[CLOSED] Malware In GSI Images From Google's AOSP Website? - Treble-Enabled Device Questions and Answers

This Google website offers frequently updated daily GSI builds of AOSP, where code changes from literally any contributor to the Android Open Source Project are built and hosted on Google Servers.
Branch Grid
ci.android.com
The FAQ states that there is a two factor security system in place to ensure the added code is genuine and safe.
Reviewers check the added code and make sure it's consistent with Google Guidelines.
Verifiers build the changes and verify it if everything checks out.
That's basically it.
Meaning the code inside those images ready for download on ci.android.com has only been vetted by a single reviewer, before a verifier builds them for testing and it is hosted as an artifact.
I understand that these img files are not meant to be used by anyone, but it still seems a little crazy to me that Google would publicly host an image file of AOSP which could potentially be downloaded or even flashed by anyone, while the code inside has basically undergone 0 scrutiny.

@tablet_seeker Thread closed as duplicate of
Malicious Code in GSI Images From Google's Developer AOSP Branch?
This Google website offers frequently updated daily GSI builds of AOSP, where code changes from literally any contributor to the Android Open Source Project are built and hosted on Google Servers...
forum.xda-developers.com
Welcome to XDA! I hope you'll always get the support you require. However, please review the XDA Forum Rules with special emphasis on rule no. 5 and post only ONCE! Thanks for your cooperation, and remember you agreed to adhere to the forum rules when you registered a few days ago.
Regards
Oswald Boelcke
Senior Moderator

Related

Supernova threads and Droidzone.in temporarily offline

Some of you may have noticed a Malware alert message from Google while trying to visit Droidzone.in to download Roms. Those who were using Supernova or Starburst may also have noticed that these threads have disappeared from the Desire Dev section.
As the Rom developer of these roms, and owner of the site, I would like to assure everyone that Droidzone.in does not voluntarily host malware on our site. Yes, our site was compromised by malware, and the attack seems to have been somwhere in the last two weeks. We think it might have come from some third party themes used in the site design. Google had detected the php injection and alerted me, which was when I became aware of the issue.
The problem with Google is that they blacklist sites with links to sites which are found to have malware. That means forum.xda-developers.com too became blacklisted at some point, which forced the Admin/Mods to disable my threads which had links to my site.
We have now cleaned up the whole site and are in the process of reuploading files to it. Right now, droidzone.in is only a stub, and download links point to sourceforge. We will be rewriting all the install instructions and add other content later.
Edit: Just wanted to thank af974 for his quick response with this issue.
Thread is again Online.
Thanks DroidZone for you cooperation.

petition for jiayu to publish repositories

Dear Jiayu S3 hardware/software development department,
First of all, thanks for making the marvelous Jiayu S3 device and
providing software updates.
There is an enthusiastic XDA community dedicated to the Jiayu S3 with
'tag' jiayu-s3 : http://forum.xda-developers.com/t/jiayu-s3
This thread named 'petition for jiayu to publish repositories' is
created to ask you if you can make an agreement with Jiayu
management to make source code repository for kernel source available,
and, to ask you if you can also make the necessary vendor and device
repositories available for building firmware (especially custom
firmware such as e.g. cyanogenmod and aosp).
Please, if these repositories can be made available, also include
necessary patches and instructions to build kernel and firmware
e.g. cyanogenmod and aosp.
Other vendors have contributed to better linux kernel and android
firmware that way and we would be proud if we can say Jiayu does the
same. Especially for the new 64 bit architecture starting with
Lollipop.
Looking forward to positive response.
It seems this thread has outlived its usefulness, as I just deleted 25 garbage posts by forum users that should know better than to spam a thread. Be glad I don't have the time or patience to dole out infractions to every person that posted here. On that note........
Thread closed

stable [GCAM ] for Lavender

This version of GCAM is stable
Everything working
Need to replace te .XML file
Mod Edit : Links Removed.
( Download from here) #GCAM
Download the XML file
Mod Edit : Links Removed.
All you need to do is simply install the GCAM
Go to setting> advance > save XML configuration
Simple name it and save it
Then go to internal storage> Google camera> camera configuration > paste the downloaded XML file ( don't delete any other XML files) > exit
Now open camera and double tap on camera between shutter button and front cam
It will ask for restore XML
Restore the new save XML ( downloaded)
Camera starts automatically (means applied new configuration)
Hit like if you do
Thanks
NOTE:-
[ I am not the developer] just sharing his work
Mod Edit
2 Threads on same topic / reposting is not allowed and there is already a thread here dedicated for gcam
May I remind you XDA Forum Rules #12
12. Sharing
XDA-Developers is based on the principle of sharing to transmit knowledge. This is the cornerstone of our site. Our members and developers freely share their experience, knowledge, and finished works with the rest of the community to promote growth within the developer community, and to encourage those still learning to become better. There are those, however, who take advantage of this model and try to make personal gains from the hard work of others.
In order to preserve the delicate balance between sharing for the good of the community and blatant self-promotion, regular members and developers alike must understand (and agree) to the following:
12.1. Give credits where due - Credits and acknowledgements for using and releasing work which is based on someone else's work are an absolute must. Works reported to have no credits will be taken down until proper acknowledgements are added by the member in question;
12.2. Courtesy - While most of the work released on our site falls under the umbrella of open source, that is not the only license model being used by developers on xda-developers. In order to prevent problems, we ask that if you decide to base your work on someone else's that you check the license model being used (as it might not be as permissive as one may think);
12.3. Re-releasing other's works as your own is forbidden. The code that you release into the wild must have something beyond minor aesthetic changes that makes it better than the last. As this can be subjective, kang reports will be reviewed on a case by case basis. If you feel that your code has been kanged, please contact the Dev Relations team (listed below) if you cannot solve the issue amicably via PM. Please understand that you will be asked to provide evidence to substantiate your claim;
12.4. Developers can issue take down requests (by contacting the Dev Relations team) under the following circumstances:
- in-process builds start showing up on forums when the developer is not yet ready to release the work;
- cases in which another developer is too aggressively soliciting donations or misrepresenting the work (kanging);
- unofficial builds where an official build is already available;
Thread Closed.
jackeagle
Forum Moderator

TWRP Realme C15 ROOT user

How to install twrp from official TWRP App
after rebooting just wait for the black screen, don't panic, it's the boot process
The TWRP.img You gave is Compiled By me for realme C11/12, Since realme C11/12/15 ( mtk Edition ) are same it worked in C15 & I know About that, Please try to Give Credits to original Owner of the Compiled ROM/Recovery, I've verified md5 checksum too, its same, Edit The post with proper credits, Thanks
@bass_deso THREAD CLOSED and the formerly attached twrp.img removed.
It seems you haven't credited the original developer of the recovery that you posted. Even if it had been your development TWRP is licensed under GPLv3 i.e. you were required to provide a link to your source.
Please advise the moderaors team (best via the report function) to re-open the thread when ready to credit the devloper of the TWRP and to mention where you obtained it from. If the original location does not obtain a link to source you'd be required to provide that link.
XDA Forum Rules (excerpt):
...
12. Sharing
XDA-Developers is based on the principle of sharing to transmit knowledge. This is the cornerstone of our site. Our members and developers freely share their experience, knowledge, and finished works with the rest of the community to promote growth within the developer community, and to encourage those still learning to become better. There are those, however, who take advantage of this model and try to make personal gains from the hard work of others.
In order to preserve the delicate balance between sharing for the good of the community and blatant self-promotion, regular members and developers alike must understand (and agree) to the following:
12.1. Give credits where due - Credits and acknowledgements for using and releasing work which is based on someone else's work are an absolute must. Works reported to have no credits will be taken down until proper acknowledgements are added by the member in question;
12.2. Courtesy - While most of the work released on our site falls under the umbrella of open source, that is not the only license model being used by developers on xda-developers. In order to prevent problems, we ask that if you decide to base your work on someone else's that you check the license model being used (as it might not be as permissive as one may think);
12.3. Re-releasing other's works as your own is forbidden. The code that you release into the wild must have something beyond minor aesthetic changes that makes it better than the last. As this can be subjective, kang reports will be reviewed on a case by case basis. If you feel that your code has been kanged, please contact the Dev Relations team (listed below) if you cannot solve the issue amicably via PM. Please understand that you will be asked to provide evidence to substantiate your claim;
12.4. Developers can issue take down requests (by contacting the Dev Relations team) under the following circumstances:
- in-process builds start showing up on forums when the developer is not yet ready to release the work;
- cases in which another developer is too aggressively soliciting donations or misrepresenting the work (kanging);
- unofficial builds where an official build is already available;
In summary, we want people to have access to work and knowledge alike. Sharing is good and courtesy and ethics go a long way.
Developers with questions, comments, complaints, or concerns about our rules (or anything!) should send a PM to our Dev Relations team (efrant or to a Moderator. We are here to help!
...
Click to expand...
Click to collapse

Where to report Treble non-compliance.

I have a TCL A30 with Android 11 that has meet unlocking criteria. I'm interested in upgrading it to Android 12.
According to this section on Treble Compliance
11. Updatable Software​
[C-0-1] Device implementations MUST include a mechanism to replace the entirety of the system software. The mechanism need not perform “live” upgrades—that is, a device restart MAY be required. Any method can be used, provided that it can replace the entirety of the software preinstalled on the device. For instance, any of the following approaches will satisfy this requirement:
“Over-the-air (OTA)” downloads with offline update via reboot.
“Tethered” updates over USB from a host PC.
“Offline” updates via a reboot and update from a file on removable storage.
Click to expand...
Click to collapse
My device is not updateable. Fastboot mode has been removed from the bootloader and all files are root, read only.
If you search this forum, there are numerous posts where TCL is non-compliant with the GPL2.- license and it now appears they are falsely claiming compliance with project Treble. I'd like to report them to the Android project but have not found anywhere to do this. Anybody know?
971shep said:
I have a TCL A30 with Android 11 that has meet unlocking criteria. I'm interested in upgrading it to Android 12.
According to this section on Treble Compliance
My device is not updateable. Fastboot mode has been removed from the bootloader and all files are root, read only.
If you search this forum, there are numerous posts where TCL is non-compliant with the GPL2.- license and it now appears they are falsely claiming compliance with project Treble. I'd like to report them to the Android project but have not found anywhere to do this. Anybody know?
Click to expand...
Click to collapse
TCL is a fine example of an Android device maker who routinely violates the GNU General Public License 2.0\ by not making kernel source available to the public. They blatantly refuse to do so. US courts, particularly the United States Circuit Courts of Appeals, have rendered some landmark decisions over the past few years holding manufacturers accountable for GPL noncompliance. The courts are now in harmony that the GPL's guidelines are enforceable via civil lawsuit being brought against the party at fault. This GPL FAQ link should give you some guidance on how and where to lodge a complaint. https://www.gnu.org/licenses/old-licenses/gpl-2.0-faq.en.html#ReportingViolation
I have had success with some obscure device makers in obtaining source code by sending emails to the CEO or general counsel departments, formally requesting the code and firmly asserting that the matter will escalate to the judiciary if noncompliance persists. I would recommend emailing TCL with such a formal request type letter, asking that Treble compliance be adhered to.

Categories

Resources