yashsingh1/xdaforums huggingface dataset:
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] anupritaisno1:
Glassrom for op7pro

Download here: https://github.com/GlassROM/glassrom-landing/releases/tag/20201212-guacamole

Sources: https://github.com/GlassROM-devices

Kernel: https://github.com/GlassROM-devices/android_kernel_oneplus_sm8150

Branch: lineage-17.1

Pregenerated config at last_generated_release_config

This ROM enforces AVB

Instructions:

There are many ways to flash glassrom. The most common ones are here

Oneplus devices don't allow flashing firmware through fastboot. It is advised to sideload the full OTA after flashing the fastboot image to upgrade firmware

You never need to clean flash glassrom unless explicitly told to do so

Installing twrp to the ramdisk on glassrom will brick your phone. Do not attempt to do so

Donate to glassrom:

bc1q2g49cs0fmvrac4kplezk4dxydgw5ksrn0etd3c

12ihMbyri7JKG8bmonrqKpPGStrdX2tHWe

These are bitcoin addresses. Addresses starting with bc1 have less transaction fees

Monero address:

42vv51M17nq992dcz2ht4F3gUPhf6Nw91jiwtrddYjgRPrns18p48ex8TKyTcpVzJLTGXJ9fAXvK5dhKEZvF4zuABpG8jYe

Do not report bugs if:

You have modified glassrom in any way. This includes flashing anything to the system, magisk as well as twrp and custom kernels

You are playing with the hidden developer menu. The only thing you should do here is turn off OEM unlocking. Doing anything else here means that you will not receive support unless you reset the device. The only exception is if a developer has asked you to capture a bug report or use adb to get system logs

XDA:DevDB Information

GlassROM, ROM for the OnePlus 7 Pro

Contributors

anupritaisno1

Source Code: https://github.com/GlassROM

ROM OS Version: Android 10

ROM Kernel: Linux 4.x

ROM Firmware Required: Oxygenos 10.

Based On: LineageOS

Version Information

Status: Stable

Created 2019-10-20

Last Updated 2020-08-09
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] anupritaisno1:
Reserved
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] ymedesines:
this doesn't boot with opengapps pico.
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] anupritaisno1:
You will need to disable verified boot
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] ymedesines:
tedious; won't blow over well.
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] babyboy8100:
Booted up with Lineage boot animation, everything during set up was lineage like? Is Glass ROM going to differentiate itself or is it Lineage os unofficial?
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] anupritaisno1:
I focus way more on speed and security. Probably not

I'm currently working on upstreaming the kernel. Didn't find a properly upstreamed one anywhere
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] insaneparnoid:
Is signature spoofing enabled ?
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] anupritaisno1:
Yes it is
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] douglasmietto:
Is this rom aosp or is it just stock based? if you need gapps for aosp?
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] anupritaisno1:
Yeah I should definitely update the thread to mention that

You don't really *need* gapps. They aren't installed by default and you have the choice to not flash them at all. I tried it for a while with them and it worked fine but I don't really use them

I don't really have any bias towards either aosp or caf. Both are equally important to have a secure system so I usually end up mixing them in various places
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] anupritaisno1:
You see this has been discussed in the op2 and op3 threads too and here's a short version:

AVB cannot be enforced by the user if it is disabled by the ROM builder during the build. Disabling it is easy

While you might not like verified boot there are obviously some who'd like it and shipping builds that have it disabled would mean a small part of the user base would be neglected. Obviously that's not right and the only solution is to make verified boot opt-out
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] anupritaisno1:
A few things you might notice yourself:

It's a user build. It's actually faster than official lineage

Signature spoofing is present

Noticed the first boot taking abnormally long? That's due to my optimizations. They cause the first boot to take a long time but you get significantly better battery and performance. Not to mention they solve a problem: since the ART cache of the system is put inside /system and apps are forcefully computed at boot you will almost never need to wipe caches. Since the system is forced to use precompiled ART files the system is reading from read-only memory making modification of these files by malware harder. It also saves approximately 14mb of memory per app which isn't much but at least you aren't sacrificing anything

And that's it really. I fixed a few bugs here and there that I've seen mostly on all devices and I was done. You're free to fork glassrom and add all the features you want. The purpose of this project is to do things right rather than do many things and finish none
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] kamikaze702k:
Based on lineage?

Screenshots?
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] anupritaisno1:
I have no records of anyone shooting their phones after installing glassrom. In fact this device would not even make something like that plausible merely due to it's price
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] DR4LUC0N:
I'm pretty sure he means can you post screen shots from your phone, not someone taking a gun out and F'ing their phone up.

Honestly I wouldn't download this, there's next to nothing telling people about what your rom does compared to others. It shows minimal effort and looks like you're trying to get the "developer" status without doing much when it's not deserved. Look at LoS, Omni, RR pages and look at all the information they give, you have nothing.
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] anupritaisno1:
Nobody asked you to download it. Have a good day

That's my standard response to "screenshots". I do not deviate much from official lineage and I never will. My focus is stability, security and technical simplicity, everything else comes after that
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] anupritaisno1:
BTW guys don't be surprised if twrp doesn't boot on future builds and don't bother me if it doesn't

I'll be porting Samsung's SELINUX_ALWAYS_ENFORCE and linux-hardened disabled selinux development which will kill twrp boot

And no I don't care, twrp is not really needed when lineage recovery is well supported and using twrp for anything is a serious mistake

Also don't expect enhanced twrp builds either. I did those on my older devices because twrp was broken and it was the only way to get things on to the device but with A/B that's not a concern
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] kamikaze702k:
With that attitude, the only person using this rom will be you. Anyway, good luck, I'm out.
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] anupritaisno1:
Cool story. Should be pretty interesting coming into a ROM thread asking the developer to post screenshots

Clearly you can slap on any theme, wallpaper, mod you want and make the ROM however you want it to be. Not to mention the end user will never use my setup so the screenshot is really just a lie as the user will just never have a phone that looks like that. And seriously why would they want to? We're all different people, our phones might be the same but they're used in different places and for different purposes

So no, I'm not going to be spreading lies in this thread by posting screenshots of an experience only I can create for myself useless for anyone other than me

And I want no arguments on this beyond this point. Users who've flashed the ROM might give you screenshots but I won't be giving any

Have a good day
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] anupritaisno1:
Google likes to close several things for third party apps but opens up exceptions for system apps so that their own google apps can actually be excluded from these restrictions. Glassrom closes down these holes opened by google for system apps. Even if you somehow manage to flash gapps onto glassrom they will crash as selinux will block most of whatever google apps try to do

Glassrom also does not support storing updates for system apps on /data. Harsher restrictions will be imposed on system apps that have updates in /data and many of them will just refuse to work. This is important as system apps should really never load anything from an untrusted partition like userdata except for their own application data. The google play store tries to update system apps and this will almost always require updates to be uninstalled or in case the play store updates your webview, you will have to factory reset to uninstall updates

The main issue with fdroid is the complete lack of release standards. They will just check if the app is open source, do some obsolete checks they lifted off play store a couple years ago (they're nothing all that special nor extensive) and they will just go ahead and release. Compare that to something like play store and you realize what the issue is

Fdroid still uses weak signatures, often will fall back to insecure hash algorithms like sha1 and use terrible options like gpg for verification. They also leave apps out of date for a long time

They have had 5 years now to fix their mess. The only reason they are trying to fix it now is because google finally closed the hole on R. Almost every app on the play store that has received an update at least once in the last 2-3 years will not have an issue. Glassrom is already planning to extend Google's code to also require apps all the way down to target API 24 to carry a strong signature

They simply denied that an issue existed until google closed this hole 5 years after it was known. The problem really isn't fdroid, glassrom is just rejecting apps that are signed with weak signatures. It just happens that almost every app in fdroid will come under "weak signature" criteria and be rejected by glassrom except for a few apps that use reproducible builds where the developer signed them correctly. Sadly only 1-2% of apps use reproducible builds and the number of developers signing them correctly is definitely way lower

Glassrom used to have more funding and more people working on it in the past. No promises can be made about any support duration for any device
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] engelhro:
Thanks for the explanation! Okay, so nothing Google then if I understand that correctly… Bummer.

I don't use that many Google apps and most I use could be installed later on as regular user apps (I don't need them to be system apps). But I would at least have required Google Play Services, Google Play Store and a few other essentials (basically what is included in the pico package of OpenGApps).

Okay, thanks again for your explanation! You didn't say anything about independent apks but I guess the situation here is the same – no way to install them unless they have a strong signature. Any easy way/tool to find out whether this is the case for an apk (so it could be installed) or not (i.e., it would be rejected by GlassROM)?

Anyway, this probably excludes even more apps from being available.

Thanks once more for the honest answer!

So to let me summarise:

If I install GlassROM I would lose access to the Google ecosystem (Google Play Store and all its apps) as well as other sources (like F-Droid and other alternative stores). I'd end up with having not a smartphone but quite a dumbphone (albeit a very secure one).

I'm afraid these are too many restrictions for a daily driver :(. I personally fail to see the purpose and the use case for GlassROM then, but this probably just means that I'm not the target audience. Too sad :crying:, as it sounded great first (knowledgeable developer, lean/not fancy system, secure configuration, fast and complete updates).
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] anupritaisno1:
You can get apps from aurora store and microg works even as a user app

Apks from independent sources... It depends. Fdroid build system can generate strong signatures since a long time but they themselves don't use it so it is only if a developer correctly uses those

Builds done through android studio should be okay too
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] engelhro:
Okay. But the Aurora store disclaimer lets me refrain from using it with my Google account (instead of the anonymous account), so that's not a very good option (to me). And MicroG has its problems too (just look at the long list of unsolved issues in Github and the slow development).

And also the use of a managed profile (for my company's apps) will be challenging with GlassROM I assume, given all the restrictions.

Maybe one day a solution for support of GApps (i.e., the very few very essential Google services which are necessary as system apps) will be found – I'll keep an eye on this thread here…
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] anupritaisno1:
Your managed enterprise profile will work just fine on glassrom. Glassrom does not apply the same amount of restrictions to user apps (doing so would be stupid and break app compatibility)

Software is not buggy because there are too many issues issues on an issue tracker. That is simply wrong. Please do not spread such baseless claims here
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] engelhro:
Okay, thanks for the info! But the problem with Aurora remains…

I know you have strong opinions and a quick to judge, but this for sure is debatable. I'll not do that here in detail (it would be off topic and pollute the thread), but – at least in my opinion – many open issues over a longer period of time are almost always an unhealthy sign for any project (this includes but is not limited to the existence of bugs) and I've always done good to stay away from such software. One could argue how generalizable that is and what the reasons for too many open issues are, but as said this doesn't belong here.

Anyway, MicroG is for sure not something I'd like to tinker with on a smartphone and ROM I use as daily driver. Sorry if that offeded you.
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] anupritaisno1:
This is certainly false and is a myth spread by people who really don't know what software engineering is about

Software is not buggy because you see a large number of issues on an issue tracker. Any sufficiently large and popular project will have "several issues open over a long period of time". The only thing the amount of bug reports say is how many people are actively looking out for one and getting one reported so that it can be fixed later on. You can have a several thousand bugs open for 10-20 years and it really goes to say nothing about the reliability of the software

Fewer bugs reported on an issue tracker merely mean that people are not actively looking out for bugs. This does not mean there are no bugs; only that their existence isn't proven yet

Another similar version of this myth is how the number of vulnerabilities tells you about how secure a software is. This is also wrong by the same logic

I would really suggest you read the actual theory instead of going to a search engine and looking up other people's opinions, taking those as truths and ignoring the facts
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] anupritaisno1:
Yes, glassrom is aware of bleedingtooth and several vulnerabilities in webview that have gone unfixed

Many of these vulnerabilities are either not possible to exploit or are extremely difficult to exploit on glassrom due to strong exploit mitigation already present in glassrom. Exploiting these vulnerabilities will be significantly harder, if not impossible on glassrom (glassrom security team has been able to prove that hardening in glassrom makes at least 2 of the bleedingtooth vulnerabilities impossible to exploit)

Fixes for these vulnerabilities will come with the next security patch
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] anupritaisno1:
Glassrom website has been moved from the porkbun registrar to google domains. Most of the old infrastructure should eventually be back, the build machine has been upgraded too to one that can build android in about an hour and this time around, glassrom actually owns the build hardware

Huge thanks to all who donated to glassrom and grapheneos
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] anupritaisno1:
new release https://github.com/GlassROM/glassrom-landing/releases/tag/20201212-guacamole
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] anupritaisno1:
And since I did touch on Linux being bad for security here's why https://madaidans-insecurities.github.io/linux.html

Yes, windows is more secure than Linux. You're welcome
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] anupritaisno1:
GPG often gives our users a false sense of security. GPG really isn't secure and it is better for users to not verify signatures at all rather than verify them

Glassrom will be removing gpg signing from the infrastructure and move to actually secure alternatives like signify

All users are requested to stop verifying gpg signatures and delete any glassrom gpg keys if you have imported any of glassrom's keys
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] skymera:
You may be right, but dude, you're preaching to the wrong choir.
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] anupritaisno1:
Why so?
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] anupritaisno1:
GlassROM now has a signal number

You can reach out to us at +1 (613) 801-4036

Alternatively, you could also send an SMS to that number. That works too
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] anupritaisno1:
Glassrom was most likely affected by the fire at an OVH data center. We are currently trying to assess the situation. The server hosted a few of our releases

Uptime Recent News | Data Center Knowledge

Explore the latest news and expert commentary on Uptime brought to you by the editors of Data Center Knowledge

www.datacenterknowledge.com
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] :
are there any instructions to uninstall the rom (return to stock/custom rom)? can i just boot into twrp, flash rom and format data?
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] anupritaisno1:
If you have locked the bootloader then you should erase glassrom's avb key with fastboot erase avb_custom_key and then you can go back to the stock rom
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] anupritaisno1:
we need testers for the oneplus 7 pro android 11 release. please join the telegram group

also i will make this clear: oneplus devices are terrible and take too long to secure. even then these devices are very lacking in security. if i do not get at least 1 tester in the next 24 hours i will think of it this way: "nobody uses glassrom on the op7pro and everyone has moved to newer/other devices so i don't need to continue maintaining it for the device" and i will drop the rom for this device
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] anupritaisno1:
we are ready to pay people for testing if needed
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] ZoiraP:
I'd love to test ^.^ . I dont want money , Just want to help. PM me.
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] grinch247:
can test too
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] anupritaisno1:
will pm you

for today i want to get a build fully working on unmodified lineage first

after that there will be builds in this order: porting glassrom base hardening changes, porting grapheneos hardening changes, copying our old camera driver from 10 onto 11 (oneplus uses a driver from android 9 on official), upstreaming the op7pro kernel, restoring device specific hardening

so easily 5-7 test builds will be released today/tomorrow
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] anupritaisno1:
btw everything is fine and i will most likely release a beta build to the testers and hopefully a stable release by this week

i will use this post to describe a few changes we are making on android 11

the biggest change is the kernel. on android 10 the kernel work was actually offloaded to another developer. however their kernel was made for oxygenos and it did give us a few problems (anyone having kernel crashes when connecting usb earphones and the usb port not working at all? or how about mobile data randomly crashing the os?). i'm sure many of you have never noticed these issues but they definitely do exist. this wasn't exactly that developer's fault but ours because we were using a kernel made for oos on lineage and at that time it was the most secure kernel so there weren't any options

starting from android 11 glassrom will be moving to a kernel built in-house specifically for glassrom. this immediately solves a lot of weird behaviour that occurs when you use a kernel not made for the os

we have also cleaned up the wifi and audio drivers. these no longer use the hacks upstream requires to get them working on things like lineage. glassrom's handling of the wifi driver is very close to how the stock rom does it and using this cleaner approach allows us to merge security patches faster and have lesser conflicts overall. also i only included the absolute bare minimum required for wifi to work

kernel reproducibility is now supported on android 11. this means that you don't have to trust glassrom's word on whether the kernel sources are legitimate. you can now verify that the kernel released by glassrom exactly corresponds to the sources we publish. while the method to perform verification is complicated, other roms don't even give you the assurance that they are indeed shipping what they claim to ship. we are working to include a commit-ish in the string so you can know exactly which commit the kernel in your release was compiled off. sadly doing so is slightly hard on lineageos so this feature is not ready yet. we plan to use git tags to mark release kernels for now

now that we have an in house kernel we are experimenting with cpu mitigations. it isn't really possible to completely eliminate spectre and meltdown. they are still a problem today (op7pro has hardware mitigation for meltdown). without the hardware mitigating these vulnerabilities it is just a cat and mouse game. also we need the meltdown mitigation even if the hardware mitigates meltdown because the meltdown mitigation was originally a security feature that just happened to also mitigate that vulnerability in software

we are also working on enabling 48-bit address space. this would require another post of its own to explain and gets a little technical
[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] anupritaisno1:
Few things for the testers

Keep a copy of the last glassrom android 10 release downloaded. Remember that you can't flash glassrom with twrp so you need to use the recovery that comes with the rom to sideload it

Be on the android 10 firmware. On glassrom a system upgrade also upgrades your firmware so you do not need to be concerned about finding and flashing the right firmware

If your bootloader is locked and glassrom is installed, enable OEM unlocking but do not unlock the bootloader for the testing. Enabling OEM unlocking on a locked bootloader doesn't reduce your security as the bootloader is still locked. Still, OEM unlocking does provide *some* defense in depth by forcing a thief to reset the phone before they can unlock the bootloader

Twrp places files in the userdata partition that break encryption on glassrom (filesystem based encryption must start with the data encrypted, old files that weren't encrypted already can't be encrypted later on) so you need to use the recovery that comes with glassrom to format data