move install documentation to dedicated page
This commit is contained in:
parent
ad30c80e78
commit
6b50a7728b
@ -13,6 +13,7 @@
|
|||||||
<nav>
|
<nav>
|
||||||
<ul>
|
<ul>
|
||||||
<li><a href="/">GrapheneOS</a></li>
|
<li><a href="/">GrapheneOS</a></li>
|
||||||
|
<li><a href="/install">Install</a></li>
|
||||||
<li><a href="/releases">Releases</a></li>
|
<li><a href="/releases">Releases</a></li>
|
||||||
<li><a href="/source">Source</a></li>
|
<li><a href="/source">Source</a></li>
|
||||||
<li><a href="/donate">Donate</a></li>
|
<li><a href="/donate">Donate</a></li>
|
||||||
|
@ -13,6 +13,7 @@
|
|||||||
<nav>
|
<nav>
|
||||||
<ul>
|
<ul>
|
||||||
<li><a href="/">GrapheneOS</a></li>
|
<li><a href="/">GrapheneOS</a></li>
|
||||||
|
<li><a href="/install">Install</a></li>
|
||||||
<li><a href="/releases">Releases</a></li>
|
<li><a href="/releases">Releases</a></li>
|
||||||
<li><a href="/source">Source</a></li>
|
<li><a href="/source">Source</a></li>
|
||||||
<li class="active"><a href="/donate">Donate</a></li>
|
<li class="active"><a href="/donate">Donate</a></li>
|
||||||
|
@ -12,6 +12,7 @@
|
|||||||
<nav>
|
<nav>
|
||||||
<ul>
|
<ul>
|
||||||
<li class="active"><a href="/">GrapheneOS</a></li>
|
<li class="active"><a href="/">GrapheneOS</a></li>
|
||||||
|
<li><a href="/install">Install</a></li>
|
||||||
<li><a href="/releases">Releases</a></li>
|
<li><a href="/releases">Releases</a></li>
|
||||||
<li><a href="/source">Source</a></li>
|
<li><a href="/source">Source</a></li>
|
||||||
<li><a href="/donate">Donate</a></li>
|
<li><a href="/donate">Donate</a></li>
|
||||||
@ -40,7 +41,8 @@
|
|||||||
a much broader and more sustainable project with a strong development team. There are
|
a much broader and more sustainable project with a strong development team. There are
|
||||||
multiple organizations and companies in the process of backing this new incarnation of
|
multiple organizations and companies in the process of backing this new incarnation of
|
||||||
the hardened mobile OS project. Official Releases are available on the
|
the hardened mobile OS project. Official Releases are available on the
|
||||||
<a href="/releases">releases</a> page and installation instructions are below.</p>
|
<a href="/releases">releases page</a> and installation instructions are on the
|
||||||
|
<a href="/install">install page</a>.</p>
|
||||||
<p>See the <a href="https://github.com/GrapheneOS">GitHub organization</a> for sources
|
<p>See the <a href="https://github.com/GrapheneOS">GitHub organization</a> for sources
|
||||||
of the OS sub-projects including the cutting edge
|
of the OS sub-projects including the cutting edge
|
||||||
<a href="https://github.com/GrapheneOS/hardened_malloc/blob/master/README.md">new
|
<a href="https://github.com/GrapheneOS/hardened_malloc/blob/master/README.md">new
|
||||||
@ -54,83 +56,6 @@
|
|||||||
support for your own builds.</p>
|
support for your own builds.</p>
|
||||||
<p>The sources are available via the
|
<p>The sources are available via the
|
||||||
<a href="https://github.com/GrapheneOS/platform_manifest">manifest on GitHub</a>.</p>
|
<a href="https://github.com/GrapheneOS/platform_manifest">manifest on GitHub</a>.</p>
|
||||||
<h2>Installation</h2>
|
|
||||||
<h3>Prerequisites</h3>
|
|
||||||
<p>You should have at least 2GB of free memory available.</p>
|
|
||||||
<p>You need the unlocked variant of one of the supported devices, not a locked carrier
|
|
||||||
specific variant.</p>
|
|
||||||
<p>You need an updated copy of the <code>fastboot</code> tool and it needs to be
|
|
||||||
included in your <code>PATH</code> environment variable. You can run <code>fastboot
|
|
||||||
--version</code> to determine the current version. It should be at least
|
|
||||||
<code>28.0.0</code>. Don't proceed with the installation process until this is set up
|
|
||||||
properly in your current shell. A very common mistake is using an outdated copy of
|
|
||||||
<code>fastboot</code> from a Linux distribution package not receiving regular updates.
|
|
||||||
Make sure that the <code>fastboot</code> found earliest in your <code>PATH</code> is
|
|
||||||
the correct one if you have multiple copies on your system. You can run <code>which
|
|
||||||
fastboot</code> to determine where the tool being used is coming from. Older versions
|
|
||||||
do not have support for current devices. Very old versions of <code>fastboot</code>
|
|
||||||
from several years ago are still shipped by Linux distributions like Debian and lack
|
|
||||||
the compatibility detection of modern versions so they can soft brick devices.</p>
|
|
||||||
<h3>Enabling OEM unlocking</h3>
|
|
||||||
<p>OEM unlocking needs to be enabled from within the operating system.</p>
|
|
||||||
<p>Enable the developer settings menu by going to Settings -> System -> About phone
|
|
||||||
and pressing on the build number menu entry until developer mode is enabled.</p>
|
|
||||||
<p>Next, go to Settings -> System -> Advanced -> Developer settings and toggle on the
|
|
||||||
'Enable OEM unlocking' setting. This requires internet access on devices with Google
|
|
||||||
Play Services.</p>
|
|
||||||
<h3>Unlocking the bootloader</h3>
|
|
||||||
<p>First, boot into the bootloader interface. You can do this by turning off the
|
|
||||||
device and then turning it on by holding both the Volume Down and Power buttons.</p>
|
|
||||||
<p>The bootloader now needs to be unlocked to allow flashing new images:</p>
|
|
||||||
<pre>fastboot flashing unlock</pre>
|
|
||||||
<p>The command needs to be confirmed on the device.</p>
|
|
||||||
<h3>Obtaining factory images</h3>
|
|
||||||
<p>The initial install will be performed by flashing the factory images. This will
|
|
||||||
replace the existing OS installation and wipe all the existing data.</p>
|
|
||||||
<p>You can download the factory images from the bottom of this page.</p>
|
|
||||||
<p>Verify the official factory images using the GPG signature:</p>
|
|
||||||
<pre>gpg --recv-keys 65EEFE022108E2B708CBFCF7F9E712E59AF5F22A
|
|
||||||
gpg --verify blueline-factory-2018.12.21.18.zip.sig blueline-factory-2018.12.21.18.zip</pre>
|
|
||||||
<p>When this signing key is replaced, the new key will be signed with it.</p>
|
|
||||||
<h3>Flashing factory images</h3>
|
|
||||||
<p>Next, extract the factory images and run the script to flash them. Note that the
|
|
||||||
<code>fastboot</code> command run by the flashing script requires a fair bit of free
|
|
||||||
space in a temporary directory, which defaults to <code>/tmp</code>:<p>
|
|
||||||
<pre>unzip blueline-factory-2018.12.21.18.zip
|
|
||||||
cd blueline-pq1a.181205.006
|
|
||||||
./flash-all.sh</pre>
|
|
||||||
<p>Use a different temporary directory if your <code>/tmp</code> doesn't have enough
|
|
||||||
space available:</p>
|
|
||||||
<pre>mkdir tmp
|
|
||||||
TMPDIR="$PWD/tmp" ./flash-all.sh</pre>
|
|
||||||
<p>Wait for the flashing process to complete and for the device to boot up using the
|
|
||||||
new operating system.</p>
|
|
||||||
<p>You should now proceed to locking the bootloader before using the device as locking
|
|
||||||
wipes the data again.</p>
|
|
||||||
<h3>Locking the bootloader</h3>
|
|
||||||
<p>Locking the bootloader is important as it enables full verified boot. It also prevents using
|
|
||||||
fastboot to flash, format or erase partitions. Verified boot will detect modifications to any of
|
|
||||||
the OS partitions (vbmeta, boot/dtbo, system, vendor) and it will prevent reading any modified /
|
|
||||||
corrupted data. If changes are detected, error correction data is used to attempt to obtain the
|
|
||||||
original data at which point it's verified again which makes verified boot robust to non-malicious
|
|
||||||
corruption.</p>
|
|
||||||
<p>Reboot into the bootloader menu and set it to locked:</p>
|
|
||||||
<pre>fastboot flashing lock</pre>
|
|
||||||
<p>The command needs to be confirmed on the device since it needs to perform a factory
|
|
||||||
reset.</p>
|
|
||||||
<p>Unlocking the bootloader again will perform a factory reset.</p>
|
|
||||||
<h3>Disabling OEM unlocking</h3>
|
|
||||||
<p>OEM unlocking can be disabled again in the developer settings menu within the
|
|
||||||
operating system after booting it up again.</p>
|
|
||||||
<h2>Replacing GrapheneOS with the stock OS</h2>
|
|
||||||
<p>Installation of the stock OS via the stock factory images is the same process
|
|
||||||
described above. However, before locking, there's an additional step to fully revert
|
|
||||||
the device to a clean factory state.</p>
|
|
||||||
<p>The GrapheneOS factory images flash a non-stock Android Verified Boot key which
|
|
||||||
needs to be erased to fully revert back to a stock device state. After flashing the
|
|
||||||
stock factory images and before locking the bootloader, you should erase the custom
|
|
||||||
Android Verified Boot key to untrust it:</p>
|
|
||||||
<pre>fastboot erase avb_custom_key</pre>
|
|
||||||
</div>
|
</div>
|
||||||
</body>
|
</body>
|
||||||
</html>
|
</html>
|
||||||
|
102
static/install.html
Normal file
102
static/install.html
Normal file
@ -0,0 +1,102 @@
|
|||||||
|
<!DOCTYPE html>
|
||||||
|
<html lang="en">
|
||||||
|
<head>
|
||||||
|
<meta charset="utf-8"/>
|
||||||
|
<meta name="theme-color" content="#212121"/>
|
||||||
|
<meta name="viewport" content="width=device-width, initial-scale=1"/>
|
||||||
|
<meta name="description" content="GrapheneOS is a security and privacy focused mobile OS with Android app compatibility."/>
|
||||||
|
<title>GrapheneOS</title>
|
||||||
|
<link rel="stylesheet" href="/grapheneos.css?0"/>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<nav>
|
||||||
|
<ul>
|
||||||
|
<li><a href="/">GrapheneOS</a></li>
|
||||||
|
<li class="active"><a href="/install">Install</a></li>
|
||||||
|
<li><a href="/releases">Releases</a></li>
|
||||||
|
<li><a href="/source">Source</a></li>
|
||||||
|
<li><a href="/donate">Donate</a></li>
|
||||||
|
<li><a href="/contact">Contact</a></li>
|
||||||
|
</ul>
|
||||||
|
</nav>
|
||||||
|
<div id="content">
|
||||||
|
<h1>Installation</h1>
|
||||||
|
<h2>Prerequisites</h2>
|
||||||
|
<p>You should have at least 2GB of free memory available.</p>
|
||||||
|
<p>You need the unlocked variant of one of the supported devices, not a locked carrier
|
||||||
|
specific variant.</p>
|
||||||
|
<p>You need an updated copy of the <code>fastboot</code> tool and it needs to be
|
||||||
|
included in your <code>PATH</code> environment variable. You can run <code>fastboot
|
||||||
|
--version</code> to determine the current version. It should be at least
|
||||||
|
<code>28.0.0</code>. Don't proceed with the installation process until this is set up
|
||||||
|
properly in your current shell. A very common mistake is using an outdated copy of
|
||||||
|
<code>fastboot</code> from a Linux distribution package not receiving regular updates.
|
||||||
|
Make sure that the <code>fastboot</code> found earliest in your <code>PATH</code> is
|
||||||
|
the correct one if you have multiple copies on your system. You can run <code>which
|
||||||
|
fastboot</code> to determine where the tool being used is coming from. Older versions
|
||||||
|
do not have support for current devices. Very old versions of <code>fastboot</code>
|
||||||
|
from several years ago are still shipped by Linux distributions like Debian and lack
|
||||||
|
the compatibility detection of modern versions so they can soft brick devices.</p>
|
||||||
|
<h2>Enabling OEM unlocking</h2>
|
||||||
|
<p>OEM unlocking needs to be enabled from within the operating system.</p>
|
||||||
|
<p>Enable the developer settings menu by going to Settings -> System -> About phone
|
||||||
|
and pressing on the build number menu entry until developer mode is enabled.</p>
|
||||||
|
<p>Next, go to Settings -> System -> Advanced -> Developer settings and toggle on the
|
||||||
|
'Enable OEM unlocking' setting. This requires internet access on devices with Google
|
||||||
|
Play Services.</p>
|
||||||
|
<h2>Unlocking the bootloader</h2>
|
||||||
|
<p>First, boot into the bootloader interface. You can do this by turning off the
|
||||||
|
device and then turning it on by holding both the Volume Down and Power buttons.</p>
|
||||||
|
<p>The bootloader now needs to be unlocked to allow flashing new images:</p>
|
||||||
|
<pre>fastboot flashing unlock</pre>
|
||||||
|
<p>The command needs to be confirmed on the device.</p>
|
||||||
|
<h2>Obtaining factory images</h2>
|
||||||
|
<p>The initial install will be performed by flashing the factory images. This will
|
||||||
|
replace the existing OS installation and wipe all the existing data.</p>
|
||||||
|
<p>You can download the factory images from the bottom of this page.</p>
|
||||||
|
<p>Verify the official factory images using the GPG signature:</p>
|
||||||
|
<pre>gpg --recv-keys 65EEFE022108E2B708CBFCF7F9E712E59AF5F22A
|
||||||
|
gpg --verify blueline-factory-2018.12.21.18.zip.sig blueline-factory-2018.12.21.18.zip</pre>
|
||||||
|
<p>When this signing key is replaced, the new key will be signed with it.</p>
|
||||||
|
<h2>Flashing factory images</h2>
|
||||||
|
<p>Next, extract the factory images and run the script to flash them. Note that the
|
||||||
|
<code>fastboot</code> command run by the flashing script requires a fair bit of free
|
||||||
|
space in a temporary directory, which defaults to <code>/tmp</code>:<p>
|
||||||
|
<pre>unzip blueline-factory-2018.12.21.18.zip
|
||||||
|
cd blueline-pq1a.181205.006
|
||||||
|
./flash-all.sh</pre>
|
||||||
|
<p>Use a different temporary directory if your <code>/tmp</code> doesn't have enough
|
||||||
|
space available:</p>
|
||||||
|
<pre>mkdir tmp
|
||||||
|
TMPDIR="$PWD/tmp" ./flash-all.sh</pre>
|
||||||
|
<p>Wait for the flashing process to complete and for the device to boot up using the
|
||||||
|
new operating system.</p>
|
||||||
|
<p>You should now proceed to locking the bootloader before using the device as locking
|
||||||
|
wipes the data again.</p>
|
||||||
|
<h2>Locking the bootloader</h2>
|
||||||
|
<p>Locking the bootloader is important as it enables full verified boot. It also prevents using
|
||||||
|
fastboot to flash, format or erase partitions. Verified boot will detect modifications to any of
|
||||||
|
the OS partitions (vbmeta, boot/dtbo, system, vendor) and it will prevent reading any modified /
|
||||||
|
corrupted data. If changes are detected, error correction data is used to attempt to obtain the
|
||||||
|
original data at which point it's verified again which makes verified boot robust to non-malicious
|
||||||
|
corruption.</p>
|
||||||
|
<p>Reboot into the bootloader menu and set it to locked:</p>
|
||||||
|
<pre>fastboot flashing lock</pre>
|
||||||
|
<p>The command needs to be confirmed on the device since it needs to perform a factory
|
||||||
|
reset.</p>
|
||||||
|
<p>Unlocking the bootloader again will perform a factory reset.</p>
|
||||||
|
<h2>Disabling OEM unlocking</h2>
|
||||||
|
<p>OEM unlocking can be disabled again in the developer settings menu within the
|
||||||
|
operating system after booting it up again.</p>
|
||||||
|
<h2>Replacing GrapheneOS with the stock OS</h2>
|
||||||
|
<p>Installation of the stock OS via the stock factory images is the same process
|
||||||
|
described above. However, before locking, there's an additional step to fully revert
|
||||||
|
the device to a clean factory state.</p>
|
||||||
|
<p>The GrapheneOS factory images flash a non-stock Android Verified Boot key which
|
||||||
|
needs to be erased to fully revert back to a stock device state. After flashing the
|
||||||
|
stock factory images and before locking the bootloader, you should erase the custom
|
||||||
|
Android Verified Boot key to untrust it:</p>
|
||||||
|
<pre>fastboot erase avb_custom_key</pre>
|
||||||
|
</div>
|
||||||
|
</body>
|
||||||
|
</html>
|
@ -12,6 +12,7 @@
|
|||||||
<nav>
|
<nav>
|
||||||
<ul>
|
<ul>
|
||||||
<li><a href="/">GrapheneOS</a></li>
|
<li><a href="/">GrapheneOS</a></li>
|
||||||
|
<li><a href="/install">Install</a></li>
|
||||||
<li class="active"><a href="/releases">Releases</a></li>
|
<li class="active"><a href="/releases">Releases</a></li>
|
||||||
<li><a href="/source">Source</a></li>
|
<li><a href="/source">Source</a></li>
|
||||||
<li><a href="/donate">Donate</a></li>
|
<li><a href="/donate">Donate</a></li>
|
||||||
|
@ -6,6 +6,10 @@
|
|||||||
<loc>https://grapheneos.org/</loc>
|
<loc>https://grapheneos.org/</loc>
|
||||||
<priority>1.0</priority>
|
<priority>1.0</priority>
|
||||||
</url>
|
</url>
|
||||||
|
<url>
|
||||||
|
<loc>https://attestation.app/install</loc>
|
||||||
|
<priority>0.5</priority>
|
||||||
|
</url>
|
||||||
<url>
|
<url>
|
||||||
<loc>https://attestation.app/releases</loc>
|
<loc>https://attestation.app/releases</loc>
|
||||||
<priority>0.5</priority>
|
<priority>0.5</priority>
|
||||||
|
@ -13,6 +13,7 @@
|
|||||||
<nav>
|
<nav>
|
||||||
<ul>
|
<ul>
|
||||||
<li><a href="/">GrapheneOS</a></li>
|
<li><a href="/">GrapheneOS</a></li>
|
||||||
|
<li><a href="/install">Install</a></li>
|
||||||
<li><a href="/releases">Releases</a></li>
|
<li><a href="/releases">Releases</a></li>
|
||||||
<li class="active"><a href="/source">Source</a></li>
|
<li class="active"><a href="/source">Source</a></li>
|
||||||
<li><a href="/donate">Donate</a></li>
|
<li><a href="/donate">Donate</a></li>
|
||||||
|
Loading…
x
Reference in New Issue
Block a user