What operating system will the Librem phone use?

My limited understanding is that CopperheadOS is dependent on Google to accept the kernel security patches that Copperhead Security suggests. This process of Copperhead Security trying to harden the security of the underlying kernel is called “backporting” i think…Copperhead Security tries to “upstream” CopperheadOS security patches to the kernel, which would benefit all Android users (and would reduce the workload of CopperheadOS development–otherwise, Copperhead Security needs to keep re-applying the same security patches to the CopperheadOS upon each new anual Android release, which is currently Oreo).

Android, AOSP, alternative Android ROMs, and CopperheadOS all use the same kernel (i think) which is based on Linux but modified by Google. Google might not want to incorporate security patches to the kernel if there is even a small performance hit. Privacy is not Google’s top priority, and can u really hav security without privacy? (um, not trying to criticize Copperhead Security or derail this thread, sorry if im necrobumping, but the Librem-5 Kickstarter campaign is half over, while the funding goal is less than halfway met. People need to know this stuff–it’s not easy to learn IMHO)

@sptankard – Yes, collaboration is ideal, thank you for that request! Note also, however, that both Copperhead Security and Purism are selling products and must try to stay afloat financially. Which maybe is why Purism frowns on posters criticizing their competition here in this forum–i.e., because Purism doesnt want to be criticized by their competitors. Copperhead developer Daniel Micay (nicknamed strncat at the CopperheadOS subReddit) replied to a request regarding his feedback of the Librem-5 in the post linked below:

https://www.reddit.com/r/CopperheadOS/comments/6z32jm/species_defender_privacy_phone_external_design/

1 Like

That is a noisy thread. His basic points:

  • Revisit decision against using AOSP as the software; it would offer better privacy / security and wouldn’t require making an entirely new viable software stack
  • be careful misinformation about AOSP is not propagated: it doesn’t require Google to do anything
  • support Android and prioritize security features
  • offer verified boot and A/B updates
  • for security reasons, either ship firmware updates for nonfree components or do not use any
  • microphone switch is a plus
  • hardware support for virtualization is irrelevant
  • CopperheadOS should not be run in containers
  • harden the host OS
  • desktop Linux stacks have weak areas: systemd, pulseaudio, tons of C and C++ at the application layer, no real application security model, permission model, no comparable full system SELinux policy…
  • applications should not be trusted especially if installed through bleeding edge flatpak
  • Android works fine on generic arm / arm64 hardware with mainline kernels; the frozen LTS branches are for out-of-tree drivers SoC drivers regardless of Android use
  • provide an AOSP board support package and properly configured kernel
  • get AOSP at least close to fully passing the Compatibility Test Suite on the L5
3 Likes