[OnePlus 7T Pro (Regular & McLaren) ROMs & Dev.] steadfasterX:
LOCK your bootloader​

Yes you read correctly: you can lock your bootloader again! Why is that so amazing? The most important thing: security. When your bootloader is locked no one can install or modify without you notice it. Let's say you loose your phone and your bootloader is unlocked. The person can boot into fastboot and flash a custom recovery of his choice and have full access to your data (if not having a pin set) but also can tamper e.g. your system partitions like installing malware. Yea for that the attacker needs physical access to your phone but there is malware around and this is REAL which uses bugs to install themselves even on your system partition. For this the attacker does NOT need physical access to your phone.

On a locked bootloader the device won't boot anymore as a modification like that will be detected.

Anyways.. yea one can say both attack variants are not THAT critical or affecting you as you are paying attention on what you do but .. there is a always a risk of undetectable malware like the good old drive-by downloads etc. so .. its all up to you if you want to have that extra barrier or not..

But before we begin

a HUUUUGE thanks to @WhitbyGreg !!!

All this here would not be possible without his great guide here ! Ofc I need to adapt it and integrate all this within my automation process but it would have been a LOT harder without his thread(s).

So if you love it having a locked bootloader now - give HIM some thanks clicks, donations, hugs.. as well ;)

Checklist: is locking the bootloader something for me?​

If you answer anyone - even just 1 - of the following with YES - then KEEP AWAY FROM LOCKING your bootloader!

I want to remove (not just disable) system apps (often called bloatware)

I want to add / convert apps into system apps (e.g. Titanium Backup offers such an option)

For rooted variant: I want to update Magisk to the latest version

For rooted variant: I want to change init scripts, XMLs or anything else within system/, product/ etc partitions

For rooted variant: I want to use an ad-blocker which modifies the "hosts" file (system partition)

I want to install another recovery then the one coming with the ROM (SHRP)

I want to flash GApps (LOL! this is /e/ !! even on unlocked bootloader this won't work!)

I want to flash anything else in recovery which modifies: boot, recovery, system or any other partition then userdata

Do you have answered at least 1 of the above with YES ? Then do NOT lock your bootloader. It WILL brick your device if you try.

if you can live with the above - GO GO GO :)

Lock your bootloader - process​

Downloads

ROM without root: https://leech.binbash.rocks:8008/e-os/a10/hotdog/ (all CUSTOM(!) builds since 2021-09-03)

AVB key: https://github.com/sfX-android/update_verifier/blob/master/hotdog_eos-q_custom_pkmd.bin

ROM with root: https://leech.binbash.rocks:8008/e-os/a10_rooted/hotdog/ (all CUSTOM(!) builds since 2021-09-03)

AVB key: https://github.com/sfX-android/update_verifier/blob/master/hotdog_eos-q_custom-rooted_pkmd.bin

backup all your data. I am serious EVERYTHING. we need to FORMAT the userdata partition during the lock process and there is no way around. so use TB or Swiftbackup, Migrate or any other. Always a good idea to also having a TWRP/SHRP backup just for the case..

boot your current recovery

flash the ROM of your choice (with or without root)

reboot to the bootloader / fastboot

if you flashed the ROM with root: fastboot flash avb_custom_key hotdog_eos-q_custom-rooted_pkmd.bin

if you flashed the ROM without root: fastboot flash avb_custom_key hotdog_eos-q_custom_pkmd.bin

type: fastboot oem lock

approve locking the bootloader on the phone's screen

< take a deeeeeeep breath >

recovery (SHRP) will load automatically

choose wipe -> format(!) data (there is no way around)

boot android -> you will notice a new bootloader message warning you that you have a custom ROM installed - but it will load

congrats! you now running on a locked bootloader + /e/ OS!

for the rooted variant: start the Magisk app (requires internet), accept the install request and open the magisk app afterwards and let it reboot when asked

enjoooooy :)

Locked - now what?​

OEM unlock option

The above does not mention one additional step: disabling OEM unlock in developer options. For a reason. I mean you CAN uncheck that option now that all is running fine but you don't get any more security tbh.

The reason is if you keep it checked an attacker is able to unlock your device but it WILL format the encryption keys when done. that means no way to access your data anyways. If you want to avoid even that then feel free to uncheck OEM unlock in developer settings as well but then a brick will require low level recovery tools to bring your device back to life.

Magisk (rooted variant)

I recommend to disable automatic update checking within magisk settings - remember: when flashing a newer version of magisk it WILL brick your device. you have to wait for me updating it within the ROM.

Anything you do within Magisk can EASILY BRICK your device, installing a magisk module which tampers your system partition: BRICK. So really really check if a module touches anything mentioned in the above checklist topic. Using the magisk variant has HIGH potential of bricking your device.

You can use all standard root functions, magisk hide and even re-pack the magisk app though.

Bricked

Always keep an eye on the above "Checklist" topic! If you change/do something mentioned there you will brick your device with a snap of a finger.

Android does not boot anymore because you flashed a newer version of Magisk or changed something within the protected partitions:

boot recovery (power off, press power on and vol down the same time and keep it pressed until you see the shrp logo)

flash the current ROM version or a later release and reboot

recovery does not load bc you flashed another recovery:

wait for the next OTA and it get fixed automatically

or unlock the bootloader again (this will need to FORMAT the userdata partition)