Upcoming changes for applications using Chrome’s CT Log Lists

[acn-masatadakurihara]

Due to the following changes to Google's terms of service, deploying an application that includes this library to Google Play Console now triggers a warning stating: Apps using the most up-to-date libraries may break as early as May 29. All applications using these libraries will be broken before July 1, 2027, if no action is taken by the developer.

https://googlechrome.github.io/CertificateTransparency/3p_libraries.html

Developers should rely on native platform support. If you are developing an Android application, you should rely on native platform support available in Android 16+ and not enforce CT on earlier versions. Apple app developers automatically have CT enforced for all TLS connections without any developer action required.

If you still choose to enforce CT in your application without relying on platform support, you must ensure that your application does NOT fetch Chrome's or Android's log lists directly from Google, nor rely on Google's log list signing keys. Enforcing CT is done at your own risk, and Google will take no action to mitigate breakage that any action we take causes your application.

Is there anything users of this library can do about this?

[jdeblasio]

If you'd like to avoid breakage, the only sure-fire way is to stop using this library.

Please see also Issue #143, wherein this has been discussed at length and elevated to the maintainers of this library.

[roman-chugunov-cko]

Is this May 29, 2026 or 2027? It's super confusing. There were no previous announcements for android developers afaik

[jdeblasio]

In two days. Though very few apps will experience breakage then in practice, and none if they're using a version of this library released since March of 2023. Users of more recent versions of the library have until at least December. The actual breakage date is determined by several factors, including most prominently the expiration date of the TLS certificates that your app uses.

There were no Play-based notifications to developers before the Play Console warning mentioned here. Your app did, however, break in June of last year (#143), which was a significant notification for many. Ultimately, app developers are responsible for what dependencies they use, and ensuring that those dependencies meet their needs and are kept up-to-date. This library has unfortunately not taken steps to protect its users from breakage, but that's always a risk when taking 3rd-party dependencies.