1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
|
<!DOCTYPE html>
<html lang="en" prefix="og: http://ogp.me/ns#">
<head>
<meta charset="utf-8"/>
<title>Install | GrapheneOS</title>
<meta name="description" content="Installation instructions for GrapheneOS, a security and privacy focused mobile OS with Android app compatibility."/>
<meta name="theme-color" content="#212121"/>
<meta name="msapplication-TileColor" content="#ffffff"/>
<meta name="viewport" content="width=device-width, initial-scale=1"/>
<meta name="twitter:site" content="@GrapheneOS"/>
<meta name="twitter:creator" content="@GrapheneOS"/>
<meta property="og:title" content="GrapheneOS install documentation"/>
<meta property="og:description" content="Installation instructions for GrapheneOS, a security and privacy focused mobile OS with Android app compatibility."/>
<meta property="og:type" content="website"/>
<meta property="og:image" content="https://grapheneos.org/opengraph.png"/>
<meta property="og:image:width" content="512"/>
<meta property="og:image:height" content="512"/>
<meta property="og:image:alt" content="GrapheneOS logo"/>
<meta property="og:url" content="https://grapheneos.org/install"/>
<meta property="og:site_name" content="GrapheneOS"/>
<link rel="icon" type="image/vnd.microsoft.icon" href="/favicon.ico"/>
<link rel="mask-icon" href="/mask-icon.svg" color="#1a1a1a"/>
<link rel="stylesheet" href="/grapheneos.css?18"/>
<link rel="manifest" href="/manifest.webmanifest"/>
<link rel="canonical" href="https://grapheneos.org/install"/>
</head>
<body>
<nav>
<ul>
<li><a href="/">GrapheneOS</a></li>
<li class="active"><a href="/install">Install</a></li>
<li><a href="/build">Build</a></li>
<li><a href="/usage">Usage</a></li>
<li><a href="/faq">FAQ</a></li>
<li><a href="/releases">Releases</a></li>
<li><a href="/source">Source</a></li>
<li><a href="/donate">Donate</a></li>
<li><a href="/contact">Contact</a></li>
</ul>
</nav>
<div id="content">
<h1 id="install">
<a href="#install">Install</a>
</h1>
<p>This is a guide on installing GrapheneOS for the officially supported devices. It
can be followed for both the official releases and custom builds.</p>
<h2 id="table-of-contents">
<a href="#table-of-contents">Table of contents</a>
</h2>
<ul>
<li>
<a href="#prerequisites">Prerequisites</a>
<ul>
<li>
<a href="#obtaining-fastboot">Obtaining fastboot</a>
<ul>
<li><a href="#standalone-platform-tools">Standalone platform-tools</a></li>
</ul>
</li>
<li><a href="#obtaining-signify">Obtaining signify</a></li>
</ul>
</li>
<li><a href="#enabling-oem-unlocking">Enabling OEM unlocking</a></li>
<li><a href="#unlocking-the-bootloader">Unlocking the bootloader</a></li>
<li><a href="#obtaining-factory-images">Obtaining factory images</a></li>
<li>
<a href="#flashing-factory-images">Flashing factory images</a>
<ul>
<li><a href="#troubleshooting">Troubleshooting</a></li>
</ul>
</li>
<li><a href="#locking-the-bootloader">Locking the bootloader</a></li>
<li><a href="#disabling-oem-unlocking">Disabling OEM unlocking</a></li>
<li><a href="#verifying-installation">Verifying installation</a></li>
<li><a href="#replacing-grapheneos-with-the-stock-os">Replacing GrapheneOS with the stock OS</a></li>
</ul>
<h2 id="prerequisites">
<a href="#prerequisites">Prerequisites</a>
</h2>
<p>You should have at least 2GB of free memory available.</p>
<p>Windows 10, macOS Catalina, Arch Linux, Debian buster and Ubuntu 20.04 LTS are the
officially supported operating systems for installing GrapheneOS. You should make sure
your operating system is up-to-date before proceeding with these instructions. Older
versions and other Linux distributions usually work, but if you encounter problems try
using one of the officially supported options.</p>
<p>You need one of the officially supported devices. To make sure that the device can
be unlocked to install GrapheneOS, avoid carrier variants of the devices. Carrier
variants of Pixels use the same stock OS and firmware with a non-zero carrier id
flashed onto the persist partition in the factory. The carrier id activates
carrier-specific configuration in the stock OS including disabling carrier and
bootloader unlocking. The carrier may be able to remotely disable this, but their
support staff may not be aware and they probably won't do it. Get a carrier agnostic
device to avoid the risk and potential hassle. If you CAN figure out a way to unlock a
carrier device, it isn't a problem as GrapheneOS can just ignore the carrier id and
it's otherwise the same.</p>
<p>It's best practice to update the stock OS on the device to make sure it's running
the latest firmware before proceeding with these instructions. This avoids running
into bugs, missing features or other differences in older firmware versions. Early
Pixel 2 and Pixel 2 XL bootloader versions use a non-standard unlocking system not
covered by these installation instructions. You can either update the device via
over-the-air updates or sideload a full update, which for Pixel phones can be obtained
from the <a href="https://developers.google.com/android/ota">full update package
page</a>.</p>
<p>These instructions use command-line tools. On Windows, use PowerShell rather than
the legacy Command Prompt.</p>
<h3 id="obtaining-fastboot">
<a href="#obtaining-fastboot">Obtaining fastboot</a>
</h3>
<p>You need an updated copy of the <code>fastboot</code> tool and it needs to be
included in your <code>PATH</code> environment variable. You can run <code>fastboot
--version</code> to determine the current version. It must be at least
<code>28.0.2</code>. You can use a distribution package for this, but most of them
mistakenly package development snapshots of fastboot, clobber the standard version
scheme for platform-tools (adb, fastboot, etc.) with their own scheme and don't keep
it up-to-date despite that being crucial.</p>
<p>List of distribution packages:</p>
<ul>
<li>Arch Linux: <code>android-tools</code> provides fastboot and other useful
tools not required for installation such as adb. <code>android-udev</code>
provides udev rules allowing fastboot and adb to work in local sessions
without root.</li>
<li>Debian: package is both broken and out-of-date, do not use (see paragraph
above)</li>
<li>Ubuntu: package is both broken and out-of-date, do not use (see paragraph
above)</li>
</ul>
<h4 id="standalone-platform-tools">
<a href="#standalone-platform-tools">Standalone platform-tools</a>
</h4>
<p>If your operating system doesn't make a proper version of fastboot available,
consider using the
<a href="https://developer.android.com/studio/releases/platform-tools">standalone
releases of platform-tools from Google</a>. If you have the Android SDK or intend to
do development work, you install the platform-tools package via the Android SDK
package manager which can be used to keep it up-to-date. The Android SDK is available
by itself or can be obtained via Android Studio.</p>
<p>To download, verify and extract the standalone platform-tools on Linux:</p>
<pre>curl -O https://dl.google.com/android/repository/platform-tools_r30.0.3-linux.zip
echo '19c74e779f3d81f15ba21207ec405439416d99330c3f5a337dab6d58ea20b465 platform-tools_r30.0.3-linux.zip' | sha256sum -c
unzip platform-tools_r30.0.3-linux.zip</pre>
<p>To download, verify and extract the standalone platform-tools on macOS:</p>
<pre>curl -O https://dl.google.com/android/repository/73f3f0b3034f61563f787bef8ebf51f38df457de.platform-tools_r30.0.3-darwin.zip
echo 'SHA256 (73f3f0b3034f61563f787bef8ebf51f38df457de.platform-tools_r30.0.3-darwin.zip) = 5c533cd87a2024f52b08877eaceea6f32bf2289d8453056f259d86dafbf622a4' | shasum -c
tar xvf 73f3f0b3034f61563f787bef8ebf51f38df457de.platform-tools_r30.0.3-darwin.zip</pre>
<p>To download, verify and extract the standalone platform-tools on Windows:</p>
<pre>curl.exe -O https://dl.google.com/android/repository/platform-tools_r30.0.3-windows.zip
(Get-FileHash platform-tools_r30.0.3-windows.zip).hash -eq "5c8fb6d72da581baa608a38853d05aeeaf920f2ac9ca2cb463d9fd62acb0871b"
tar xvf platform-tools_r30.0.3-windows.zip</pre>
<p>Next, add the tools to your <code>PATH</code> in the current shell so they can be
used without referencing them by file path, enabling usage by the flashing script.</p>
<p>On Linux and macOS:</p>
<pre>export PATH="$PWD/platform-tools:$PATH"</pre>
<p>On Windows:</p>
<pre>$env:Path = "$pwd\platform-tools;$env:Path"</pre>
<p>Sample output from <code>fastboot --version</code> afterwards:</p>
<pre>fastboot version 30.0.3-6597393
Installed as /home/username/downloads/platform-tools/fastboot</pre>
<p>This is a temporary change to <code>PATH</code> for the current shell and will need
to be done again if you open a new terminal. Make sure that the <code>fastboot</code>
command works in the current shell before trying to run the flashing script.</p>
<h3 id="obtaining-signify">
<a href="#obtaining-signify">Obtaining signify</a>
</h3>
<p>To verify the download of the OS beyond the security offered by HTTPS, you can use
the signify tool. If you do not have a way to obtain signify from a package repository
you're already trusting, it does not make sense to use it. GrapheneOS releases are
hosted on our servers and we do not have third party mirrors. A compromised signify
would be able to compromise your OS and the GrapheneOS download due to the lack of an
application security model on traditional operating systems. It would be worse than
not trying to verify the signatures. It's far less likely that our servers would be
compromised than someone's GitHub account or GitHub itself. You're already trusting
these installation instructions from our site, which is hosted on the same static web
server infrastructure as the releases.</p>
<p>List of distribution packages:</p>
<ul>
<li>Arch Linux: <code>signify</code></li>
<li>Debian: <code>signify-openbsd</code> with the command renamed to <code>signify-openbsd</code></li>
<li>Ubuntu: <code>signify-openbsd</code> with the command renamed to <code>signify-openbsd</code></li>
</ul>
<p>On Debian-based distributions, the <code>signify</code> package and command are an
<a href="http://signify.sourceforge.net/" rel="nofollow">unmaintained mail-related
tool for generating mail signatures (not cryptographic signatures)</a> with the final
releases from 2003-2004 made directly by the developer via the Debian package without
upstream releases. Please pressure them to correct this usability issue.</p>
<h2 id="enabling-oem-unlocking">
<a href="#enabling-oem-unlocking">Enabling OEM unlocking</a>
</h2>
<p>OEM unlocking needs to be enabled from within the operating system.</p>
<p>Enable the developer options menu by going to Settings ➔ About phone and
pressing on the build number menu entry until developer mode is enabled.</p>
<p>Next, go to Settings ➔ System ➔ Advanced ➔ Developer options and toggle on the
'Enable OEM unlocking' setting. This requires internet access on devices with Google
Play Services as part of Factory Reset Protection (FRP) for anti-theft protection.</p>
<h2 id="unlocking-the-bootloader">
<a href="#unlocking-the-bootloader">Unlocking the bootloader</a>
</h2>
<p>First, boot into the bootloader interface. You can do this by turning off the
device and then turning it on by holding both the Volume Down and Power buttons.</p>
<p>Unlock the bootloader to allow flashing the OS and firmware:</p>
<pre>fastboot flashing unlock</pre>
<p>The command needs to be confirmed on the device and will wipe all data.</p>
<h2 id="obtaining-factory-images">
<a href="#obtaining-factory-images">Obtaining factory images</a>
</h2>
<p>You need to obtain the GrapheneOS factory images for your device to proceed with
the installation process.</p>
<p>You can either download the files with your browser or using a command like
<code>curl</code>. It's generally easier to use the command-line since you're already
using it for the rest of the installation process, so these instructions use
<code>curl</code>. On Windows, you need to reference <code>curl</code> as
<code>curl.exe</code> since PowerShell has a legacy <code>curl</code> alias.</p>
<p>Download <a href="https://releases.grapheneos.org/factory.pub">the factory images
public key (factory.pub)</a> in order to verify the factory images:</p>
<pre>curl -O https://releases.grapheneos.org/factory.pub</pre>
<p>This is the content of <code>factory.pub</code>:</p>
<pre>untrusted comment: GrapheneOS factory images public key
RWQZW9NItOuQYJ86EooQBxScfclrWiieJtAO9GpnfEjKbCO/3FriLGX3</pre>
<p>The public key has also been published via the official
<a href="https://twitter.com/GrapheneOS/status/1145259815851253762">@GrapheneOS Twitter
account</a>,
<a href="https://www.reddit.com/r/GrapheneOS/comments/c7gb3f/grapheneos_factory_images_are_now_signed_with/esewpm9">the /u/GrapheneOS
Reddit account</a> and <a href="https://github.com/GrapheneOS/releases.grapheneos.org/blob/master/static/factory.pub">is available on GitHub</a>.
When the current signing key is replaced, the new key will be signed with it.</p>
<p>Download the factory images for the device from <a href="/releases">the releases
page</a>. For example, to download the 2020.05.05.02 release for the Pixel 3 XL (crosshatch):</p>
<pre>curl -O https://releases.grapheneos.org/crosshatch-factory-2020.05.05.02.zip
curl -O https://releases.grapheneos.org/crosshatch-factory-2020.05.05.02.zip.sig</pre>
<p>Verify the factory images using the signature if you were able to obtain
<code>signify</code> from trusted package repositories (see above):</p>
<pre>signify -Cqp factory.pub -x crosshatch-factory-2020.05.05.02.zip.sig && echo verified</pre>
<p>This will output <code>verified</code> if verification is successful. If something
goes wrong, it will output an error message rather than <code>verified</code>.</p>
<h2 id="flashing-factory-images">
<a href="#flashing-factory-images">Flashing factory images</a>
</h2>
<p>The initial install will be performed by flashing the factory images. This will
replace the existing OS installation and wipe all the existing data.</p>
<p>Reboot into the bootloader interface to begin the flashing procedure.</p>
<p>Next, extract the factory images. On Linux:</p>
<pre>unzip crosshatch-factory-2020.05.05.02.zip</pre>
<p>On macOS and Windows:</p>
<pre>tar xvf crosshatch-factory-2020.05.05.02.zip</pre>
<p>Move into the directory:</p>
<pre>cd crosshatch-factory-2020.05.05.02</pre>
<p>Flash the images with the flash-all script in the directory.</p>
<p>On Linux and macOS:</p>
<pre>./flash-all.sh</pre>
<p>On Windows:</p>
<pre>./flash-all.bat</pre>
<p>Wait for the flashing process to complete and proceed to <a href="#locking-the-bootloader">locking the bootloader</a>
before using the device as locking wipes the data again.</p>
<h3 id="troubleshooting">
<a href="#troubleshooting">Troubleshooting</a>
</h3>
<p>A common issue on Linux distributions is that they mount the default temporary file
directory <code>/tmp</code> as tmpfs which results in it being backed by memory and
swap rather than persistent storage. By default, the size is 50% of the available
virtual memory. This is often not enough for the flashing process, especially since
<code>/tmp</code> is shared between applications and users. To use a different
temporary directory if your <code>/tmp</code> doesn't have enough space available:</p>
<pre>mkdir tmp
TMPDIR="$PWD/tmp" ./flash-all.sh</pre>
<p>A majority of failed flashes tend to be caused by substandard USB connectors,
plugging in via hubs or bad cables which aren't properly up to the USB standard. The
scrollback from a failed flash will contain valuable diagnostic information which
is essential in knowing where and how the process went wrong.</p>
<p>Front I/O ports on desktop computer cases and USB 3.1 or USB C on many laptops
often aren't implemented properly or are broken in subtle ways, which may cause flashing
to fail even on a USB port that works for other peripherals. Older Linux kernels that
predate version 5 may have inadequate or patchwork support for USB C or USB 3. If you
are installing from a Linux distribution, ensure your distribution uses a modern
kernel.</p>
<p>Always use a high quality USB A to USB C cable with a rear USB port directly on your
motherboard, and never use a USB hub for flashing. <em>Never install from a virtual
machine;</em> USB passthrough in software emulation may be broken or inadequate and this
can cause the flashing to fail.</p>
<h2 id="locking-the-bootloader">
<a href="#locking-the-bootloader">Locking the bootloader</a>
</h2>
<p>Locking the bootloader is important as it enables full verified boot. It also
prevents using fastboot to flash, format or erase partitions. Verified boot will
detect modifications to any of the OS partitions (vbmeta, boot/dtbo, product, system,
vendor) and it will prevent reading any modified / corrupted data. If changes are
detected, error correction data is used to attempt to obtain the original data at
which point it's verified again which makes verified boot robust to non-malicious
corruption.</p>
<p>In the bootloader interface, set it to locked:</p>
<pre>fastboot flashing lock</pre>
<p>The command needs to be confirmed on the device since it needs to perform a factory
reset.</p>
<p>Unlocking the bootloader again will perform a factory reset.</p>
<h2 id="disabling-oem-unlocking">
<a href="#disabling-oem-unlocking">Disabling OEM unlocking</a>
</h2>
<p>OEM unlocking can be disabled again in the developer settings menu within the
operating system after booting it up again.</p>
<h2 id="verifying-installation">
<a href="#verifying-installation">Verifying installation</a>
</h2>
<p>Verified boot authenticates and validates the firmware images and OS from the
hardware root of trust. Since GrapheneOS supports full verified boot, the OS images
are entirely verified. However, it's possible that the computer you used to flash the
OS was compromised, leading to flashing a malicious verified boot public key and
images. To detect this kind of attack, you can use the Auditor app included in
GrapheneOS in the Auditee mode and verify it with another Android device in the
Auditor mode. The Auditor app works best once it's already paired with a device and
has pinned a persistent hardware-backed key and the attestation certificate chain.
However, it can still provide a bit of security for the initial verification via the
attestation root. Ideally, you should also do this before connecting the device to the
network, so an attacker can't proxy to another device (which stops being possible
after the initial verification). Further protection against proxying the initial
pairing will be provided in the future via optional support for ID attestation to
include the serial number in the hardware verified information to allow checking
against the one on the box / displayed in the bootloader. See the
<a href="https://attestation.app/tutorial">Auditor tutorial</a> for a guide.</p>
<p>After the initial verification, which results in pairing, performing verification
against between the same Auditor and Auditee (as long as the app data hasn't been
cleared) will provide strong validation of the identity and integrity of the
device. That makes it best to get the pairing done right after installation. You can
also consider setting up the optional remote attestation service.</p>
<h2 id="replacing-grapheneos-with-the-stock-os">
<a href="#replacing-grapheneos-with-the-stock-os">Replacing GrapheneOS with the stock OS</a>
</h2>
<p>Installation of the stock OS via the stock factory images is the same process
described above. However, before locking, there's an additional step to fully revert
the device to a clean factory state.</p>
<p>The GrapheneOS factory images flash a non-stock Android Verified Boot key which
needs to be erased to fully revert back to a stock device state. After flashing the
stock factory images and before locking the bootloader, you should erase the custom
Android Verified Boot key to untrust it:</p>
<pre>fastboot erase avb_custom_key</pre>
</div>
<footer>
<a href="/"><img src="/logo.png" width="512" height="512" alt=""/>GrapheneOS</a>
<ul id="social">
<li><a href="https://twitter.com/GrapheneOS">Twitter</a></li>
<li><a href="https://github.com/GrapheneOS">GitHub</a></li>
<li><a href="https://reddit.com/r/GrapheneOS">Reddit</a></li>
</ul>
</footer>
</body>
</html>
|
