[OnePlus 3 & 3T Cross Device Development] :
How to re-lock your bootloader with LineageOS 17.x

First the WHY;

A locked bootloader is needed to pass safetynet api if you do not want to install Magisk.

Passing Safetynet is needed for many things like banking apps, Gpay, installing Netflix etc...

So you can do it the 'Magisk' way which is also giving you a rooted device, or re-lock the bootloader again.

This is only working with a signed ROM and TWRP!

And now the HOW:

For anyone who wants to use Lineage 17.1 with locked bootloader; this is what I did and is working:

Flash SAR TWRP (fastboot flash recovery twrp-3.3.1-system-as-root-oneplus3.img)

Reboot into recovery

Format /data (Wipe > Format Data > type yes) and wipe the rest (Wipe > Advanced Wipe > everything except USB-OTG)

Reboot into bootloader

Do an OEM LOCK by fastboot (fastboot devices, fastboot oem lock >> choose NO on your phone, this is a bug in OnePlus firmware and actually means YES)

Reboot into recovery

Copy all stuff you need to install from your pc to the internal storage on your phone

Flash the whole stuff from within Recovery:

- latest firmware (link is for OP3T!)

- latest Lineage build

Reboot into system

Do the normal first boot setup presented by Lineage

Set a password

Encrypt the device

In developer settings:

- disable OEM unlock

- disable ADB

Reboot into system

Copy all your files from pc to internal storage

Install your apps and configure the rest

The result;

Re-locked bootloader, warning screen on boot gone (of course) and Lineage working fine without any issues!

Banking apps and build.prop settings

Still had a banking app though which could not be activated and was complaining about using a custom rom (worked with Magisk Hide in the past).

After some searching I noticed Magisk Hide is changing and/or adding some settings in build.prop.

Some of those were missing, did not check which of them was the issue though.

What I noticed was ro.build.type=user.debug in default build.prop, which I know is giving trouble sometimes.

Based on Magisk Hide, this is what I replaced/added in build.prop of Lineage 17.1 to get my banking app working:

ro.build.version.security_patch=2019-10-01 (changed this one earlier; was not the issue though)

ro.build.selinux=0

ro.build.tags=release-keys

ro.build.type=user

ro.debuggable=0

ro.secure=1

No issues anymore now, banking app installed without any issue.

Hope it helps for other people who want to have a locked bootloader and working banking apps without using Magisk.

Note:

By design adb root command works in development builds only (i.e. eng and userdebug which have ro.debuggable=1 by default). So to enable the adb root command the ro.debuggable=1 line must be in build.prop, which now is set to 0. This means you can use adb as user but not as root anymore.

You can try to leave ro.debuggable=1, though my banking app was actually checking this parameter and did not work without changing it to 0.

Magisk and rooting phone

Would you like to be rooted, you have to use Magisk as the SU package is not supported anymore for LOS 17.x. In that case you can use Magisk Hide and above build.prop settings are not needed. Because Magisk resigns the boot image if it's signed when Magisk is installed, you can use Magisk with locked bootloader.

The nice part;

As long as you are using latest TWRP it is possible to unlock and re-lock your bootloader without loosing data, though only uncrypted.

With encryption this is NOT possible as mentioned here.

From within TWRP you can update firmware, TWRP itself, ROM, Gapps etc...

You can run scripts from terminal in recovery to remove some system apps and do some other stuff. I like this because after each update, which I flash from within TWRP as OTA is not working with encryption/ TWRP as recovery, I can run a script to remove some system apps and do some extra settings.

TWRP Scripts

Enclosed a script (twrp-script-change-buildprop.sh.txt) to add the build.prop settings as mentioned above.

Just remove the .txt part from the file name, do a chmod 755 and run the script after every (dirty) rom flash to add the needed stuff to buid.prop.

I have also enclosed the script (setup.sh.txt and setup-remove-userapps-only.sh.txt) I am using myself to do some additional stuff. This script will be updated when I make any changes. No support about how to work with scripts, what it is doing etc..., you are completely on your own. For people who want to clean up things so now and then or want to remove some system apps, it could be a nice start point though. At my latest fresh install I decided not to debloat everything possible, resulting in the script setup-remove-userapps-only.sh.txt. Please note for both scripts that DocumentsUI is removed, so without any other file manager installed, you are lost when using the script as it is now!

Happy tweaking!

--

15-06-2020: Updated my setup file; added some extra lines because of ro.build.x and ro.system.build.x settings in build.prop

06-06-2020: Updated the explanation a little to make it more fool proof

03-05-2020: Updated my setup file; added setup-remove-userapps-only which I am using myself at the moment. No functionality lost, only some user apps.

23-04-2020: Finalized my setup file after fresh install.

22-04-2020: Updated my setup file; removed some lines from build.prop, seems almost final now...

21-04-2020: Updated my setup file; added again some extra apk's to remove with explanation (please understand what the apk's are doing before removing!!)

21-04-2020: Updated my setup file; added some extra apk's to remove with explanation

19-04-2020: Added explanation of removed packages to my setup script

18-04-2020: Added comment about ro.debuggable=1 and adb root

--