How to install GrapheneOS on Google Pixel 6a (GP6a) + Setup for new users

published 2022-11-06 · updated 2022-12-21 #grapheneos #android #how_to #install
The Google Pixel 6a is a great mobile device. With the Google Tensor chip, it's one of the most secure mobile devices you can purchase.

Transcript

Please excuse any grammatical errors. I used a tool to generate the transcript and haven't had a chance to read through it yet.

So the main purpose of today's video is to install graphene OS on the Google Pixel six a specifically, the process will be similar regardless of which pixel you have. But the one I'm demonstrating on today is the six A, we're going to be following the instructions on graphene os.org. I'll put the link down below in the description as well as on the screen right now. And we will be using the web installer, it's essentially impossible to break your phone using the web installer. So don't be scared to try this, I've done the process probably about 50 to 100 times at this point, I've never had an issue with it. Now that being said, there are some issues that come up for some individuals when they are going through the install process. And I will point those out throughout the video for any tips, you can try to overcome those. But with that out of the way, let's begin the installation process. So we're at Griffin os.org, the web installer, we're going to go down to the prerequisites, give this a read through the supported OS. I'm installing this from Mac OS today using brave browser, make sure you are using a supported browser and a supported OS. Otherwise you will encounter issues. This is a very important note for those on Ubuntu. If you're using chromium that is broken and will not work. So make sure if you're on a boon to you are not using chromium. So once you know you're using a supported browser and OS, we can continue, make sure to give all this a read through I'm not going to waste your time reading it to you. But there's some other important bits of information in here such as Do not use an incognito browser or private browser. Because again, you will encounter issues. So once you make sure all the prerequisites are met, we are on to enabling OEM unlocking. So just a note about where you get your information from always go to the source directly, in this case, Griffin os.org. That's why I'm following along in their guide when showing you the developers do a great job documenting the installation process and different features. Always go to the source. First, don't trust some random YouTuber talking about it, or some random forum posts that you saw, you'll always get the best information directly from the source. So the first step for this OEM unlocking needs to be enabled from within the operating system, enable the developer options by going into settings about and pressing the build number entry until developer mode is enabled. So I'm going to be demonstrating this, like I just took my pixel out of the box. When you turn it on for the first time, you will see this screen. If you already past the initial setup, and you want to skip ahead, I'll have that in the play bar below. So you can skip this section. But if you're here, go ahead and press Get Started. I don't have a SIM card in the phone yet. So go ahead and click Skip. So you could connect to Wi Fi at this point. But I like to skip this because we don't need a Wi Fi connection, we can set up the pixel offline first. So we're gonna go to Setup offline. Just a quick warning about setting up offline continue. Date and time. I uncheck these just for good practice. Except Except it's always good practice to set a pin. Even if you're just going to be erasing the OS quick. Sometimes I don't but you should anyways.

No fingerprint, no thanks. Skip, and then swipe up to go home. So at this point, we're on the home screen, the first step is to go into settings about so swipe up,

you'll see settings, go to Settings, scroll down to the bottom, we're going to go into about phone, scroll down at the bottom here you see build number. Now tap on that you will get this screen if you set a PIN number, type in the pin. And we can now see you are now a developer. So developer options are enabled. And that's where the setting for OEM unlocking will be located. So next, go into settings, system developer options and toggle OEM unlocking. So we're gonna go back word in the settings, so go to System developer options. And here's the option to enable OEM unlocking. So there's a couple things to note about OEM unlocking. So if you purchase your device brand new OEM unlocking will be grayed out and you won't be able to enable it. The reason for that is that you need to actually connect to Wi Fi at this point before you can enable OEM unlocking. So we can see here OEM unlocking requires Internet access so that the stock OS can check if the device was sold as locked by a carrier. And so what does that actually mean? So the founder and lead developer of graphene OS has a thread on Twitter describing how OEM unlocking actually works, which again, I'll link down below if you want to read through it. So essentially, how that works is that Google has a database of the pixels serial numbers and which ones were sold as an unlocked device not locked by the carrier. Your device will check with Google if the device is enabled for OEM unlocking after you connect to the internet. You will then be able to enable OEM unlocking. If your device checks with Google and your serial number is not authorized for unlocking, then that option will remain grayed out because it's locked by the carrier devices that are commonly locked or Verizon branded pixels. So if you have a Verizon pixel, you will not be able to enable OEM unlocking and you cannot install graphene unless your only option is to return it or sell it and buy a OEM, unlockable pixel. For me personally, I buy my devices directly from Google as unlocked, so I know that it's unlockable, I don't need to worry about it being locked. If you decide to buy used online, I would suggest asking the seller to confirm if OEM unlocking is available, had them send you a screenshot so that you know, I've made the mistake in the past of buying a locked pixel, I had to return it. So don't make the same mistake as me. One other note on the site is so for the pixel six A, this phone in particular, if you're using one, unlocking won't work with the version of the stock OS from the factory, you need to update it to the June 2022 release or later, via and over the air update. After you've updated it, you also need to factory reset the device to fix the OEM unlocking issue. So depending on when you bought your pixel, this may not be an issue for you. This pixel was purchased around a month ago, and it shipped with the newer updates. And I did not have to factory reset or follow this at all to get it to work. But if you purchased a pixel earlier, you may need to do this and follow these steps to actually get OEM unlocking to work. So I've unlocked this device in the past, which is why OEM unlocking is available. So again, connect to Wi Fi, if it's not, if your device is able to be unlocked after a checksum with Google, you will then be able to enable it, enable OEM unlocking if you have a pin set you need to enter it. Allow OEM unlocking enable, and we can now see it's enabled. So on to the next step flashing as non root. This is for Linux distributions, I'm not going to cover this part. So the next step is booting into the bootloader interface, you need to boot your phone into the bootloader interface. To do this, you need to hold the Volume Down button while the phone boots. The easiest approach is to reboot the phone and begin holding the Volume Down button until it boots up into the bootloader interface. So now what that looks like we have OEM unlocking enabled. Going to swipe down, going to pull down again, in the bottom right hand corner is the power button. And then from here, we're going to select Restart, hold down the volume down button on the right side of the phone. So as you saw that took about 10 seconds. And once you see this screen, we are in the bootloader interface. If the screen doesn't come up for you, the phone will just boot up like normal, try restarting and again, hold the Volume Down button until you get to this screen. So the next step is actually connecting the phone to our computer. And so for this step I want to mention, make sure you use the stock cable that actually came with your device. Now that being said, the most common issue that I've heard others talk about is that their computer doesn't see the phone. And that's because they have a faulty USB cable. So if you plug in your USB cable to your computer with your phone, and it doesn't see it or you have any other strange issues when downloading the OS later in this guide, go ahead and try a different USB cable, and likely that'll solve your issue. Also, when connecting the USB cable to your computer connected directly to your computer, don't connect it through a dongle that's plugged into another port. While it still might work. This could lead to some other strange issues. Let's go ahead and connect the USB cable to our device. So just some notes here. If you're using Windows on Windows, you need to install the driver for fastboot. If you don't already have it, you can obtain the driver from Windows Update, which will detect it as an optional update when the device is booted into the bootloader interface and connected to the computer. So you should see a little pop up if you're on Windows. Another method is to go here and just download the driver manually. But the easiest option will likely be through Windows Update. So once you have your device connected to your computer with a USB cable, and you have all the drivers installed, if you're on Windows, the next step is unlocking the bootloader. It's important to note that unlocking the bootloader will erase the device and wipe all data. It's impossible to recover your data if you erase it. So make sure if you had any contacts or calendar events or photos that you need to save that you save those before proceeding because your device will be erased. So if you're ready to continue, we're going to press the unlock bootloader button, you'll see this prompt in your browser. If you have issues or if the drivers didn't install or you're using an unsupported browser, you've likely will not see your phone here. If that's the case, the first and easiest step, go through again, if you're on Windows, make sure you install the drivers. And what I usually suggest to people is if you're not using Google Chrome, just go ahead and install it even if it's temporary google chrome Rome is supported and will work. So that's one easy way to rule out that your browser is the issue. But if you do see it in your browser, and you see you can select your phone, go ahead and select Connect, you're going to see this warning on the phone, take a second to read that through. Once you do, press the volume down or up button, so that it says unlock the bootloader. And once you see that, press the Power button to select that. And if this was successful, you will now see device state red unlocked, as compared to before where it was green and said locked. So once you see device state unlocked, we're ready to proceed on to the next step. Next one is obtaining the factory images. So go ahead and press download release. This will download the release in your browser. Depending on your internet connection speed. This could take a minute, a few minutes or an hour. And so while that's downloading it, just want to mention that once you start using graphene OS consider donating to the project. The developers put in a lot of hard work supporting current devices and new devices very quickly. The donations are used for paying developers and purchasing hardware. Me personally, I like the GitHub sponsors option. So I set that up. So I have a reoccurring monthly donation. And again, I'll link this down below. So you can check out the page and set up your donation. And so once that finishes, you'll see the progress bar is full and this will say downloaded and then the name of the release dot zip. And the next step is to actually flash the image to our device. So the initial install be performed by flashing the factory images. This will replace the existing OS installation and wipe all existing data. The main thing to note here is avoid interacting with the device until the flashing script is finished and the device is back at the bootloader interface. So once you're ready, select flash release, you'll see your screen change waiting bootloader. And your device will now flash and go through the entire process. And again, this will probably take five to 10 minutes. So while that's flashing and you and I are both waiting for this to finish, I just want to mention that I have a monthly newsletter that I send out, you can sign up for that at side of burritos.com. So the other day I was talking to my best friend who was a truck driver and he asked me if I knew what frogs did when their car breaks down. I said no, I do not know what frogs do when their car breaks down. And he said they get it towed. So with that great joke out of the way I'm going to fast forward the video and I will see you shortly

so once that's completed, for me, it took about five minutes for that to complete. You will see flashed and then again the name dot zip to device. And I want to the next step which is locking the bootloader which is extremely important as it enables full verified boot. And some of the reasons why this is extremely important are in the rest of this paragraph, which I would suggest you read over. So to do that, we're going to select Lock bootloader again, we can see do not lock the bootloader use the volume up or down to change that. When it says lock the bootloader Press the Power button to select and once that is successful, you will see device state is now green locked. So once that's completed, we can go on to the next step post installation booting. You've now successfully installed graphene OS congratulations and can boot it. pressing the power button with the default start option selected in the bootloader interface will boot the OS. So we can see here it says start press the power button the screen is normal. Do not be afraid if you see that we have a customer lesson installed. Seeing the Google screen is normal and then once you see the graphene OS screen, this is now the boot animation booting into graphene OS so the next step after booting is disable OEM unlocking. So for that we have to go to the initial setup. So start set your language, date and time set that we're going to skip Wi Fi for now. I don't have a SIM card if you do, you can put it in now just turn location services off by default. Next, I'm going to skip fingerprint setup but you can set that up if you want. I'm just going to set a PIN code quick just for the demo but again, set a secure PIN code along with fingerprint if you want. I don't have a backup to restore from Skip and start. So we have now reached the GrapheneOS home screen. And now to disable OEM unlocking we're gonna go into settings. We're going to scroll down again to About phone. Go to the bottom tap Build Number or type in the PIN code. We can now see your now developer, go back system developer options.

Disable OEM unlocking, please restart the device to enabled device protection feature. And also, I'm going to disable developer options, you don't really need those enabled,

we can now see developer options are gone. So as the instruction said, Let's Reboot the device, since we disabled OEM unlocking, restart so I'm just gonna press the power button quick, so I can pause it on the screen. So the next part, verifying installation, give this a read over some very good information. This verified boot key hash, the reason I paused it by pressing the power button on boot is that we can verify the boot key hash. And here we have the pixel six A in this example, can make sure the number matches there. Which does so we're good to go. So I'm gonna press the power button to resume. So I'm just gonna log in quick. So the next thing I want to cover quick is what I think is the best setup for anyone that's new to Griffin OS. If you've read around, there's a lot of videos, including my own channel or blog post that talks about using F Droid or Aurora store or all these different things you can do to increase your privacy and security. And while some of them are valid, it can be a bit overwhelming for anyone that's new. So what I'm going to do is show you a basic initial setup that I think is best for anyone that's new here. So for that we need to connect to Wi Fi.

And some other Wi Fi is connected, we can proceed on, we're going to swipe up, we're going to go into apps.

And the apps app support allows you to install different apps that are provided by Griffin OS. In this case, we're going to be installing the sandbox Google Play services. Again, like I said, this is going to be a basic setup for anyone that's new, I get a lot of messages from people that say they're new to privacy or the security community. And it's overwhelming at first they get a VPN, they get a new phone, they get this, they get that they want to use F droid. And I can understand how that's overwhelming. And that's why don't suggest trying to do everything at first, privacy and security as a journey. You can't do it all at once. Because if something's too difficult, you're not going to stick with it, you're gonna give up easily. And that's why I think it's easier to go ahead and install the sandbox Play services use Google Play, like we're about to do and start there. Once you get comfortable with the OS, you can make changes one by one, you can check out some other videos I have, you can see different suggestions that users might have online. But the first step is getting a solid base that you're comfortable with using Griffin OS. And I think sandbox Google Play services are a great place to start. So to do that, we're going to go down to the bottom, and we want to install Google Play Store. We can see here it's going to install these other two dependencies, services framework and Play services. So select Install. All right. So that took about three minutes, we can now see that it's finished. Because we see the Open option. You can either select open, or you can go swipe up. And you'll now see Play stores installed. This is the same Play Store you'd get on Android OS except on graphene OS it's sandboxed and installed as a normal app instead of an app with system level access. So select the Play store. You can select Sign In. And then at this point, you can either sign in with your personal Gmail account. Or another option if you want a little bit of increased privacy, create a separate gmail account that you can use specifically for this. That's not tied to anything else you have. If you have paid for apps, you can sign in with that account. You can installed paid apps like anything else. And since we now have all the Google services installed in our device, notifications, and everything else will work as expected. And if you've used Android in the past, this is going to feel like the standard Android experience.