[Google Pixel 6] WhitbyGreg:
What is this tutorial?

This tutorial will:

Creating an unofficial build of LineageOS 20.0 suitable for using to re-lock the bootloader on a Google Pixel 6

Take you through the process of re-locking your bootloader after installing the above

This tutorial will NOT:

Remove *all* warning messages during boot (the yellow "Custom OS" message will be present though the orange "Unlocked bootloader" message will not)

Allow you to use official builds of LineageOS 20.0 on your device with a re-locked bootloader (more details near the end of the tutorial)

This tutorial will assume you are working on an Ubuntu 20.04 installation, if you are using Windows or another Linux distro, the commands may be different or not work at all.

Supported devices:

The following devices have been tested and confirmed to work:

Google Pixel 4 (flame)

Google Pixel 5 (redfin)

Google Pixel 6 (oriole)

Google Pixel 7 (panther)

NOTE: This should work on the variants of these phones as well, like the Pixel 6 Pro or 6a, however they have not been tested.

NOTE: In previous versions of this guide, the OnePlus seriers of phones was supported, that is no longer the case, as since OxygenOS 12, custom AVB keys are no longer supported by the bootloader on those devices.

For simplicities sake, all further references will only be to the Google Pixel 6 (oriole).

Pre-requisites:

a mid level knowledge of terminal commands and features

a supported phone

a PC with enough CPU/RAM to build LineageOS 20.0 (recommended 8 cores, 48g of RAM)

a working USB cable

fastboot/adb installed and functional

LineageOS 20.0 source code downloaded

Use of the muppets for both blobs and firmware (https://gitlab.com/the-muppets/proprietary_vendor_google_oriole & https://gitlab.com/the-muppets/proprietary_vendor_firmware)

at least one successful build of LineageOS

at least one successful signing of your build with your own keys

Misc. notes:

the basics of building/signing of LineageOS is outside the scope of this tutorial, refer to the LineageOS Wiki (https://wiki.lineageos.org/devices/oriole/build) for details on how to complete these tasks

if you have generated your signing keys at some significant time in the past, you may have generated 2048 bit keys. 4096 bit keys are now supported and recommended, so you may want to generate new keys for LineageOS 20.0. If you decided to continue to use the 2048 bit keys make sure to make the appropriate changes in step 2 and 3 below.

signing with keys that have passwords set can cause problems, the easiest way around this is to *not* set a password when you generate your signing keys, however this does add risk that if your key files are stolen, no password is required to use them.

you'll be modifying some code in LineageOS, so if you are not comfortable using basic editing utilities as well as patch, do not proceed any further

the path to your LineageOS source code is going to be assumed to be ~/android/lineageos, if it is somewhere else, substitute the correct path in the tutorial

the path to your private certificate files is going to be assumed to be ~/.android-certs, if it is somewhere else, substitute the correct path in the tutorial

*** WARNING ****

This process may brick your device. Do not proceed unless you are comfortable taking this risk.

*** WARNING ****

This process will delete all data on your phone! Do not proceed unless you have backed up your data!

*** WARNING ****

Make sure you have read through this entire process at least once before attempting, if you are uncomfortable with any steps include in this guide, do not continue.

And now on with the show!

Step 1: Basic setup

You need a few places to store things, so create some working directories:

mkdir ~/android/oriole

mkdir ~/android/oriole/patches

mkdir ~/android/oriole/pkmd

You also need to add "~/android/lineageos/out/host/linux-x86/bin" to your shell's profile path. Make sure to close and restart your session afterwards otherwise the signing will fail later on with a "file not found" error message (this may no longer be required).

Step 2: Update the signing keys to use & enable AVB

The Pixel 6 device files are mostly contained in the shared "raviole" and "gs101" devices for the Pixel 6 and 6 Pro. You will need to add a few parameters to the shared make file found here: ~/android/lineageos/device/google/raviole/BoardConfigLineage.mk, they are:

BOARD_AVB_ALGORITHM := SHA256_RSA4096

BOARD_AVB_KEY_PATH := /home/<userid>/.android-certs/releasekey.key

Note you cannot use "~" in the path names above to signify your home directory, so give the full absolute path to make sure the files are found.

LineageOS by default disables Android Verified Boot's partition verification, but you can enable it now as all the required parts will be in place.

To enable partition verification do the following:

cd ~/android/lineageos/device/google/gs101

sed -i 's/^BOARD_AVB_MAKE_VBMETA_IMAGE_ARGS += --flags 3/#BOARD_AVB_MAKE_VBMETA_IMAGE_ARGS += --flags 3/' BoardConfigLineage.mk

Step 3: Set the AVB key to use

To set the correct signing key to use for AVB, do the following:

cd ~/android/lineageos/device/google/gs101

sed -i 's/external\/avb\/test\/data\/testkey_rsa2048.pem/\/home\/<userid>\/.android-certs\/releasekey.key/' BoardConfig-common.mk
sed -i 's/SHA256_RSA2048/SHA256_RSA4096/' BoardConfig-common.mk

Don't forget to replace your <userid> in the first sed command above with your current logged in user id.

Step 4: Patch the AOSP and Device Makefile

You also need to patch the Makefile included with AOSP as it will otherwise fail during the build.

The required patch can be found here:

https://raw.githubusercontent.com/Wunderment/build_tasks/master/source/core_Makefile-20.0.patch

Download it and store in ~/android/oriole/patches.

Now apply it with the following command:

cd ~/android/lineageos/build/core

patch Makefile ~/android/oriole/patches/core_Makefile-20.0.patch

If you would like to know more about this patch, see the additional info at the bottom of this post.

Step 5: Add the pvmfw partition

NOTE: This step is no longer required as a patch to LineageOS to include it has been committed.

The Muppets firmware repo is missing one partition needed to make AVB work correctly, so we need to extract and add it ourselves:

First go to https://developers.google.com/android/images#oriole and download the matching factory image to ~/android/oriole

unzip the factory image, you should now have a directory something like oriole-tq1a.230205.002

change into the new directory

in the new directory should be a zip file something like image-oriole-tq1a.230205.002.zip

unzip pvmfw.img from the above image zip file

copy pvmfw.img to ~/android/lineageos/vendor/firmware/oriole/radio

edit the ~/android/lineageos/vendor/firmware/oriole/firmware.mk file and add the following line above the endif statement:

$(call add-radio-file,radio/pvmfw.img)

Step 6: Build LineageOS

You are now ready to build:

cd ~/android/lineageos

source build/envsetup.sh

breakfast oriole

croot

mka target-files-package otatools

Step 7: Sign the APKs

You are now ready to sign the apks with sign_target_files_apks:

./build/tools/releasetools/sign_target_files_apks -o -d ~/.android-certs $OUT/obj/PACKAGING/target_files_intermediates/*-target_files-*.zip signed-target_files.zip

Step 8: Build the OTA

Now it is time to complete the OTA package:

./build/tools/releasetools/ota_from_target_files -k ~/.android-certs/releasekey --block signed-target_files.zip lineage-20.0-[date]-UNOFFICIAL-oriole-signed.zip

Note, replace [date] with today's date in YYYYMMDD format.

Step 9: Create pkmd.bin for your phone

Before you can lock your phone, you have to tell it what your public key is so it knows it can trust your build.

To do this you need to create a pkmd.bin file:

~/android/lineageos/external/avb/avbtool extract_public_key --key ~/.android-certs/releasekey.key --output ~/android/oriole/pkmd/pkmd.bin

Note: if you don't have a releasekey.key file in your certificate directory, use the following command to generate one:

openssl pkcs8 -in releasekey.pk8 -inform DER -out releasekey.key -nocrypt

Step 10: Flashing your LineageOS build

It's time to flash your build to your phone. The following steps assume you have already unlocked your phone and have flashed an official version of LineageOS to it. You don't need to have flashed LineageOS yet, you can use the recovery that was just created, it is located in ~/android/lineageos/out/target/product/oriole and is called vendor_boot.img.

Reboot your phone in to recovery mode

In LineageOS Recovery return to the main menu and select "Apply update", then "Apply from ADB".

From your PC, run:

adb sideload ~/android/lineageos/lineage-20.0-[date]-UNOFFICIAL-oriole-signed.zip

When the sideload is complete, reboot into LineageOS. Make sure everything looks good with your build.

You may also need to format your data partition at this time depending on what you had installed on your phone previously, it's best to do so anyway. In LineageOS Recovery return to the main menu and select "Factory reset", then "Format data/factory reset", then confirm with "Format data".

Step 11: Flashing your signing key

Now it's time to add your signing key to the Android Verified Boot process. To do so, do the following:

Reboot your phone in to fastboot mode

From your PC, run:

fastboot flash avb_custom_key ~/android/oriole/pkmd/pkmd.bin
fastboot reboot bootloader
fastboot flashing lock

On your phone, confirm you want to re-lock and it will reboot

Note: If you have already flashed a custom avb key you must erase it before flashing the new one, use "fastboot erase avb_custom_key" to do so.

Your phone will then factory reset and then reboot in to LineageOS.

Which of course means you have to go through the first time setup wizard, so do so now.

Step 12: Disable OEM unlock

Congratulations! Your boot loader is now locked, but you can still unlock it again using fastboot, so it's time to disable that as well.

Unlock you phone and go to Settings->About phone

Scroll to the bottom and find "Build number"

Tap on it you enable the developer options

Go to Settings->System->Advanced->Developer options

Disable the "OEM unlocking" slider

Reboot

Step 13: Profit!

Other things

The above will build a standard USERDEBUG version of LineageOS, however this will still allow LineageOS Recovery to sideload non-signed files as well as give you root shell access through ADB. Step 3/4 above protects your system/vendor/boot/dtbo/etc. partitions, but none of the others. Likewise USERDEBUG builds will allow for rolling back to a previous builds/versions of LineageOS. To increase security and disallow both of these scenarios you may want to build a USER version of LineageOS to install. However this brings in other issues, such as flashing newer firmware from the vendor so make sure you understand the implications of both choices. For more details on build types, see https://source.android.com/setup/develop/new-device#build-variants.

The above build will not include other items like GAPPS or Magisk. Those are outside the scope of this tutorial.

If you want to remove you signing key from your phone, you can do it by running "fastboot erase avb_custom_key".

The changes you made to the AOSP Makefile may conflict with future updates that you pull from LineageOS through repo sync, if you have to reset the file to get repo sync to complete successfully, you'll have to reapply the changes afterwards.

So why can't I do this with official LineageOS builds?

You can! See https://xdaforums.com/t/guide-re-lo...ustom-rom-such-as-lineageos-official.4260825/ for more details.

Well at least you will be able to if the pvmfw partition gets added to the official LineageOS builds.

For Android Verified Boot (AVB) to work, it must have the hash values for each of the system/vendor/boot/dtbo/etc. partitions stored in vbmeta. Official LineageOS builds for oriole do include the vendor.img in them along with everything else that is needed, however that is not true for all phones.

An "issue" that might stop someone from using the official oriole builds is that AVB is enabled in the official LineageOS builds but does not validate the hash trees during boot which limits the protection offered.

Ok, what messages do I see during the boot process then?

During a boot you will of course see the standard power up screen, followed by the yellow "custom os" message and then the standard LineageOS boot animation.

For more details on AVB boot messages, see https://source.android.com/security/verifiedboot/boot-flow

So what does that patch to the Makefile do?

AOSP's default Makefile makes an assumption that when AVB is enabled, that all the img files will be available well before vbmeta.img is created. This is simply NOT true and AOSP seems to know this as well from the following comment in the Makefile:

# Not using INSTALLED_VBMETA_SYSTEMIMAGE_TARGET as it won't be set yet.

ifdef BOARD_AVB_VBMETA_SYSTEM

$(eval $(call check-and-set-avb-args,vbmeta_system))

endif

ifdef BOARD_AVB_VBMETA_VENDOR

$(eval $(call check-and-set-avb-args,vbmeta_vendor))

endif

These two calls eventual evaluate to returning the path to the partitions based upon the INSTALLED_*IMAGE_TARGET variable, which isn't created until later in the build process.

Because of this, the command to build vbmeta.img gets corrupted due to the missing make variable being empty and an invalid command line is passed to avbtool near the end of the build.

The corruption happens due to the fact that the following line from the original Makefile:

--include_descriptors_from_image $(call images-for-partitions,$(1))))))

Gets added to the avbtool call even if "$(call images-for-partitions,$(1))" turns out to be an empty string. Avbtool then throws an error message as it is expecting a parameter after the "--include_descriptors_from_image" flag that is added for the "empty" partition path.

The fix is to call "$(call images-for-partitions,$(1))" earlier, set it to a variable and check to make sure it isn't an empty string before letting the "--include_descriptors_from_image" be added to the avbtool command line to be used later.

This technically generates an incomplete vbmeta.img file during the build process, but since the signing process recreates it from scratch anyway; no harm, no foul.

Thank-Yous

Obviously to all of the members of the LineageOS team!

The Oriole maintainers

optimumpro for the OnePlus 5/5t re-locking guide which inspired this one

Quark.23 for helping with the process and testing on enchilada

Related guides

OnePlus 5/5t re-locking guide (https://xdaforums.com/oneplus-5/how-to/guide-relock-bootloader-custom-rom-t3849299)

Re-locking the bootloader with a pre-built custom ROM, such as LineageOS official (https://xdaforums.com/t/guide-re-lo...ustom-rom-such-as-lineageos-official.4260825/)

Re-locking the bootloader on the OnePlus 6t with a self-signed build of LOS 17.1 (https://xdaforums.com/t/guide-re-lo...s-6t-with-a-self-signed-build-of-los.4113743/)

Re-locking the bootloader on the OnePlus 8t with a self-signed build of LOS 18.1 (https://xdaforums.com/t/guide-re-lo...with-a-self-signed-build-of-los-18-1.4259409/)

Re-locking the bootloader on the Google Pixel 5 with a self-signed build of LOS 19.1 (https://xdaforums.com/t/guide-re-lo...with-a-self-signed-build-of-los-19-1.4500903/)

A discussion about bootloader locking/unlocking... AKA I want to relock my bootloader, should I? (over on [reddit]/r/LineageOS/comments/n7yo7u/a_discussion_about_bootloader_lockingunlocking/) (link broken on purpose to avoid the linked post being embedded here)