avbroot

Pixels are consistently "third party Android builds friendly", plus GrapheneOS has a list of required security features (beyond their control): https://grapheneos.org/faq#future-devices e.g. first one in the list: > Support for using alternate operating systems including full hardware security functionality GrapheneOS wants users to lock the bootloader (≈enable Secure Boot) after install by providing user signing keys (avb_custom_key) -- that already seems to leave only Pixel, Nothing and Fairphone. https://github.com/chenxiaolong/avbroot/issues/299

You can re-sign it using https://github.com/chenxiaolong/avbroot I don't currently have any root on the phone, but I reserve the right to add it or run the userdebug build at a later date

Wall of Fame (allows re-locking the bootloader with custom key): https://github.com/chenxiaolong/avbroot/issues/299

Only two options (Google Pixel and Nothing Phone) for relocking Android with custom keys? https://github.com/chenxiaolong/avbroot/issues/299

As far as I'm aware, their flagship Xperia phones do support bootloader re-locking [1]. The problem is they haven't fulfilled GrapheneOS's other requirements: https://grapheneos.org/faq#future-devices [1] https://github.com/chenxiaolong/avbroot/issues/299#issue-232...

You can root GrapheneOS just fine. Moreover you can even re-lock the bootloader after rooting. See: github.com/chenxiaolong/avbroot

Yes. There aren't many Android smartphones that allow you to re-lock the bootloader after installing a custom operating system. Pixels are the only ones officially supporting `avb_custom_key`. https://github.com/chenxiaolong/avbroot/issues/299

> Rooting in this context means unlocking the bootloader to allow for a custom OS/kernel that isn't signed by the OEM That would not be the correct usage of the term "rooting". "Rooting" on Android systems generally means to install a `su` binary (like Magisk) that you can use to give apps root permissions, thus completely circumventing the normal android app permission system. > I'd rather have the ability to enroll my own keys so I can boot my own signed OS and maintain a root of trust that I own much like what can be done on desktop Linux with a TPM. IIRC Google's Pixel phones have this ability (and are one of the few phones that have this ability if I'm not mistaken). I agree completely. I have a Google Pixel and use this with GrapheneOS. This feature is `called avb_custom_key`, and yeah, unfortunately only some devices support it. ht

No, over-the-air updates are not supported. The instructions for flashing updates patched with avbroot are here: https://github.com/chenxiaolong/avbroot?tab=readme-ov-file#u...

Anyone who prefers root access on Android with a locked bootloader (on the OSes that support it) can use avbroot: https://github.com/chenxiaolong/avbroot Works great with CalyxOS and GrapheneOS.

Do you know if OnePlus uses the same A/B style OTA updates as Pixel devices and whether it supports setting a custom bootloader key? If so, you might be able to use my avbroot project [1]. It roots the boot image, signs it with your own key, and replaces the OTA verification certificate with your own, so you can install future updates signed by your key while the bootloader is locked. [1] https://github.com/chenxiaolong/avbroot EDIT: I read a bit about OnePlus devices. Looks like they do indeed support locking the bootloader with a custom signing key installed. So I went ahead and added support for OnePlus' OTAs in avbroot: https://github.com/chenxiaolong/avbroot/pull/32. There are only minor differences compared to Pixel's OTA images.

I root my phone for a few reasons (in no particular order): * Reverse engineering, mostly to satisfy my own curiosity, but also to verify that the few third party apps I install don't do scummy things behind my back. I mostly use frida [1] for this and if I want to change the behavior of something permanently, I make a module for LSPosed [2]. * Get rid of Android's awful app links feature [3]. I despise Android >=12's behavior of always opening deep links in "official" apps (eg. Youtube) by default. To open those links in third party apps by default, the user has to go into Android's settings for the app and manually whitelist domains. This module forces Android to treat every domain as "unverified", which restores the old behavior of prompting the user which app to use when opening a link. * Call recording [4]. (Or playing audio into a p