Security Updates for /e/: "Trust" App says "vendor: outdated"

Hi everyone!

A quick question: I have the latest version of /e/ on my phone and noticed the “Trust” feature (Settings->Security->Trust). When I go there it says: “Android security patches: Plattform: current, vendor: outdated”. (I do not have my phone in English so the exact phrasing may be different).

Why is the vendor part outdated? Is it safer to have the official fairphone firmware?

Fairphone 3:

If you have a look at Settings - About phone - (tap on “Android-Version 9”) … the Vendor security patch level is being reported as 5 August 2018, which seems bogus, the phone came out one year later than that.
As for why this date gets reported, I don’t know.

I seem to remember that the date was the same with the stock OS, I don’t know whether Fairphone fixed that in the meantime. But when they do, /e/ should get this, too, I think /e/ gets those patches from Fairphone.


Fairphone 2:

The Vendor security patch level is being reported as outdated because it is.
Qualcomm as the main vendor “patcher” ended support for the Snapdragon 801 SoC of the Fairphone 2 long ago, and there’s nothing more coming.

Curious indeed! Thanks for clarifying!

Also: Sorry for not being clear enough: I was talking about the FP3.

Stock OS for the FP3 does not show the vendor patch date.

1 Like

Hi,

Here is the corresponding issue :

I still dont understand. Does /e/ also deliver current Kernel and Modem?
Only for FP3?

The /e/ install only concern system and kernel,
no pit, no modem, no csc, no vendor, , , ,

Edith : this is valable for old (non treble) devices and for GSI

Even for the FP3?
So that means I often need to go back to STOCK to install the current firmware? Thats crazy…

Of course not. /e/ have an official partnership with Fairphone, so they get this stuff.

No, on the FP3, and treble devices, you should be able to overwrite the vendor firmware without touching the system part cause they are located on différents partions

That’s what I thought. So that means /e/ is able to deliver security on every level?
Because its a common criticism of LineageOS that only the OS level is up to date.

How would users go about updating this?

You update /e/. End of story :wink: .

1 Like

In theory :
Take the official firmware compressed folder, extract the content with a tar décrypter, select the appropriate sub-compressed-folder, and flash it !
But where to find it ?
Fairphone compagnie is actting as an assembler technician, that take hardware elements parts from third party providers, those are sold with proprietary drivers witch are rarely updated ( or compagnie have to to pay for it ) because the manufacturers nomore build this product and don’t care.

In practice: Could you please have a look at the /e/ Fairphone 3 install/update files, which are straight partition images to flash, and enlighten us what’s missing there and why /e/ wouldn’t get drivers and patches to include from Fairphone via their official partnership?

1 Like

Probably to cut things short, here the list of files in the /e/ install archive for FP3:

boot.img
dtbo.img
dtbo-pre.img
product.img
ramdisk.img
ramdisk-recovery.img
system.img
userdata.img
vbmeta.img
vendor.img

As you can see, it includes vendor.img that gets flashed to the vendor partition.

3 Likes