images (CP3A.260905.009 for 21 devices and CD1A.260905.001.B1 for cubs, grizzly, kodiak and yogi); image_info.txt was last modified on August 21, so those may just be lag.

# Compare every Pixel 6+ factory image on developers.google.com/android/images
# with the Pixel Binary Transparency log's image_info.txt.
import collections, re, urllib.request

def get(url, cookie=None):
    h = {"User-Agent": "curl/8"}
    if cookie: h["Cookie"] = cookie
    return urllib.request.urlopen(urllib.request.Request(url, headers=h)).read().decode()

BT = "https://developers.google.com/android/binary_transparency/"
size = int(get(BT + "checkpoint.txt").split("\n")[1])  # verify the signature separately
log = get(BT + "image_info.txt").strip().split("\n\n")
assert len(log) == size

logged = collections.defaultdict(set)
for entry in log:
    fp = entry.split("\n")[1]  # google/<product>/<device>:<ver>/<build>/...
    device, build = re.match(r"google/[^/]+/([^:]+):[^/]+/([^/]+)/", fp).groups()
    logged[device].add(build.upper())

site = get("https://developers.google.com/android/images", cookie="devsite_wall_acks=nexus-image-tos")
PIXEL6_AND_NEWER = {"oriole", "raven", "bluejay", "panther", "cheetah", "lynx", "tangorpro",
    "felix", "shiba", "husky", "akita", "tokay", "caiman", "komodo", "comet", "tegu",
    "frankel", "blazer", "mustang", "rango", "stallion", "cubs", "grizzly", "kodiak", "yogi"}

counts = collections.Counter()
for device, build in sorted(set(re.findall(r"aosp/([a-z0-9_]+)-([a-z0-9.]+)-factory-[0-9a-f]+\.zip", site))):
    if device not in PIXEL6_AND_NEWER: continue
    build = build.upper()
    if build in logged[device]: counts["logged"] += 1
    elif build in logged["generic"]: counts["logged as generic"] += 1
    else: counts["missing"] += 1; print("missing", device, build)
print(f"tree size {size}:", dict(counts))
Lingua principale
Python
Stelle
18
Fork
5
Merge medio
3h 43m
PR unite (30g)
8

Guida per i contributori

Apri la guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di android/android-binary-transparency

Tutte le issue di android/android-binary-transparency

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.