<!DOCTYPE html><html><head><title></title></head><body><div>GrapheneOS typically has 4 or more security updates each month. June was exceptional with 8 security updates. Check it:</div><div><br></div><div><a href="https://grapheneos.org/releases">https://grapheneos.org/releases</a></div><div><br></div><div>CalyxOS? For all of 2026, there was one general release in July, requiring a reflash, plus one security update in August.</div><div><br></div><div><a href="https://calyxos.org/news/">https://calyxos.org/news/</a><br></div><div><br></div><div>Graphene has the best security & privacy, and is actively developed. I do not recommend Calyx, which is more of a zombie project.</div><div><br></div><div>On Sat, Aug 22, 2026, at 10:13 PM, Mikalai Birukou via kwlug-disc wrote:</div><blockquote type="cite" id="qt" style=""><p>Did you know about Google play store "Play App Signing": <a class="qt-moz-txt-link-freetext" href="https://developer.android.com/guide/app-bundle/faq#app-signing">https://developer.android.com/guide/app-bundle/faq#app-signing</a></p><p>Developer gives his signing key to Google. Completely. Private
and public parts. Or, developer may go with option 2, where you
don't even see that key, which is under your developer name, but,
... Google uses it to sign.</p><p>Real use. Person of interest gets Signal update. Just this person
receives these particular bytes. I mean, targeted update. Like
targeted advertising. And device will check Signal's signature all
right.</p><p>Why would you use Aurora, <a class="qt-moz-txt-link-freetext" href="https://f-droid.org/packages/com.aurora.store/">https://f-droid.org/packages/com.aurora.store/</a> ?<br> Via Tor, via Aurora, presumably anonymous connection, get to
Google place with Signal update. Okay. Can one verify before
install ?</p><p><br></p><p>Leaving in the woods is already impossible. Starlink shines
everywhere. Next options are Calyx and GrapheneOS hats.</p><pre style="position:absolute;top:-99999px;left:-99999px;" class="qt-clear-for-copy"><div><a class="qt-moz-txt-link-freetext" href="https://developer.android.com/guide/app-bundle/faq#app-signing">https://developer.android.com/guide/app-bundle/faq#app-signing</a></div></pre><pre style="position:absolute;top:-99999px;left:-99999px;" class="qt-clear-for-copy"><div><a class="qt-moz-txt-link-freetext" href="https://developer.android.com/guide/app-bundle/faq#app-signing">https://developer.android.com/guide/app-bundle/faq#app-signing</a></div></pre><pre style="position:absolute;top:-99999px;left:-99999px;" class="qt-clear-for-copy"><div><a class="qt-moz-txt-link-freetext" href="https://developer.android.com/guide/app-bundle/faq#app-signing">https://developer.android.com/guide/app-bundle/faq#app-signing</a></div></pre><div>_______________________________________________</div><div>kwlug-disc mailing list</div><div>To unsubscribe, send an email to <a href="mailto:kwlug-disc-leave@kwlug.org">kwlug-disc-leave@kwlug.org</a></div><div>with the subject "unsubscribe", or email</div><div><a href="mailto:kwlug-disc-owner@kwlug.org">kwlug-disc-owner@kwlug.org</a> to contact a human being.</div><div><br></div></blockquote><div><br></div></body></html>