[Google Pixel 6 Pro] FireRattus:
This guide is intended to help people to install GrapheneOS with Root (using Magisk) and a Locked Boot Loader on a Pixel 6 Pro

AVBRoot Technically should support All Pixel devices with unlockable bootloaders, as well as most OnePlus devices

If they support (non-legacy-SAR) A/B partitioning.

Do not ever disable the OEM unlocking checkbox when using a locked bootloader with root. This is critically important. With root access, it is possible to corrupt the running system, for example by zeroing out the boot partition. In this scenario, if the checkbox is turned off, both the OS and recovery mode will be made unbootable and fastboot flashing unlock will not be allowed. This effectively renders the device hard bricked.

I am not responsible for any harm you may do to your device, follow at your own risk etc etc, Rooting your device can potentially introduce security flaws, I am not claiming this to be secure.

Simple method without building from source

Although I highly recommend building Graphene yourself

,

All you really need to do is patch the official OTA released by graphene using AVBRoot

Follow steps 1-4 in the usage section AFTER the prerequisites are complete

You will need to patch each new OTA to update and sideload the update as explained HERE

Here is a video reference, Not a Guide

WARNING: If you are flashing CalyxOS, the setup wizard will automatically turn off the OEM unlocking switch. Make sure to manually reenable it again from Android's developer settings. Consider using avbroot's oemunlockonboot Magisk module to automatically ensure OEM unlocking is enabled on every boot.

Second Method, But requires more time and a decent computer

Only Recommended for people with experience things building from source

The first step is to build GrapheneOS from its sources or to use AVBRoot on official builds. I will include some of the information specific for Pixel 6 Pro to help with the build process

Part one, follow this guide to build GrapheneOS from source

You will want to build a Stable Release using the TAG_NAME 2023071100 this an EXAMPLE Tag for the Pixel 6 Pro

Find the Latest tag on the Releases page https://grapheneos.org/releases

When it comes to the step of "Extracting vendor files for Pixel devices"

The DEVICE for the 6 Pro is raven and an Example of the BUILD_ID is tp1a.221105.002

You can obtain the correct BUILD_ID from build/make/core/build_id.mk

Continue to follow the guide until completion, creating your own Keys during the process

I do recommend testing to Lock the Boot Loader, Just to see if you are able to

In my experience if the pixel does not detect a valid signed boot etc, it will not allow you to lock the bootloader

So if it brings up the screen on your phone where you can confirm the locking of the bootloader

at this stage you can just select No / Do not lock

To build with a specific BUILD_NUMBER use the command export BUILD_NUMBER=2022112500Replacing the number with what matches the version you are attempting to build

Remove the encryption from keys/raven/avb.pem that was created for Graphene so that you can use it with AVBRoot

Use the script script/decrypt_keys.sh https://grapheneos.org/build#encrypting-keys

And set a copy of the key aside for the next steps.

Use the following process to create the correct keys for AVBRoot & GrapheneOS

Use the avb.pem you decrypted in the last step

Convert the avb.pem to avb.key with the following command

openssl rsa -in avb.pem -out avb.key

Then clone the avb.key and rename it to ota.key

as it says "The boot-related components are signed with an AVB key and OTA-related components are signed with an OTA key. They can be the same RSA keypair, though the following steps show how to generate two separate keys."

Continue by following the instructions for generating the keys for AVBRoot using the avb.key and ota.key you now have

I am not entirely certain what other of the keys I should use instead, I think this is the best approach for now

as it creates all the keys it requires and this process works for me

Copy the OTA (raven-ota_update-*.zip) from the folder where you have your own Factory Graphene Build and use this with AVBRoot

Then you will have all the keys and files you need to continue the guide and use the AVBRoot script

Now it's time to follow the instructions Here https://github.com/chenxiaolong/avbroot

To create a full factory installer, Intall it and lock the bootloader.

When you are done with AVBRoot and you have the boot.img, vbmeta.img and vendor_boot.img

All patched and signed by AVBRoot, Take a factory image from your Graphene Build and Extract it anywhere

Open the image-raven-*.zip with an Archive manager

Delete the existing boot.img, vbmeta.img and vendor_boot.img files and replace them the patched ones

also replace the avb_pkmd.bin with the one you have created in the previous steps for AVBRoot (might work without this step)

Finally, you are able to run the flash-all.sh and then lock the bootloader

./flash-all.sh

fastboot flashing lock

Updating is very simple, Once you use AVBRoot to create the Patched OTA.zip

you can reboot to recovery and flash the patched ota.zip with adb sideload

adb sideload raven-ota_update-*.zip.patched

https://grapheneos.org/usage#updates-sideloading

Creating the patched full factory installer is not required if you simply flash the avb custom key and the patched OTA zip before locking the bootloader, after flashing the unpatched full system install build

Third Method /post-88499289 simpler than second but requires building from source still

This for me allowed me after much struggle to achieve a Rooted, Locked Boot Loader using GrapheneOS and Magisk

Now though with this guide worked out, I think it should be quite easy for anyone with basic terminal knowledge to accomplish.

Something to note is that GrapheneOS does Not Pass the CTS Profile integrity check

and I do Not Pass the Play Integrity API Check currently, Neither the Basic or Strong check

But I can pass the Basic attestation Safety Net test when using the patched SafetyNet Fix

Further testing is needed and welcomed to try and pass SafetyNet and Play Integrity

To Be Clear, Although it already should be, This is NOT Modifying the official Graphene OS Sources, it is simply using them as a SOURCE for a GUIDE, You build it using unmodified grapheneOS source code so it is an unnofficial build according to their website

Sources: GrapheneOS, AVBRoot, Magisk

PayPal Donation Link