security/hakurei.app
security/hakurei.app
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

move install documentation to dedicated page

Browse Source
This commit is contained in:
Daniel Micay 2019-04-26 02:18:24 -04:00
parent ad30c80e78
commit 6b50a7728b
7 changed files with 113 additions and 78 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
static/contact.html
View File

@ -13,6 +13,7 @@
<nav>
<ul>
<li><a href="/">GrapheneOS</a></li>
<li><a href="/install">Install</a></li>
<li><a href="/releases">Releases</a></li>
<li><a href="/source">Source</a></li>
<li><a href="/donate">Donate</a></li>

1
static/donate.html
View File

@ -13,6 +13,7 @@
<nav>
<ul>
<li><a href="/">GrapheneOS</a></li>
<li><a href="/install">Install</a></li>
<li><a href="/releases">Releases</a></li>
<li><a href="/source">Source</a></li>
<li class="active"><a href="/donate">Donate</a></li>

81
static/index.html
View File

@ -12,6 +12,7 @@
<nav>
<ul>
<li class="active"><a href="/">GrapheneOS</a></li>
<li><a href="/install">Install</a></li>
<li><a href="/releases">Releases</a></li>
<li><a href="/source">Source</a></li>
<li><a href="/donate">Donate</a></li>
@ -40,7 +41,8 @@
a much broader and more sustainable project with a strong development team. There are
multiple organizations and companies in the process of backing this new incarnation of
the hardened mobile OS project. Official Releases are available on the
<a href="/releases">releases</a> page and installation instructions are below.</p>
<a href="/releases">releases page</a> and installation instructions are on the
<a href="/install">install page</a>.</p>
<p>See the <a href="https://github.com/GrapheneOS">GitHub organization</a> for sources
of the OS sub-projects including the cutting edge
<a href="https://github.com/GrapheneOS/hardened_malloc/blob/master/README.md">new
@ -54,83 +56,6 @@
support for your own builds.</p>
<p>The sources are available via the
<a href="https://github.com/GrapheneOS/platform_manifest">manifest on GitHub</a>.</p>
<h2>Installation</h2>
<h3>Prerequisites</h3>
<p>You should have at least 2GB of free memory available.</p>
<p>You need the unlocked variant of one of the supported devices, not a locked carrier
specific variant.</p>
<p>You need an updated copy of the <code>fastboot</code> tool and it needs to be
included in your <code>PATH</code> environment variable. You can run <code>fastboot
--version</code> to determine the current version. It should be at least
<code>28.0.0</code>. Don't proceed with the installation process until this is set up
properly in your current shell. A very common mistake is using an outdated copy of
<code>fastboot</code> from a Linux distribution package not receiving regular updates.
Make sure that the <code>fastboot</code> found earliest in your <code>PATH</code> is
the correct one if you have multiple copies on your system. You can run <code>which
fastboot</code> to determine where the tool being used is coming from. Older versions
do not have support for current devices. Very old versions of <code>fastboot</code>
from several years ago are still shipped by Linux distributions like Debian and lack
the compatibility detection of modern versions so they can soft brick devices.</p>
<h3>Enabling OEM unlocking</h3>
<p>OEM unlocking needs to be enabled from within the operating system.</p>
<p>Enable the developer settings menu by going to Settings -> System -> About phone
and pressing on the build number menu entry until developer mode is enabled.</p>
<p>Next, go to Settings -> System -> Advanced -> Developer settings and toggle on the
'Enable OEM unlocking' setting. This requires internet access on devices with Google
Play Services.</p>
<h3>Unlocking the bootloader</h3>
<p>First, boot into the bootloader interface. You can do this by turning off the
device and then turning it on by holding both the Volume Down and Power buttons.</p>
<p>The bootloader now needs to be unlocked to allow flashing new images:</p>
<pre>fastboot flashing unlock</pre>
<p>The command needs to be confirmed on the device.</p>
<h3>Obtaining factory images</h3>
<p>The initial install will be performed by flashing the factory images. This will
replace the existing OS installation and wipe all the existing data.</p>
<p>You can download the factory images from the bottom of this page.</p>
<p>Verify the official factory images using the GPG signature:</p>
<pre>gpg --recv-keys 65EEFE022108E2B708CBFCF7F9E712E59AF5F22A
gpg --verify blueline-factory-2018.12.21.18.zip.sig blueline-factory-2018.12.21.18.zip</pre>
<p>When this signing key is replaced, the new key will be signed with it.</p>
<h3>Flashing factory images</h3>
<p>Next, extract the factory images and run the script to flash them. Note that the
<code>fastboot</code> command run by the flashing script requires a fair bit of free
space in a temporary directory, which defaults to <code>/tmp</code>:<p>
<pre>unzip blueline-factory-2018.12.21.18.zip
cd blueline-pq1a.181205.006
./flash-all.sh</pre>
<p>Use a different temporary directory if your <code>/tmp</code> doesn't have enough
space available:</p>
<pre>mkdir tmp
TMPDIR="$PWD/tmp" ./flash-all.sh</pre>
<p>Wait for the flashing process to complete and for the device to boot up using the
new operating system.</p>
<p>You should now proceed to locking the bootloader before using the device as locking
wipes the data again.</p>
<h3>Locking the bootloader</h3>
<p>Locking the bootloader is important as it enables full verified boot. It also prevents using
fastboot to flash, format or erase partitions. Verified boot will detect modifications to any of
the OS partitions (vbmeta, boot/dtbo, system, vendor) and it will prevent reading any modified /
corrupted data. If changes are detected, error correction data is used to attempt to obtain the
original data at which point it's verified again which makes verified boot robust to non-malicious
corruption.</p>
<p>Reboot into the bootloader menu and set it to locked:</p>
<pre>fastboot flashing lock</pre>
<p>The command needs to be confirmed on the device since it needs to perform a factory
reset.</p>
<p>Unlocking the bootloader again will perform a factory reset.</p>
<h3>Disabling OEM unlocking</h3>
<p>OEM unlocking can be disabled again in the developer settings menu within the
operating system after booting it up again.</p>
<h2>Replacing GrapheneOS with the stock OS</h2>
<p>Installation of the stock OS via the stock factory images is the same process
described above. However, before locking, there's an additional step to fully revert
the device to a clean factory state.</p>
<p>The GrapheneOS factory images flash a non-stock Android Verified Boot key which
needs to be erased to fully revert back to a stock device state. After flashing the
stock factory images and before locking the bootloader, you should erase the custom
Android Verified Boot key to untrust it:</p>
<pre>fastboot erase avb_custom_key</pre>
</div>
</body>
</html>

102
static/install.html Normal file
View File

@ -0,0 +1,102 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8"/>
<meta name="theme-color" content="#212121"/>
<meta name="viewport" content="width=device-width, initial-scale=1"/>
<meta name="description" content="GrapheneOS is a security and privacy focused mobile OS with Android app compatibility."/>
<title>GrapheneOS</title>
<link rel="stylesheet" href="/grapheneos.css?0"/>
</head>
<body>
<nav>
<ul>
<li><a href="/">GrapheneOS</a></li>
<li class="active"><a href="/install">Install</a></li>
<li><a href="/releases">Releases</a></li>
<li><a href="/source">Source</a></li>
<li><a href="/donate">Donate</a></li>
<li><a href="/contact">Contact</a></li>
</ul>
</nav>
<div id="content">
<h1>Installation</h1>
<h2>Prerequisites</h2>
<p>You should have at least 2GB of free memory available.</p>
<p>You need the unlocked variant of one of the supported devices, not a locked carrier
specific variant.</p>
<p>You need an updated copy of the <code>fastboot</code> tool and it needs to be
included in your <code>PATH</code> environment variable. You can run <code>fastboot
--version</code> to determine the current version. It should be at least
<code>28.0.0</code>. Don't proceed with the installation process until this is set up
properly in your current shell. A very common mistake is using an outdated copy of
<code>fastboot</code> from a Linux distribution package not receiving regular updates.
Make sure that the <code>fastboot</code> found earliest in your <code>PATH</code> is
the correct one if you have multiple copies on your system. You can run <code>which
fastboot</code> to determine where the tool being used is coming from. Older versions
do not have support for current devices. Very old versions of <code>fastboot</code>
from several years ago are still shipped by Linux distributions like Debian and lack
the compatibility detection of modern versions so they can soft brick devices.</p>
<h2>Enabling OEM unlocking</h2>
<p>OEM unlocking needs to be enabled from within the operating system.</p>
<p>Enable the developer settings menu by going to Settings -> System -> About phone
and pressing on the build number menu entry until developer mode is enabled.</p>
<p>Next, go to Settings -> System -> Advanced -> Developer settings and toggle on the
'Enable OEM unlocking' setting. This requires internet access on devices with Google
Play Services.</p>
<h2>Unlocking the bootloader</h2>
<p>First, boot into the bootloader interface. You can do this by turning off the
device and then turning it on by holding both the Volume Down and Power buttons.</p>
<p>The bootloader now needs to be unlocked to allow flashing new images:</p>
<pre>fastboot flashing unlock</pre>
<p>The command needs to be confirmed on the device.</p>
<h2>Obtaining factory images</h2>
<p>The initial install will be performed by flashing the factory images. This will
replace the existing OS installation and wipe all the existing data.</p>
<p>You can download the factory images from the bottom of this page.</p>
<p>Verify the official factory images using the GPG signature:</p>
<pre>gpg --recv-keys 65EEFE022108E2B708CBFCF7F9E712E59AF5F22A
gpg --verify blueline-factory-2018.12.21.18.zip.sig blueline-factory-2018.12.21.18.zip</pre>
<p>When this signing key is replaced, the new key will be signed with it.</p>
<h2>Flashing factory images</h2>
<p>Next, extract the factory images and run the script to flash them. Note that the
<code>fastboot</code> command run by the flashing script requires a fair bit of free
space in a temporary directory, which defaults to <code>/tmp</code>:<p>
<pre>unzip blueline-factory-2018.12.21.18.zip
cd blueline-pq1a.181205.006
./flash-all.sh</pre>
<p>Use a different temporary directory if your <code>/tmp</code> doesn't have enough
space available:</p>
<pre>mkdir tmp
TMPDIR="$PWD/tmp" ./flash-all.sh</pre>
<p>Wait for the flashing process to complete and for the device to boot up using the
new operating system.</p>
<p>You should now proceed to locking the bootloader before using the device as locking
wipes the data again.</p>
<h2>Locking the bootloader</h2>
<p>Locking the bootloader is important as it enables full verified boot. It also prevents using
fastboot to flash, format or erase partitions. Verified boot will detect modifications to any of
the OS partitions (vbmeta, boot/dtbo, system, vendor) and it will prevent reading any modified /
corrupted data. If changes are detected, error correction data is used to attempt to obtain the
original data at which point it's verified again which makes verified boot robust to non-malicious
corruption.</p>
<p>Reboot into the bootloader menu and set it to locked:</p>
<pre>fastboot flashing lock</pre>
<p>The command needs to be confirmed on the device since it needs to perform a factory
reset.</p>
<p>Unlocking the bootloader again will perform a factory reset.</p>
<h2>Disabling OEM unlocking</h2>
<p>OEM unlocking can be disabled again in the developer settings menu within the
operating system after booting it up again.</p>
<h2>Replacing GrapheneOS with the stock OS</h2>
<p>Installation of the stock OS via the stock factory images is the same process
described above. However, before locking, there's an additional step to fully revert
the device to a clean factory state.</p>
<p>The GrapheneOS factory images flash a non-stock Android Verified Boot key which
needs to be erased to fully revert back to a stock device state. After flashing the
stock factory images and before locking the bootloader, you should erase the custom
Android Verified Boot key to untrust it:</p>
<pre>fastboot erase avb_custom_key</pre>
</div>
</body>
</html>

1
static/releases.html
View File

@ -12,6 +12,7 @@
<nav>
<ul>
<li><a href="/">GrapheneOS</a></li>
<li><a href="/install">Install</a></li>
<li class="active"><a href="/releases">Releases</a></li>
<li><a href="/source">Source</a></li>
<li><a href="/donate">Donate</a></li>

4
static/sitemap.xml
View File

@ -6,6 +6,10 @@
<loc>https://grapheneos.org/</loc>
<priority>1.0</priority>
</url>
<url>
<loc>https://attestation.app/install</loc>
<priority>0.5</priority>
</url>
<url>
<loc>https://attestation.app/releases</loc>
<priority>0.5</priority>

1
static/source.html
View File

@ -13,6 +13,7 @@
<nav>
<ul>
<li><a href="/">GrapheneOS</a></li>
<li><a href="/install">Install</a></li>
<li><a href="/releases">Releases</a></li>
<li class="active"><a href="/source">Source</a></li>
<li><a href="/donate">Donate</a></li>