One extremely disappointing thing that Android has been getting under the hood with Google images is ... Play integrity.
This used to be a relatively simplistic system with three tiers:
0 - you are not certified for anything
1 - basic integrity, you need to have a genuine android device running google play services
2 - device integrity, you need to have a genuine android device with core requirements on play and no rooting
3 - strong integrity, you need a locked bootloader and signed image with recent security update
This API/requirements set was uniquely put by pressure from various vendors(think banks and various "security-certification" obsessed parties), and was already quite unpleasant, as it excludes any form of rooting, even if your root-access is adb only. But it gets worse as now non-official images are getting excluded not only from strong integrity[0] but also device integrity. Numerous apps are now requiring device integrity and hence won't be usable even on a locked, signed android image if it's not google or vendor-official.
It actually gets worse. Google has been silently restricting the api results(as of may):
- basic requires a certified device with an android platform key attestation
- device now requires a hardware verified boot, with locked bootloader and recent security patch. This excludes lots of devices
- strong requires security patch on all partitions
And it gets even worse. On recent play stores & android versions, as apps have to be installed or updated by google play to get a full integirty response. no more sideloading APKs or alternative stores.
This is nothing but a clear move to a full lock-in to play store, where the majority of vendors live, to end up with a fully locked a-la-apple ecosystem. This doesn't improve security, people that know still have ways to bypass those restrictions when needed. All it does is give the illusion of safety.
I would personally feel like:
1 - rooting should be allowed on a certified device with most apps still working. This could be done with a locked bootloader too if they provided such an image for debug.
2 - alternative os, like graphene, should be given a way to pass all attestations, as well as alternative stores, provided they follow a set of constraints.
With this in mind, I can't be positive about android 16 and new versions going down a grim locked future.
[0] https://discuss.grapheneos.org/d/6361-play-integrity-api-and...