Departure of Calyx / CalyxOS leadership and discontinuation of CalyxOS updates

linux-dev

What do you mean by more responsibly? Spreading the keys to dozens of developers, that still can use these keys even if they leave the project?

IMHO is Calyx doing the only right thing. Since they cannot rotate the key, only OEMs can do that as they have full control over the bootloader. If someone leaves the project he should not have access to the key anymore.

Probably9857

linux-dev

linux-dev What do you mean by more responsibly?

I mean in a way that is likely to avoid the situation in which CalyxOS finds themselves.

linux-dev Spreading the keys to dozens of developers, that still can use these keys even if they leave the project?

I imagine that more creative solutions are possible.

linux-dev IMHO is Calyx doing the only right thing

I didn't say anything about what they are doing now. Only that it was irresponsible of them to allow this situation to arise in the first place.

But, I'm not an expert in this area, so if you want to say they were actually following best practices, I'm not in a position to dispute it.

GrapheneOS

linux-dev

Since they cannot rotate the key, only OEMs can do that as they have full control over the bootloader.

Calyx could have released updates rotating all of the keys used within the OS including the ones for OS and app updates. They can't do that because they seem to lack access to the signing keys. It's only the verified boot keys which can't be rotated and several devices they support lack working verified boot anyway. They also don't have the extensions to verified boot needed to make it more useful than wiping via recovery being near equivalent to a fresh install.

linux-dev

Probably9857

I imagine that more creative solutions are possible.

There is: https://rombsr.org/ but as far as I know neither grapheos or calyxos used it so far, may change in the future though.

Probably9857

linux-dev

The problem of shared/organizational/distributed key management has been widely considered in relation to cryptocurrencies, and there are many solutions that seem to be reasonably effective. Seems to me the concepts would transfer to software signing keys.

GrapheneOS

linux-dev Where did you get this link?

lynatic

linux-dev the repo linked on their website doesn't exist: https://github.com/xoraxiom/ROMbsr

The install guide uses a "your-org" placeholder that smells vibecoded, there a no other mentions of this project anywhere on the internet (other than the websites repo itself: https://github.com/xoraxiom/ROMbsr-website).

Seems weird...

GrapheneOS

linux-dev We asked where you got the link you shared in GrapheneOS. Please provide an answer to this question.

linux-dev

FYI, I think they don't want to use the old keys, as they are changing their signing process, at least this is what I assume from reading: https://gitlab.com/CalyxOS/calyxos/-/issues/3430

GrapheneOS

linux-dev The signing keys for APKs and APEXes can be rotated, as can the signing keys for OS updates. There's no need to stop releases updates to rotate those keys. If they had the previous signing keys, they would still be able to release updates and wouldn't need to require reinstallation. Only verified boot key rotation requires reinstallation and not all the devices they support have working verified boot anyway.

de0u

lynatic the repo linked on their website doesn't exist: https://github.com/xoraxiom/ROMbsr

I believe GitHub can return a 404 if a repository is private (perhaps by accident).

linux-dev

GrapheneOS

If they had the previous signing keys, they would still be able to release updates and wouldn't need to require reinstallation.

And how do you know that they don't have the keys?

How can they provide another ota if they don't have the keys:

https://calyxos.org/news/2025/08/27/last-ota-update-before-new-calyxos-release/

GrapheneOS

linux-dev Convincing Nick to sign a final update to give users a notice doesn't mean they have the signing keys. The actual patch level will still be 2025-06-01 even if they set an inaccurate Android security patch level without providing everything required as they usually do. If they have the signing keys and can use them for arbitrary things, why aren't they rotating everything other than the verified boot keys?

Adlers

GrapheneOS He vibe coded that abs was trying to exploit you into using it and then compromising the whole project. Maybe a north Korean or some skid

linux-dev

GrapheneOS

We asked where you got the link you shared in GrapheneOS. Please provide an answer to this question.

While I'm not a fan of google, sometimes google is your friend:
https://www.google.com/search?q=android+hsm+rom+signing+github
https://www.google.com/search?q=android+hsm+rom+signing

GrapheneOS

The remaining core developer working on CalyxOS (Tommy Webb) left the organization. That leaves almost no one working on the project. One of their core developers left prior to this being public, their lead developer left following that and then the leader of the organization left too. You can see from https://review.calyxos.org/q/status:open that Tommy Webb was the remaining active core developer. Their initial 4-6 month estimate for resuming updates on August 1st is looking overly optimistic.

CalyxOS users still don't have the 2025-06-05 patch level or above including being missing the Critical severity remote cellular radio vulnerability from June 2025, other driver/firmware patches from June 2025, driver/firmware patches from August 2025 or the massive set of September 2025 patches for both AOSP and Pixels. It's increasingly unsafe for remaining CalyxOS users to continue using it especially since 2 of the September 2025 vulnerabilities are marked in the bulletin as being known to be exploited in the wild. It's worth noting they don't go back and update past bulletins with news about in the wild exploitation being discovered, that information is only provided when the issues are first patched and then it's assumed everyone is updated to them. The in the wild exploitation info is only provided for what Android considers 0 days in terms of the Android Security Bulletins, not N days after patches are officially disclosed. That's also based on very limited insight into exploitation, as far more issues are exploited in the wild prior to being patched in reality.

n3t_admin

GrapheneOS It's increasingly unsafe for remaining CalyxOS users to continue using it

I think the worst part is that uninformed people, who don't check the news on CalyxOS, have no clue that they are at risk. Like elderly people who got it installed by their grandchildren for example.

The Calyx team should just push an update with a big, unmistaken (non-dismissible) notification that their OS is now unsafe to use in production and should be abandoned in favor of better, up-to-date, secure options.
Everything else would be dishonest at this point in time, since you correctly outlined that the project most certainly will never get up to speed with basically all of their developers gone.

Let's see if they actually care about their users and whether they will inform them, I honestly doubt it.

matchboxbananasynergy

As a follow-up to GrapheneOS Tommy Webb, the developer who seems to have been the most experienced CalyxOS developer after the departure of cdesai has posted this on their Mastodon: https://ioc.exchange/@tmw/115343274226581752

on september 30, i stepped down as a developer for the #calyx institute.

i am proud of everyone on the OS team, who all pulled together and showed so much dedication to #calyxos and its users, despite the last few months' challenges.

still, in my opinion, calyx has a lot of work to do to rebuild trust, both inside and outside the org. i have a few starter ideas: listen to your workers. act swiftly on bad behavior. and don't shield the men who engage in it from consequences. ...repeatedly.

i'm so tired of it. people deserve better.

I believe it's important for that statement to be read as it indicates that there may be more happening within Calyx Institute than people outside of the org might think.

That said, this isn't being posted for drama, and isn't meant to spark a huge back-and-forth in this thread or elsewhere, but rather to inform.

Momud

n3t_admin Calyx already made an update that adds a notice. https://www.reddit.com/r/CalyxOS/comments/1n1v00q/last_ota_update_before_the_new_calyxos_release/

MarSOnEarth

Latest on 'where in the world is' Nicholas Merrill:
https://www.wired.com/story/new-anonymous-phone-carrier-sign-up-with-nothing-but-a-zip-code/

Hmm...

« Previous Page