There is no way this thing is %100 open source. Last time I built a full AOSP from scratch, I found out:

- VoLTE and SMS over LTE is a proprietary library.

- WiFi calling is a proprietary library.

- the Vendor partition is entirely proprietary, and at least for the Pixel, is different depending on if you use the AOSP version or the stock Google Version.

- For the Pixel 3a, you cannot even POST the phone without adding a proprietary library! I would be shocked if it's different for the Pixel 4.

I know for a fact that you cannot even boot a Pixel 3a without adding proprietary libraries.

If the reader is curious, feel free to look here and try it for yourself:

https://wiki.lineageos.org/extracting_blobs_from_zips.html

https://grapheneos.org/build#extracting-vendor-files-for-pix...

In my opinion, if Nitrokey was at all serious about making this 100% open source and secure, they would help mainline the kernel for it.

Edit: https://social.nitrokey.com/@nitrokey/106861801899442589

Its not 100% open source.

They removed the "100%" now: https://social.nitrokey.com/@nitrokey/106862053334870694.

Yeah, that was after I poked at them a few times to ask what "100%" even meant.

Also, are they using reproducible builds? Because without that, there is no quarantee that the same code is in the device. Unless I can build same binaries and verify output binaries cryptographically to be the same.

Graphene offers to be reproducible. Haven't reproduced them myself. Gonna test in n time units.

No. It's a Pixel phone, the hardware is not open.

Given the level of detail in the post that seems highly unlikely. They seem to be heavily reliant on the Graphene community for their creds.