GrapheneOS
I suppose I meant something slightly different.
I mean that if I enable the security preview (to patch critical bugs that OEMs know about and therefore would be knowable to many governments and others), then I am downloading a particular patch early and applying it, without source code being released.
It's very unlikely probably, but I could see this as a way to attack users using threats or coercision. For example, if there were a world war and some societal choas, which isn't an impossible scenario, and the military came and they say "You need to change this patch to something with a backdoor or we will kill all of these puppies and kittens that we've brought with us" and the developer implemented the backdoor because of this threat, and later released open source code, and the open source code didn't have the backdoor, how would the target know that the closed upgrade they downloaded didn't match the open source code later?
So is there was a way to download the code first, check a hash for it, and then apply it, then even if the source code were temporarily closed, I could always check the hash with what was released later? In a worst case scenario it could mean being compromised for a month or two and I would learn about this after the open source code is published.
However, if there is no hash and the source code is open later, I don't know if there is a way to compare what was previously applied. A one month compromise would be less concerning to me than a one year compromise. I also currently do not have that high of a threat model but still value privacy.
Thank you to GrapheneOS and developers for continuing to code during these extraordinary times. I know you have said that forking would not be possible. I do worry for the future of the project with Google escalating hostility towards FOSS and privacy but hope it continues. I also hope that GOS developers can provide their expertise to FOSS mobile developers if requested so that mobile linux will eventually become more robust and usable. I have tried Postmarket OS and Mobian and others before and, back when I tried them they were quite horrible, but Rome wasn't built in a day and something has to start somewhere. GOS is generally a usable operating system for most things, and much safer in BFU than other options, and I appreciate the effort and extra security and features during these challenging times.