crDroid, DivestOS, /e/OS, LineageOS-for-microG are all based on the code of the and Lineage Android distribution. /e/OS builds two versions: /e/OS-Q + /e/OS-R. The bootloader is open - except for DivestOS Mobile.
Tad aka SkewedZeppelin from Divested Computing Group has single-handedly managed to lock the bootloader again on these four OnePlus with his DivestOS 18.1 / 11.0 / R. OnePlus 6 (enchilada) and 6T (fajita) are also tentatively already running its DivestOS 19.1 / 12.1 / S / - with Re-Locked bootloader.
„bootloader locking, this is pretty easy to support/enable, you just have to integrate the following into your builds“
this is pretty easy to support/enable, you just have to integrate the following into your builds
- builds must be -user, not -userdebug
- in DivestOS-Build repo:
- signing keys can be generated correctly using Scripts/Generate_Signing_Keys.sh $device
- Scripts/Common/Copy_Keys.sh is used to copy verity keys into kernels
- processRelease() in Scripts/Common/Functions.sh is used to sign releases
- devices can have verified boot re-enabled using enableVerity() in Scripts/Common/Functions.sh
- you need to
sed -i 's/^\treturn VERITY_STATE_DISABLE;//' drivers/md/dm-android-verity.con all kernels, to restore verified boot that LineageOS disabled
- you’ll need to apply Patches/*/android_build/0002-OTA_Keys.patch to android_build repo to correctly add keys to the recovery
- update_device_info.sh in DivestOS-Website repo has device bootloader information in the format: unlock method, bootloader lock support, verified boot support
As for device support (per the devices I build for):
- 9 devices have been tested working with locked bootloader and verified boot
- 5 devices have been tested working with locked bootloader but do not support verfied boot
- 25 devices should support locked bootloader with verified boot
- 6 devices should support locked bootloader but do not support verified boot
iodéOS 1.x and 2.x with re-locked bootloader on OnePlus 5/5T + 6/6T - that would be an extraordinary feature and best advertisement for iodéOS, apart from an iodé GSI.