diff options
| author | Daniel Micay <danielmicay@gmail.com> | 2021-09-08 03:09:28 -0400 |
|---|---|---|
| committer | Daniel Micay <danielmicay@gmail.com> | 2021-09-08 03:09:28 -0400 |
| commit | dc411390220e9ede95ff81c92705ad2a8da608d6 (patch) | |
| tree | ef9f2cfcba05d9f5e7d7dbc0a9ee4c293307cc00 | |
| parent | 60d2b72fec18c0f59ba560e1d5247c964f1f77fa (diff) | |
note about new devices/keys for attestation
| -rw-r--r-- | static/articles/attestation-compatibility-guide.html | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/static/articles/attestation-compatibility-guide.html b/static/articles/attestation-compatibility-guide.html index e54a54fc..a15c0b54 100644 --- a/static/articles/attestation-compatibility-guide.html +++ b/static/articles/attestation-compatibility-guide.html @@ -96,6 +96,9 @@ key is in the permitted set when <code>verifiedBootState</code> is <code>SelfSigned</code>.</p> + <p>GrapheneOS regularly adds support for new devices so you should have a process for + regularly adding the new verified boot key fingerprints from this page.</p> + <p>The hardware attestation API also provides other useful information signed by the hardware including the OS patch level, in a way that even an attacker exploiting the OS after boot to gain root cannot trivially bypass. It's a better feature than the |