Web install

- -

This is a highly experimental WebUSB-based installer for GrapheneOS. Use it - at your own risk. Use the official install guide until this has - been more thoroughly tested and improved.

- -

Prerequisites

- -

You should have at least 2GB of free memory available and 8GB of free storage - space.

- -

You need a USB cable for attaching the device to a laptop or desktop. Whenever - possible, use the high quality standards compliant USB-C cable packaged with the - device. If your computer doesn't have any USB-C ports, you'll need a high quality - USB-C to USB-A cable. You should avoid using a USB hub such as the front panel on - a desktop computer case. Connect directly to a rear port on a desktop or the ports - on a laptop. Many widely distributed USB cables and hubs are broken and are the - most common source of issues for installing GrapheneOS.

- -

Installing from an OS in a virtual machine is not recommended. USB passthrough - is often not reliable. To rule out these problems, install from an OS running on - bare metal. Virtual machines are also often configured to have overly limited - memory and storage space.

- -

Windows 10, macOS Big Sur, Arch Linux, Debian buster and Ubuntu 20.04 LTS are the - officially supported operating systems for installing GrapheneOS. You should make sure - your operating system is up-to-date before proceeding with these instructions. Older - versions and other Linux distributions usually work, but if you encounter problems try - using one of the officially supported options.

- -

For this web-based installation process, the latest stable release of Chromium - or Chrome is recommended.

- -

You need one of the officially supported devices. To make sure that the device can - be unlocked to install GrapheneOS, avoid carrier variants of the devices. Carrier - variants of Pixels use the same stock OS and firmware with a non-zero carrier id - flashed onto the persist partition in the factory. The carrier id activates - carrier-specific configuration in the stock OS including disabling carrier and - bootloader unlocking. The carrier may be able to remotely disable this, but their - support staff may not be aware and they probably won't do it. Get a carrier agnostic - device to avoid the risk and potential hassle. If you CAN figure out a way to unlock a - carrier device, it isn't a problem as GrapheneOS can just ignore the carrier id - and the hardware is the same.

- -

It's best practice to update the stock OS on the device to make sure it's running - the latest firmware before proceeding with these instructions. This avoids running - into bugs, missing features or other differences in older firmware versions. You can - either update the device via over-the-air updates or sideload a full update, which for - Pixel phones can be obtained from the - full update package page.

- -

Enabling OEM unlocking

- -

OEM unlocking needs to be enabled from within the operating system.

- -

Enable the developer options menu by going to Settings ➔ About phone and - pressing on the build number menu entry until developer mode is enabled.

- -

Next, go to Settings ➔ System ➔ Advanced ➔ Developer options and toggle on the - 'Enable OEM unlocking' setting. This requires internet access on devices with Google - Play services as part of Factory Reset Protection (FRP) for anti-theft protection.

- -

Connecting the phone

- -

Connect the phone to the computer. On Linux, you'll need to do this again if - you didn't have the udev rules set up when you connected it.

- -

Unlocking the bootloader

- -

First, boot into the bootloader interface. You can do this by turning off the - device and then turning it on by holding both the Volume Down and Power buttons.

- -

Unlock the bootloader to allow flashing the OS and firmware:

- - - -

The command needs to be confirmed on the device and will wipe all data. Use one - of the volume keys to switch the selection to accepting it and the power button to - confirm.

- -

Obtaining factory images

- -

You need to obtain the GrapheneOS factory images for your device to proceed with - the installation process.

- -

Press the button below to start the download:

- - - -

- -

Flashing factory images

- -

The initial install will be performed by flashing the factory images. This will - replace the existing OS installation and wipe all the existing data.

- - - -

Wait for the flashing process to complete and proceed to - locking the bootloader before using the - device as locking wipes the data again.

- -

Locking the bootloader

- -

Locking the bootloader is important as it enables full verified boot. It also - prevents using fastboot to flash, format or erase partitions. Verified boot will - detect modifications to any of the OS partitions and it will prevent reading any - modified / corrupted data. If changes are detected, error correction data is used - to attempt to obtain the original data at which point it's verified again which - makes verified boot robust to non-malicious corruption.

- -

In the bootloader interface, set it to locked:

- - - -

The command needs to be confirmed on the device and will wipe all data. Use one - of the volume buttons to switch the selection to accepting it and the power button - to confirm.

- -

Post-installation

- -

Booting

- -

You've now successfully installed GrapheneOS and can boot it. Pressing the - power button with the default Start option selected in the bootloader menu - will boot the OS.

- -

Disabling OEM unlocking

- -

OEM unlocking can be disabled again in the developer settings menu within the - operating system after booting it up again.

- -

Verifying installation

- -

Verified boot authenticates and validates the firmware images and OS from the - hardware root of trust. Since GrapheneOS supports full verified boot, the OS images - are entirely verified. However, it's possible that the computer you used to flash the - OS was compromised, leading to flashing a malicious verified boot public key and - images. To detect this kind of attack, you can use the Auditor app included in - GrapheneOS in the Auditee mode and verify it with another Android device in the - Auditor mode. The Auditor app works best once it's already paired with a device and - has pinned a persistent hardware-backed key and the attestation certificate chain. - However, it can still provide a bit of security for the initial verification via the - attestation root. Ideally, you should also do this before connecting the device to the - network, so an attacker can't proxy to another device (which stops being possible - after the initial verification). Further protection against proxying the initial - pairing will be provided in the future via optional support for ID attestation to - include the serial number in the hardware verified information to allow checking - against the one on the box / displayed in the bootloader. See the - Auditor tutorial for a guide.

- -

After the initial verification, which results in pairing, performing verification - against between the same Auditor and Auditee (as long as the app data hasn't been - cleared) will provide strong validation of the identity and integrity of the - device. That makes it best to get the pairing done right after installation. You can - also consider setting up the optional remote attestation service.

- -

Further information

- -

Please look through the usage guide and - FAQ for more information. If you have further questions not - covered by the site, join the official GrapheneOS - chat channels and ask the questions in the appropriate channel.