Notable changes in version 45:
- update CameraX to 1.1.0-beta03 providing various improvements which are partially documented in their release notes
- update target API level to 32 (Android 12.1)
- sync attestation library with upstream CTS (android-cts-12.0_r3)
- add failure notification for sample submission failures
- update Guava to 31.1
- update Gradle to 7.4.2
- update Kotlin Gradle plugin to 1.6.20
- update Android Gradle plugin to 7.1.3
- improve code quality
A full list of changes from the previous release (version 44) is available through the Git commit log between the releases.
The Auditor app uses hardware security features on supported devices to validate the integrity of the operating system from another Android device. It will verify that the device is running the stock operating system with the bootloader locked and that no tampering with the operating system has occurred. It will also detect downgrades to a previous version.
It cannot be bypassed by modifying or tampering with the operating system (OS) because it receives signed device information from the device's Trusted Execution Environment (TEE) or Hardware Security Module (HSM) including the verified boot state, operating system variant and operating system version. The verification is much more meaningful after the initial pairing as the app primarily relies on Trust On First Use via pinning. It also verifies the identity of the device after the initial verification.
See the tutorial for detailed usage instructions. This is included as the Help entry in the app menu. The app also provides basic guidance through the process. See the documentation for a more detailed overview.