I have a always on vpn connection using openvpn.

When I turn on the always on feature, I consistently get the following error message:

Note that I can surf the web just fine.

I tried checking the connection settings of my updater app, but they seem fine:

Any ideas what is going wrong or how I can fix this?

Thanks in advance.

Hi folks,
I have an OnePlus2 which until yesterday was working fine, today I got an update prompted from updater and installed the update upon reboot and on my surprise I found that I couldn't get into the actual os system, meaning the phone kept bringing up the twrp menu, and every time I tried to reboot I always ended up in the same twrp menu.

I've noticed that upon reboot the phone tries to boot into the os cause I can see the lineage os logo but then all of the sudden it reboots on its own and immediately throws me off at the twrp menu, and this cycle continues every time I try to reboot. It seems that I'm stuck at this boot cycle from which I don't know how to exit and retrieve back the functionality of my phone prior to the update?

Is there any I can restore the phone to previous stage prior to update without loosing any data?

Hi there,

The device manager can't find any update on my device.
In fact, I've inspected the request with a mitm proxy, and it appears that it searches at https://download.lineageos.org/api/v1///2bc6f0b58c, which of course returns a 404.

Device: fajita
Build number: lineage_fajita-userdebug 12 SQ3A.220705.004 2bc6f0b58c

Is this issue known and do I have to do the update manually ?

Aosp

hi there ,
i noticed that the incremental ota 's are not working in lineageos .
is there anything that i can do to fix this?
any ideas would be deeply appreciated.

Please add possibility to vote for a Device. At moment I got more and more devices unsupported by lineageOS like my "Asus Transformer TF701" and "Samsung Galaxy Tab2 (espressowifi)" even I get actual Roms from other sources without problem I wish that lineage do support it. If possible I would vote for it.

Users can enable ~wakelock in the lineageos updater in order to install updates more quickly.

It appears that the updater runs more quickly when the screen is kept on. This can be done with Developer Options > Stay Awake, but a "Stay Awake" toggle or similar UI element in the lineageos updater would be helpful for performance and also when/if Developer Options is not enabled.

• https://developer.android.com/studio/debug/dev-options#enable
• https://www.wikihow.com/Keep-the-Screen-on-While-Charging-on-Android
• https://developer.android.com/training/scheduling/wakelock#screen

USB-Ethernet perfomance is degraded from 90+ to 50...70MBps.
Tested with:
17.1-20200624, 17.1-20201110
TP-LINK EU-300 USB 3.0 to Gigabit Ethernet Network Adapter (RTL8153)
Magic iPerf, Speedtest by Ookla

This is not a new problem, it appeared in some builds 16.0

hello there , i happened to notice another ota backend in :
LineageOTA

could you provide me with some more info about which one to use ?
i need the infrastructure as official and properly configured as possible.
thanks in advance.

I have le eco2 and i have downloaded the build for the same , codenamed s2. I am unable to access the camera in some apps namely , WhatsApp, Facebook , Instagram. And in some other apps, i have to switch between front and back camera multiple times before I can use camera.
Error : Unable to start camera, please restart device.

System does not show NTFS volume on USB Flash drive.
j5xnlte
17.1-20200624, 17.1-20201110
Formatted by standard Windows 7 tool.

I'm using the docker-compose script, and while everything works fine (on my pc at least, rpi has weird issues), when I visit /api/v1/grouper/unofficial/foo, I get an internal server error, compared to an empty "response" when I visit /api/v1/grouper/nightly/foo.
Have a look here id you want to check: http://charles-iv.serveo.net (it's probably going to disconnect again, but I'll try to keep it online)
idk if this is the right place to report it or if you'll care because it's about unofficial stuff.

My Moto G 2013 is restarting automatic after this update.

Users can download a sha256sums file which contains sha256 checksums for each file in the build; alongside the other files for download at e.g. https://download.lineageos.org/devices/coral/builds

curl './.zip'
curl './.img'
curl './sha256sums'
sha256sum -c ./sailfish_build_id?.sha256sums

• https://github.com/lineageos-infra/updater/blob/main/gen_mirror_json.py#L36

Something like:?

for file in rom['files']:
    sha256sumfile.write(f"{file['sha256']} *{file['filename']}\n")

See also:

• #68

lineageos-infra/issues#8

video here:
https://gfycat.com/FrenchHiddenBlacknorwegianelkhound

Gunicorn workers get rotated, this service goes down & requires a restart due to docker links. Probably should wrap the requests fetch in a try/except & return a 500 to the user, along with moving away from docker links.

Users can verify lineageOS-built software artifacts with sigstore (and someday, SLSA) manually and with the lineageos updater android app
(because sha256 without crytographic signatures is not good enough according to TUF, Sigstore, and SLSA)

• https://wiki.lineageos.org/signing_builds
• Decide whether to start with SLSA, Sigstore, or just TUF
  • SLSA supports Sigstore
  • Sigstore depends on TUF to be verified itself
  • blockcerts/cert-verifier-js is another approach (built with W3C Verfiable Credentials and W3C DID Decentralized Identifier keys instead of OIDC OpenID Connect)
• Sign LineageOS build list json files
  • https://download.lineageos.org/api/v2/devices/sunfish/builds
• Sign LineageOS CI ROM builds
  • Upload artifact signatures to a log
• Update lineageos-infra/updater?
• Verify LineageOS ROM downloads with a (python?) CLI tool
  by default, and optionally
  • allow skipping tuf||sigstore verfication for UNOFFICIAL custom builds
    • display a note about unsigned UNOFFICIAL custom builds
• Verify LineageOS ROM downloads with the LineageOS updater android app
  • sigstore-java is not considered production-ready
  • sigstore-js and tuf-js are IIUC

TUF

TUF: The Update Framework

• src: https://github.com/theupdateframework
• web: https://theupdateframework.io/
• https://github.com/topics/tuf
  • https://github.com/engineerd/wasm-to-oci
• spec: https://theupdateframework.github.io/specification/latest/
• https://theupdateframework.github.io/specification/latest/#goals-to-protect-against-specific-attacks
• https://theupdateframework.io/news/
• TUF implementations
  • PyPI has TUF & Sigstore
  • Docker Notary has TUF
  • OCI Container Image repos may or may not support TUF

python-tuf

• src: https://github.com/theupdateframework/python-tuf
• docs: https://github.com/theupdateframework/python-tuf/tree/develop/examples/

tuf-js

• src: https://github.com/theupdateframework/tuf-js

go-tuf

• src: https://github.com/theupdateframework/go-tuf

Sigstore

• web: https://sigstore.dev/
• status: https://status.sigstore.dev/
• src: https://github.com/sigstore/
• gh topic: https://github.com/topics/sigstore
  • https://github.com/sigstore/gitsign#what-data-does-gitsign-store
• docs: https://docs.sigstore.dev/
• https://docs.sigstore.dev/#how-to-use-sigstore
• "How to Use Sigstore without Sigstore" (2023) https://eprint.iacr.org/2023/003.pdf

  The CLIs, when used to sign a software artifact, basically run the following procedure:

  1. Generate a disposable key pair
  2. Obtain a customizable OIDC token (e.g., for a workflow, VM, or Gmail user)
  3. Request a public-key certificate from Fulcio using the key pair and the token
  4. Digitally sign (the hash of) the software artifact using the private key
  5. Timestamp the signature using Rekor
  6. Output the certificate, the digital signature from step 4, and the timestamp data from step 5

  Then the authenticity of a software artifact can be verified offline with the following proofs:
  a) The output from step 6
  b) The root certificate of Fulcio
  c) The public key that Rekor used to sign the timestamp data

  • sigstore/sigstore-python#483

fulcio

• src: https://github.com/sigstore/fulcio

  sigstore OIDC PKI
  A Free-to-Use CA For Code Signing

  Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity, such as email address.

  Fulcio only issues short-lived certificates that are valid for 10 minutes.

• https://fulcio.sigstore.dev/
• https://fulcio.sigstore.dev/api/v2/trustBundle

rekor

• src: https://github.com/sigstore/rekor

  The Rekor project provides a restful API based server for validation and a transparency log for storage. A CLI application is available to make and verify entries, query the transparency log for inclusion proof, integrity verification of the transparency log or retrieval of entries by either public key or artifact.

cosign

• src: https://github.com/sigstore/cosign

sigstore-js

• src: https://github.com/sigstore/sigstore-js

sigstore-java

• src: https://github.com/sigstore/sigstore-java

sigstore-python

• src: https://github.com/sigstore/sigstore-python
• docs: https://sigstore.github.io/sigstore-python/
• docs: https://sigstore.github.io/sigstore-python/sigstore/sign.html
• docs: https://sigstore.github.io/sigstore-python/sigstore/verify.html
• https://github.com/sigstore/sigstore-python/network/dependents
  • https://github.com/python/release-tools/
    • https://github.com/python/release-tools/blob/8a66d95a3d93af799e5740053478c45eb79d0e70/run_release.py#L738
    • https://github.com/python/release-tools/blob/8a66d95a3d93af799e5740053478c45eb79d0e70/add-to-pydotorg.py#L164 ctrl-f sigstore
    • https://www.python.org/download/sigstore/ :

       python -m pip install -r https://raw.githubusercontent.com/sigstore/sigstore-python/main/install/requirements.txt
       # or, without checking the sha256 checksums in the requirements.txt
       python -m pip install sigstore
       python -m sigstore verify identity \
         --certificate Python-3.11.0.tgz.crt \
         --signature Python-3.11.0.tgz.sig \
         --cert-identity [email protected] \
         --cert-oidc-issuer https://accounts.google.com \
        Python-3.11.0.tgz

  • https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/building_running_and_managing_containers/assembly_signing-container-images_building-running-and-managing-containers#signing-container-images-with-sigstore-signatures-using-fulcio-and-rekor_assembly_signing-container-images
  • https://github.com/mayaCostantini/sigstore-ansible-github-action
  • https://github.com/sigstore/gh-action-sigstore-python
  • https://github.com/aerleon/aerleon
    • https://aerleon.readthedocs.io/en/latest/install/#verifying-installation
      • SLSA

SLSA

• src: https://github.com/slsa-framework/slsa
• web: https://slsa.dev/
• https://slsa.dev/spec/v1.0/threats-overview
• https://slsa.dev/spec/v1.0/requirements#provenance-generation
• https://slsa.dev/spec/v1.0/provenance#schema
• https://slsa.dev/spec/v1.0/provenance#index-of-build-types
  • https://github.com/nektos/act -- run GH actions {locally, w/ gitea actions,}
• https://github.com/slsa-framework/slsa-github-generator/blob/main/PROVENANCE_FORMAT.md
• https://slsa.dev/spec/v1.0/verifying-artifacts
• https://github.com/slsa-framework/slsa-verifier
• https://github.com/slsa-framework/slsa-verifier#what-is-slsa
• https://github.com/slsa-framework/slsa-github-generator
• https://github.com/slsa-framework/slsa-github-generator#hall-of-fame
• https://security.googleblog.com/2022/04/how-to-slsa-part-2-details.html

When I search on my LG G3 with the LineageOS build 14.1-20180410-nightly-d855 for updates I got an error that the updater couldn't search for updates and I should check my internet connection.
This is the exception which appears in adb:

04-16 22:51:55.051 15411-15411/org.lineageos.updater D/UpdatesActivity: Checking https://download.lineageos.org/api/v1/d855/nightly/a556d30458
04-16 22:51:55.847 15411-15411/org.lineageos.updater D/UpdatesActivity: List downloaded
04-16 22:51:55.847 15411-15411/org.lineageos.updater D/UpdatesActivity: Adding remote updates
04-16 22:51:55.855 15411-15411/org.lineageos.updater D/Utils: lineage-14.1-20180321-nightly-d855-signed.zip is older than current build
04-16 22:51:55.855 15411-15411/org.lineageos.updater D/Utils: Ignoring incompatible update lineage-14.1-20180321-nightly-d855-signed.zip
04-16 22:51:55.855 15411-15411/org.lineageos.updater D/Utils: lineage-14.1-20180328-nightly-d855-signed.zip is older than current build
04-16 22:51:55.855 15411-15411/org.lineageos.updater D/Utils: Ignoring incompatible update lineage-14.1-20180328-nightly-d855-signed.zip
04-16 22:51:55.856 15411-15411/org.lineageos.updater D/Utils: lineage-14.1-20180404-nightly-d855-signed.zip is older than current build
04-16 22:51:55.856 15411-15411/org.lineageos.updater D/Utils: Ignoring incompatible update lineage-14.1-20180404-nightly-d855-signed.zip
04-16 22:51:55.856 15411-15411/org.lineageos.updater D/Utils: lineage-14.1-20180410-nightly-d855-signed.zip is older than current build
04-16 22:51:55.856 15411-15411/org.lineageos.updater D/Utils: Ignoring incompatible update lineage-14.1-20180410-nightly-d855-signed.zip
04-16 22:51:55.882 15411-15411/org.lineageos.updater E/UpdatesActivity: Could not read json
                                                                        org.json.JSONException: End of input at character 0 of 
                                                                            at org.json.JSONTokener.syntaxError(JSONTokener.java:449)
                                                                            at org.json.JSONTokener.nextValue(JSONTokener.java:97)
                                                                            at org.json.JSONObject.<init>(JSONObject.java:156)
                                                                            at org.json.JSONObject.<init>(JSONObject.java:173)
                                                                            at org.lineageos.updater.misc.Utils.parseJson(Utils.java:125)
                                                                            at org.lineageos.updater.misc.Utils.checkForNewUpdates(Utils.java:201)
                                                                            at org.lineageos.updater.UpdatesActivity.processNewJson(UpdatesActivity.java:306)
                                                                            at org.lineageos.updater.UpdatesActivity.-wrap2(UpdatesActivity.java)
                                                                            at org.lineageos.updater.UpdatesActivity$4.-org_lineageos_updater_UpdatesActivity$4_lambda$3(UpdatesActivity.java:345)
                                                                            at org.lineageos.updater.UpdatesActivity$4$-void_onSuccess_java_io_File_destination_LambdaImpl0.run(UpdatesActivity.java)
                                                                            at android.os.Handler.handleCallback(Handler.java:751)
                                                                            at android.os.Handler.dispatchMessage(Handler.java:95)
                                                                            at android.os.Looper.loop(Looper.java:154)
                                                                            at android.app.ActivityThread.main(ActivityThread.java:6186)
                                                                            at java.lang.reflect.Method.invoke(Native Method)
                                                                            at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:889)
                                                                            at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:779)
                                                                            at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:107)
04-16 22:52:54.737 15411-15411/org.lineageos.updater D/UpdaterService: Service no longer needed, stopping

But if there is an update, it is displayed and I can download it, so the main function is working.