diff options
| -rw-r--r-- | static/install.html | 494 |
1 files changed, 247 insertions, 247 deletions
diff --git a/static/install.html b/static/install.html index c8b544ff..22e72538 100644 --- a/static/install.html +++ b/static/install.html @@ -78,353 +78,353 @@ </ul> </nav> - <h2 id="prerequisites"> - <a href="#prerequisites">Prerequisites</a> - </h2> + <section id="prerequisites"> + <h2><a href="#prerequisites">Prerequisites</a></h2> - <p>You should have at least 2GB of free memory available.</p> + <p>You should have at least 2GB of free memory available.</p> - <p>Windows 10, macOS Catalina, Arch Linux, Debian buster and Ubuntu 20.04 LTS are the - officially supported operating systems for installing GrapheneOS. You should make sure - your operating system is up-to-date before proceeding with these instructions. Older - versions and other Linux distributions usually work, but if you encounter problems try - using one of the officially supported options.</p> + <p>Windows 10, macOS Catalina, Arch Linux, Debian buster and Ubuntu 20.04 LTS are the + officially supported operating systems for installing GrapheneOS. You should make sure + your operating system is up-to-date before proceeding with these instructions. Older + versions and other Linux distributions usually work, but if you encounter problems try + using one of the officially supported options.</p> - <p>You need one of the officially supported devices. To make sure that the device can - be unlocked to install GrapheneOS, avoid carrier variants of the devices. Carrier - variants of Pixels use the same stock OS and firmware with a non-zero carrier id - flashed onto the persist partition in the factory. The carrier id activates - carrier-specific configuration in the stock OS including disabling carrier and - bootloader unlocking. The carrier may be able to remotely disable this, but their - support staff may not be aware and they probably won't do it. Get a carrier agnostic - device to avoid the risk and potential hassle. If you CAN figure out a way to unlock a - carrier device, it isn't a problem as GrapheneOS can just ignore the carrier id and - it's otherwise the same.</p> + <p>You need one of the officially supported devices. To make sure that the device can + be unlocked to install GrapheneOS, avoid carrier variants of the devices. Carrier + variants of Pixels use the same stock OS and firmware with a non-zero carrier id + flashed onto the persist partition in the factory. The carrier id activates + carrier-specific configuration in the stock OS including disabling carrier and + bootloader unlocking. The carrier may be able to remotely disable this, but their + support staff may not be aware and they probably won't do it. Get a carrier agnostic + device to avoid the risk and potential hassle. If you CAN figure out a way to unlock a + carrier device, it isn't a problem as GrapheneOS can just ignore the carrier id and + it's otherwise the same.</p> - <p>It's best practice to update the stock OS on the device to make sure it's running - the latest firmware before proceeding with these instructions. This avoids running - into bugs, missing features or other differences in older firmware versions. You can - either update the device via over-the-air updates or sideload a full update, which for - Pixel phones can be obtained from the - <a href="https://developers.google.com/android/ota">full update package page</a>.</p> + <p>It's best practice to update the stock OS on the device to make sure it's running + the latest firmware before proceeding with these instructions. This avoids running + into bugs, missing features or other differences in older firmware versions. You can + either update the device via over-the-air updates or sideload a full update, which for + Pixel phones can be obtained from the + <a href="https://developers.google.com/android/ota">full update package page</a>.</p> - <p>These instructions use command-line tools. On Windows, use PowerShell rather than - the legacy Command Prompt.</p> + <p>These instructions use command-line tools. On Windows, use PowerShell rather than + the legacy Command Prompt.</p> - <h3 id="obtaining-fastboot"> - <a href="#obtaining-fastboot">Obtaining fastboot</a> - </h3> + <section id="obtaining-fastboot"> + <h3><a href="#obtaining-fastboot">Obtaining fastboot</a></h3> - <p>You need an updated copy of the <code>fastboot</code> tool and it needs to be - included in your <code>PATH</code> environment variable. You can run <code>fastboot - --version</code> to determine the current version. It must be at least - <code>29.0.6</code>. You can use a distribution package for this, but most of them - mistakenly package development snapshots of fastboot, clobber the standard version - scheme for platform-tools (adb, fastboot, etc.) with their own scheme and don't keep - it up-to-date despite that being crucial.</p> + <p>You need an updated copy of the <code>fastboot</code> tool and it needs to be + included in your <code>PATH</code> environment variable. You can run <code>fastboot + --version</code> to determine the current version. It must be at least + <code>29.0.6</code>. You can use a distribution package for this, but most of them + mistakenly package development snapshots of fastboot, clobber the standard version + scheme for platform-tools (adb, fastboot, etc.) with their own scheme and don't keep + it up-to-date despite that being crucial.</p> - <p>List of distribution packages:</p> + <p>List of distribution packages:</p> - <ul> - <li>Arch Linux: <code>android-tools</code> provides fastboot and other useful - tools not required for installation such as adb. <code>android-udev</code> - provides udev rules allowing fastboot and adb to work in local sessions - without root.</li> - <li>Debian and Ubuntu: <code>android-sdk-platform-tools-common</code> provides - udev rules allowing fastboot and adb to work in local sessions without root. - The udev rules in Debian and Ubuntu are out-of-date, but it has the necessary - entries for Pixel phones. The adb and fastboot packages are currently both - broken and far too out-of-date to be any use, so avoid those. The version - check in the flashing script will prevent accidentally using these.</li> - </ul> + <ul> + <li>Arch Linux: <code>android-tools</code> provides fastboot and other useful + tools not required for installation such as adb. <code>android-udev</code> + provides udev rules allowing fastboot and adb to work in local sessions + without root.</li> + <li>Debian and Ubuntu: <code>android-sdk-platform-tools-common</code> provides + udev rules allowing fastboot and adb to work in local sessions without root. + The udev rules in Debian and Ubuntu are out-of-date, but it has the necessary + entries for Pixel phones. The adb and fastboot packages are currently both + broken and far too out-of-date to be any use, so avoid those. The version + check in the flashing script will prevent accidentally using these.</li> + </ul> - <h4 id="standalone-platform-tools"> - <a href="#standalone-platform-tools">Standalone platform-tools</a> - </h4> + <section id="standalone-platform-tools"> + <h4><a href="#standalone-platform-tools">Standalone platform-tools</a></h4> - <p>If your operating system doesn't make a proper version of fastboot available, - consider using the - <a href="https://developer.android.com/studio/releases/platform-tools">standalone - releases of platform-tools from Google</a>. If you have the Android SDK or intend to - do development work, you install the platform-tools package via the Android SDK - package manager which can be used to keep it up-to-date. The Android SDK is available - by itself or can be obtained via Android Studio.</p> + <p>If your operating system doesn't make a proper version of fastboot available, + consider using the + <a href="https://developer.android.com/studio/releases/platform-tools">standalone + releases of platform-tools from Google</a>. If you have the Android SDK or intend to + do development work, you install the platform-tools package via the Android SDK + package manager which can be used to keep it up-to-date. The Android SDK is available + by itself or can be obtained via Android Studio.</p> - <p>To download, verify and extract the standalone platform-tools on Linux:</p> + <p>To download, verify and extract the standalone platform-tools on Linux:</p> - <pre>curl -O https://dl.google.com/android/repository/platform-tools_r30.0.5-linux.zip + <pre>curl -O https://dl.google.com/android/repository/platform-tools_r30.0.5-linux.zip echo 'd6d72d006c03bd55d49b6cef9f00295db02f0a31da10e121427e1f4cb43e7cb9 platform-tools_r30.0.5-linux.zip' | sha256sum -c unzip platform-tools_r30.0.5-linux.zip</pre> - <p>To download, verify and extract the standalone platform-tools on macOS:</p> + <p>To download, verify and extract the standalone platform-tools on macOS:</p> - <pre>curl -O https://dl.google.com/android/repository/eabcd8b4b7ab518c6af9c941af8494072f17ec4b.platform-tools_r30.0.5-darwin.zip + <pre>curl -O https://dl.google.com/android/repository/eabcd8b4b7ab518c6af9c941af8494072f17ec4b.platform-tools_r30.0.5-darwin.zip echo 'SHA256 (eabcd8b4b7ab518c6af9c941af8494072f17ec4b.platform-tools_r30.0.5-darwin.zip) = e5780bad71a53cf9d693e1053a0748f49e4a67cc1f71d16a94ab4c943af3345f' | shasum -c tar xvf fbad467867e935dce68a0296b00e6d1e76f15b15.platform-tools_r30.0.5-darwin.zip</pre> - <p>To download, verify and extract the standalone platform-tools on Windows:</p> + <p>To download, verify and extract the standalone platform-tools on Windows:</p> - <pre>curl.exe -O https://dl.google.com/android/repository/platform-tools_r30.0.5-windows.zip + <pre>curl.exe -O https://dl.google.com/android/repository/platform-tools_r30.0.5-windows.zip (Get-FileHash platform-tools_r30.0.5-windows.zip).hash -eq "549ba2bdc31f335eb8a504f005f77606a479cc216d6b64a3e8b64c780003661f" tar xvf platform-tools_r30.0.5-windows.zip</pre> - <p>Next, add the tools to your <code>PATH</code> in the current shell so they can be - used without referencing them by file path, enabling usage by the flashing script.</p> + <p>Next, add the tools to your <code>PATH</code> in the current shell so they can be + used without referencing them by file path, enabling usage by the flashing script.</p> - <p>On Linux and macOS:</p> + <p>On Linux and macOS:</p> - <pre>export PATH="$PWD/platform-tools:$PATH"</pre> + <pre>export PATH="$PWD/platform-tools:$PATH"</pre> - <p>On Windows:</p> + <p>On Windows:</p> - <pre>$env:Path = "$pwd\platform-tools;$env:Path"</pre> + <pre>$env:Path = "$pwd\platform-tools;$env:Path"</pre> - <p>Sample output from <code>fastboot --version</code> afterwards:</p> + <p>Sample output from <code>fastboot --version</code> afterwards:</p> - <pre>fastboot version 30.0.5-6877874 + <pre>fastboot version 30.0.5-6877874 Installed as /home/username/downloads/platform-tools/fastboot</pre> - <p>This is a temporary change to <code>PATH</code> for the current shell and will need - to be done again if you open a new terminal. Make sure that the <code>fastboot</code> - command works in the current shell before trying to run the flashing script.</p> + <p>This is a temporary change to <code>PATH</code> for the current shell and will need + to be done again if you open a new terminal. Make sure that the <code>fastboot</code> + command works in the current shell before trying to run the flashing script.</p> + </section> + </section> - <h3 id="obtaining-signify"> - <a href="#obtaining-signify">Obtaining signify</a> - </h3> + <section id="obtaining-signify"> + <h3><a href="#obtaining-signify">Obtaining signify</a></h3> - <p>To verify the download of the OS beyond the security offered by HTTPS, you can use - the signify tool. If you do not have a way to obtain signify from a package repository - you're already trusting, it does not make sense to use it. GrapheneOS releases are - hosted on our servers and we do not have third party mirrors. A compromised signify - would be able to compromise your OS and the GrapheneOS download due to the lack of an - application security model on traditional operating systems. It would be worse than - not trying to verify the signatures. It's far less likely that our servers would be - compromised than someone's GitHub account or GitHub itself. You're already trusting - these installation instructions from our site, which is hosted on the same static web - server infrastructure as the releases.</p> + <p>To verify the download of the OS beyond the security offered by HTTPS, you can use + the signify tool. If you do not have a way to obtain signify from a package repository + you're already trusting, it does not make sense to use it. GrapheneOS releases are + hosted on our servers and we do not have third party mirrors. A compromised signify + would be able to compromise your OS and the GrapheneOS download due to the lack of an + application security model on traditional operating systems. It would be worse than + not trying to verify the signatures. It's far less likely that our servers would be + compromised than someone's GitHub account or GitHub itself. You're already trusting + these installation instructions from our site, which is hosted on the same static web + server infrastructure as the releases.</p> - <p>List of distribution packages:</p> + <p>List of distribution packages:</p> - <ul> - <li>Arch Linux: <code>signify</code></li> - <li>Debian: <code>signify-openbsd</code> with the command renamed to <code>signify-openbsd</code></li> - <li>Ubuntu: <code>signify-openbsd</code> with the command renamed to <code>signify-openbsd</code></li> - </ul> + <ul> + <li>Arch Linux: <code>signify</code></li> + <li>Debian: <code>signify-openbsd</code> with the command renamed to <code>signify-openbsd</code></li> + <li>Ubuntu: <code>signify-openbsd</code> with the command renamed to <code>signify-openbsd</code></li> + </ul> - <p>On Debian-based distributions, the <code>signify</code> package and command are an - <a href="http://signify.sourceforge.net/" rel="nofollow">unmaintained mail-related - tool for generating mail signatures (not cryptographic signatures)</a> with the final - releases from 2003-2004 made directly by the developer via the Debian package without - upstream releases. Please pressure them to correct this usability issue.</p> + <p>On Debian-based distributions, the <code>signify</code> package and command are an + <a href="http://signify.sourceforge.net/" rel="nofollow">unmaintained mail-related + tool for generating mail signatures (not cryptographic signatures)</a> with the final + releases from 2003-2004 made directly by the developer via the Debian package without + upstream releases. Please pressure them to correct this usability issue.</p> + </section> + </section> - <h2 id="enabling-oem-unlocking"> - <a href="#enabling-oem-unlocking">Enabling OEM unlocking</a> - </h2> + <section id="enabling-oem-unlocking"> + <h2><a href="#enabling-oem-unlocking">Enabling OEM unlocking</a></h2> - <p>OEM unlocking needs to be enabled from within the operating system.</p> + <p>OEM unlocking needs to be enabled from within the operating system.</p> - <p>Enable the developer options menu by going to Settings ➔ About phone and - pressing on the build number menu entry until developer mode is enabled.</p> + <p>Enable the developer options menu by going to Settings ➔ About phone and + pressing on the build number menu entry until developer mode is enabled.</p> - <p>Next, go to Settings ➔ System ➔ Advanced ➔ Developer options and toggle on the - 'Enable OEM unlocking' setting. This requires internet access on devices with Google - Play services as part of Factory Reset Protection (FRP) for anti-theft protection.</p> + <p>Next, go to Settings ➔ System ➔ Advanced ➔ Developer options and toggle on the + 'Enable OEM unlocking' setting. This requires internet access on devices with Google + Play services as part of Factory Reset Protection (FRP) for anti-theft protection.</p> + </section> - <h2 id="unlocking-the-bootloader"> - <a href="#unlocking-the-bootloader">Unlocking the bootloader</a> - </h2> + <section id="unlocking-the-bootloader"> + <h2><a href="#unlocking-the-bootloader">Unlocking the bootloader</a></h2> - <p>First, boot into the bootloader interface. You can do this by turning off the - device and then turning it on by holding both the Volume Down and Power buttons.</p> + <p>First, boot into the bootloader interface. You can do this by turning off the + device and then turning it on by holding both the Volume Down and Power buttons.</p> - <p>Unlock the bootloader to allow flashing the OS and firmware:</p> + <p>Unlock the bootloader to allow flashing the OS and firmware:</p> - <pre>fastboot flashing unlock</pre> + <pre>fastboot flashing unlock</pre> - <p>The command needs to be confirmed on the device and will wipe all data.</p> + <p>The command needs to be confirmed on the device and will wipe all data.</p> + </section> - <h2 id="obtaining-factory-images"> - <a href="#obtaining-factory-images">Obtaining factory images</a> - </h2> + <section id="obtaining-factory-images"> + <h2><a href="#obtaining-factory-images">Obtaining factory images</a></h2> - <p>You need to obtain the GrapheneOS factory images for your device to proceed with - the installation process.</p> + <p>You need to obtain the GrapheneOS factory images for your device to proceed with + the installation process.</p> - <p>You can either download the files with your browser or using a command like - <code>curl</code>. It's generally easier to use the command-line since you're already - using it for the rest of the installation process, so these instructions use - <code>curl</code>.</p> + <p>You can either download the files with your browser or using a command like + <code>curl</code>. It's generally easier to use the command-line since you're already + using it for the rest of the installation process, so these instructions use + <code>curl</code>.</p> - <p>On Windows, remove PowerShell's legacy curl alias for the current shell to avoid - needing to reference it as <code>curl.exe</code> instead of <code>curl</code>:</p> + <p>On Windows, remove PowerShell's legacy curl alias for the current shell to avoid + needing to reference it as <code>curl.exe</code> instead of <code>curl</code>:</p> - <pre>Remove-Item Alias:Curl</pre> + <pre>Remove-Item Alias:Curl</pre> - <p>Download <a href="https://releases.grapheneos.org/factory.pub">the factory images - public key (factory.pub)</a> in order to verify the factory images:</p> + <p>Download <a href="https://releases.grapheneos.org/factory.pub">the factory images + public key (factory.pub)</a> in order to verify the factory images:</p> - <pre>curl -O https://releases.grapheneos.org/factory.pub</pre> + <pre>curl -O https://releases.grapheneos.org/factory.pub</pre> - <p>This is the content of <code>factory.pub</code>:</p> + <p>This is the content of <code>factory.pub</code>:</p> - <pre>untrusted comment: GrapheneOS factory images public key + <pre>untrusted comment: GrapheneOS factory images public key RWQZW9NItOuQYJ86EooQBxScfclrWiieJtAO9GpnfEjKbCO/3FriLGX3</pre> - <p>The public key has also been published via the official - <a href="https://twitter.com/GrapheneOS/status/1145259815851253762">@GrapheneOS Twitter - account</a>, - <a href="https://www.reddit.com/r/GrapheneOS/comments/c7gb3f/grapheneos_factory_images_are_now_signed_with/esewpm9">the /u/GrapheneOS - Reddit account</a> and <a href="https://github.com/GrapheneOS/releases.grapheneos.org/blob/master/static/factory.pub">is available on GitHub</a>. - When the current signing key is replaced, the new key will be signed with it.</p> + <p>The public key has also been published via the official + <a href="https://twitter.com/GrapheneOS/status/1145259815851253762">@GrapheneOS Twitter + account</a>, + <a href="https://www.reddit.com/r/GrapheneOS/comments/c7gb3f/grapheneos_factory_images_are_now_signed_with/esewpm9">the /u/GrapheneOS + Reddit account</a> and <a href="https://github.com/GrapheneOS/releases.grapheneos.org/blob/master/static/factory.pub">is available on GitHub</a>. + When the current signing key is replaced, the new key will be signed with it.</p> - <p>Download the factory images for the device from <a href="/releases">the releases - page</a>. For example, to download the 2020.11.05.18 release for the Pixel 4a (sunfish):</p> + <p>Download the factory images for the device from <a href="/releases">the releases + page</a>. For example, to download the 2020.11.05.18 release for the Pixel 4a (sunfish):</p> - <pre>curl -O https://releases.grapheneos.org/sunfish-factory-2020.11.05.18.zip + <pre>curl -O https://releases.grapheneos.org/sunfish-factory-2020.11.05.18.zip curl -O https://releases.grapheneos.org/sunfish-factory-2020.11.05.18.zip.sig</pre> - <p>Verify the factory images using the signature if you were able to obtain - <code>signify</code> from trusted package repositories (see above):</p> + <p>Verify the factory images using the signature if you were able to obtain + <code>signify</code> from trusted package repositories (see above):</p> - <pre>signify -Cqp factory.pub -x sunfish-factory-2020.11.05.18.zip.sig && echo verified</pre> + <pre>signify -Cqp factory.pub -x sunfish-factory-2020.11.05.18.zip.sig && echo verified</pre> - <p>This will output <code>verified</code> if verification is successful. If something - goes wrong, it will output an error message rather than <code>verified</code>.</p> + <p>This will output <code>verified</code> if verification is successful. If something + goes wrong, it will output an error message rather than <code>verified</code>.</p> + </section> - <h2 id="flashing-factory-images"> - <a href="#flashing-factory-images">Flashing factory images</a> - </h2> + <section id="flashing-factory-images"> + <h2><a href="#flashing-factory-images">Flashing factory images</a></h2> - <p>The initial install will be performed by flashing the factory images. This will - replace the existing OS installation and wipe all the existing data.</p> + <p>The initial install will be performed by flashing the factory images. This will + replace the existing OS installation and wipe all the existing data.</p> - <p>Next, extract the factory images.</p> + <p>Next, extract the factory images.</p> - <p>On Linux:</p> + <p>On Linux:</p> - <pre>unzip sunfish-factory-2020.11.05.18.zip</pre> + <pre>unzip sunfish-factory-2020.11.05.18.zip</pre> - <p>On macOS and Windows:</p> + <p>On macOS and Windows:</p> - <pre>tar xvf sunfish-factory-2020.11.05.18.zip</pre> + <pre>tar xvf sunfish-factory-2020.11.05.18.zip</pre> - <p>Move into the directory:</p> + <p>Move into the directory:</p> - <pre>cd sunfish-factory-2020.11.05.18</pre> + <pre>cd sunfish-factory-2020.11.05.18</pre> - <p>Flash the images with the flash-all script in the directory.</p> + <p>Flash the images with the flash-all script in the directory.</p> - <p>On Linux and macOS:</p> + <p>On Linux and macOS:</p> - <pre>./flash-all.sh</pre> + <pre>./flash-all.sh</pre> - <p>On Windows:</p> + <p>On Windows:</p> - <pre>./flash-all.bat</pre> + <pre>./flash-all.bat</pre> - <p>Wait for the flashing process to complete and proceed to <a href="#locking-the-bootloader">locking the bootloader</a> - before using the device as locking wipes the data again.</p> + <p>Wait for the flashing process to complete and proceed to <a href="#locking-the-bootloader">locking the bootloader</a> + before using the device as locking wipes the data again.</p> - <h3 id="troubleshooting"> - <a href="#troubleshooting">Troubleshooting</a> - </h3> + <section id="troubleshooting"> + <h3><a href="#troubleshooting">Troubleshooting</a></h3> - <p>A common issue on Linux distributions is that they mount the default temporary file - directory <code>/tmp</code> as tmpfs which results in it being backed by memory and - swap rather than persistent storage. By default, the size is 50% of the available - virtual memory. This is often not enough for the flashing process, especially since - <code>/tmp</code> is shared between applications and users. To use a different - temporary directory if your <code>/tmp</code> doesn't have enough space available:</p> + <p>A common issue on Linux distributions is that they mount the default temporary file + directory <code>/tmp</code> as tmpfs which results in it being backed by memory and + swap rather than persistent storage. By default, the size is 50% of the available + virtual memory. This is often not enough for the flashing process, especially since + <code>/tmp</code> is shared between applications and users. To use a different + temporary directory if your <code>/tmp</code> doesn't have enough space available:</p> - <pre>mkdir tmp + <pre>mkdir tmp TMPDIR="$PWD/tmp" ./flash-all.sh</pre> - <p>A majority of failed flashes tend to be caused by substandard USB connectors, - plugging in via hubs or bad cables which aren't properly up to the USB standard. The - scrollback from a failed flash will contain valuable diagnostic information which - is essential in knowing where and how the process went wrong.</p> + <p>A majority of failed flashes tend to be caused by substandard USB connectors, + plugging in via hubs or bad cables which aren't properly up to the USB standard. The + scrollback from a failed flash will contain valuable diagnostic information which + is essential in knowing where and how the process went wrong.</p> - <p>Front I/O ports on desktop computer cases and USB 3.1 or USB C on many laptops - often aren't implemented properly or are broken in subtle ways, which may cause flashing - to fail even on a USB port that works for other peripherals. Older Linux kernels that - predate version 5 may have inadequate or patchwork support for USB C or USB 3. If you - are installing from a Linux distribution, ensure your distribution uses a modern - kernel.</p> + <p>Front I/O ports on desktop computer cases and USB 3.1 or USB C on many laptops + often aren't implemented properly or are broken in subtle ways, which may cause flashing + to fail even on a USB port that works for other peripherals. Older Linux kernels that + predate version 5 may have inadequate or patchwork support for USB C or USB 3. If you + are installing from a Linux distribution, ensure your distribution uses a modern + kernel.</p> - <p>Always use a high quality USB A to USB C cable with a rear USB port directly on your - motherboard, and never use a USB hub for flashing. <em>Never install from a virtual - machine;</em> USB passthrough in software emulation may be broken or inadequate and this - can cause the flashing to fail.</p> + <p>Always use a high quality USB A to USB C cable with a rear USB port directly on your + motherboard, and never use a USB hub for flashing. <em>Never install from a virtual + machine;</em> USB passthrough in software emulation may be broken or inadequate and this + can cause the flashing to fail.</p> + </section> + </section> - <h2 id="locking-the-bootloader"> - <a href="#locking-the-bootloader">Locking the bootloader</a> - </h2> + <section id="locking-the-bootloader"> + <h2><a href="#locking-the-bootloader">Locking the bootloader</a></h2> - <p>Locking the bootloader is important as it enables full verified boot. It also - prevents using fastboot to flash, format or erase partitions. Verified boot will - detect modifications to any of the OS partitions (vbmeta, boot/dtbo, product, system, - vendor) and it will prevent reading any modified / corrupted data. If changes are - detected, error correction data is used to attempt to obtain the original data at - which point it's verified again which makes verified boot robust to non-malicious - corruption.</p> + <p>Locking the bootloader is important as it enables full verified boot. It also + prevents using fastboot to flash, format or erase partitions. Verified boot will + detect modifications to any of the OS partitions (vbmeta, boot/dtbo, product, system, + vendor) and it will prevent reading any modified / corrupted data. If changes are + detected, error correction data is used to attempt to obtain the original data at + which point it's verified again which makes verified boot robust to non-malicious + corruption.</p> - <p>In the bootloader interface, set it to locked:</p> + <p>In the bootloader interface, set it to locked:</p> - <pre>fastboot flashing lock</pre> + <pre>fastboot flashing lock</pre> - <p>The command needs to be confirmed on the device since it needs to perform a factory - reset.</p> + <p>The command needs to be confirmed on the device since it needs to perform a factory + reset.</p> - <p>Unlocking the bootloader again will perform a factory reset.</p> + <p>Unlocking the bootloader again will perform a factory reset.</p> + </section> - <h2 id="disabling-oem-unlocking"> - <a href="#disabling-oem-unlocking">Disabling OEM unlocking</a> - </h2> + <section id="disabling-oem-unlocking"> + <h2><a href="#disabling-oem-unlocking">Disabling OEM unlocking</a></h2> - <p>OEM unlocking can be disabled again in the developer settings menu within the - operating system after booting it up again.</p> + <p>OEM unlocking can be disabled again in the developer settings menu within the + operating system after booting it up again.</p> + </section> - <h2 id="verifying-installation"> - <a href="#verifying-installation">Verifying installation</a> - </h2> + <section id="verifying-installation"> + <h2><a href="#verifying-installation">Verifying installation</a></h2> - <p>Verified boot authenticates and validates the firmware images and OS from the - hardware root of trust. Since GrapheneOS supports full verified boot, the OS images - are entirely verified. However, it's possible that the computer you used to flash the - OS was compromised, leading to flashing a malicious verified boot public key and - images. To detect this kind of attack, you can use the Auditor app included in - GrapheneOS in the Auditee mode and verify it with another Android device in the - Auditor mode. The Auditor app works best once it's already paired with a device and - has pinned a persistent hardware-backed key and the attestation certificate chain. - However, it can still provide a bit of security for the initial verification via the - attestation root. Ideally, you should also do this before connecting the device to the - network, so an attacker can't proxy to another device (which stops being possible - after the initial verification). Further protection against proxying the initial - pairing will be provided in the future via optional support for ID attestation to - include the serial number in the hardware verified information to allow checking - against the one on the box / displayed in the bootloader. See the - <a href="https://attestation.app/tutorial">Auditor tutorial</a> for a guide.</p> + <p>Verified boot authenticates and validates the firmware images and OS from the + hardware root of trust. Since GrapheneOS supports full verified boot, the OS images + are entirely verified. However, it's possible that the computer you used to flash the + OS was compromised, leading to flashing a malicious verified boot public key and + images. To detect this kind of attack, you can use the Auditor app included in + GrapheneOS in the Auditee mode and verify it with another Android device in the + Auditor mode. The Auditor app works best once it's already paired with a device and + has pinned a persistent hardware-backed key and the attestation certificate chain. + However, it can still provide a bit of security for the initial verification via the + attestation root. Ideally, you should also do this before connecting the device to the + network, so an attacker can't proxy to another device (which stops being possible + after the initial verification). Further protection against proxying the initial + pairing will be provided in the future via optional support for ID attestation to + include the serial number in the hardware verified information to allow checking + against the one on the box / displayed in the bootloader. See the + <a href="https://attestation.app/tutorial">Auditor tutorial</a> for a guide.</p> - <p>After the initial verification, which results in pairing, performing verification - against between the same Auditor and Auditee (as long as the app data hasn't been - cleared) will provide strong validation of the identity and integrity of the - device. That makes it best to get the pairing done right after installation. You can - also consider setting up the optional remote attestation service.</p> + <p>After the initial verification, which results in pairing, performing verification + against between the same Auditor and Auditee (as long as the app data hasn't been + cleared) will provide strong validation of the identity and integrity of the + device. That makes it best to get the pairing done right after installation. You can + also consider setting up the optional remote attestation service.</p> + </section> - <h2 id="replacing-grapheneos-with-the-stock-os"> - <a href="#replacing-grapheneos-with-the-stock-os">Replacing GrapheneOS with the stock OS</a> - </h2> + <section id="replacing-grapheneos-with-the-stock-os"> + <h2><a href="#replacing-grapheneos-with-the-stock-os">Replacing GrapheneOS with the stock OS</a></h2> - <p>Installation of the stock OS via the stock factory images is the same process - described above. However, before locking, there's an additional step to fully revert - the device to a clean factory state.</p> + <p>Installation of the stock OS via the stock factory images is the same process + described above. However, before locking, there's an additional step to fully revert + the device to a clean factory state.</p> - <p>The GrapheneOS factory images flash a non-stock Android Verified Boot key which - needs to be erased to fully revert back to a stock device state. After flashing the - stock factory images and before locking the bootloader, you should erase the custom - Android Verified Boot key to untrust it:</p> + <p>The GrapheneOS factory images flash a non-stock Android Verified Boot key which + needs to be erased to fully revert back to a stock device state. After flashing the + stock factory images and before locking the bootloader, you should erase the custom + Android Verified Boot key to untrust it:</p> - <pre>fastboot erase avb_custom_key</pre> + <pre>fastboot erase avb_custom_key</pre> + </section> </main> <footer> <a href="/"><img src="/logo.png" width="512" height="512" alt=""/>GrapheneOS</a> |