Development [ROM][14][UNOFFICIAL][Raven/Oriole] Magisk Patched GrapheneOS + Lockable Bootloader

Search This thread

FireRattus

Senior Member
Feb 26, 2022
243
168
Magisk Patched Unofficial GrapheneOS for the Pixel 6 / 6 Pro (oriole/raven)

This ROM will allow you to lock the boot loader. Do not ever disable the OEM unlocking checkbox when using a locked bootloader with root.
This is critically important. With root access, it is possible to corrupt the running system, for example by zeroing out the boot partition.
In this scenario, if the checkbox is turned off, both the OS and recovery mode will be made unbootable and fastboot flashing unlock will not be allowed.
This effectively renders the device hard bricked.

I am not responsible for any harm you may do to your device, follow at your own risk etc etc, Rooting your device can potentially introduce security flaws, I am not claiming this to be secure. If you would like to have more security and peace of mind then I highly recommend you follow This Guide to build this rom using your own encryption keys.

GrapheneOS is a privacy and security focused mobile OS with Android app compatibility developed as a non-profit open source project. It's focused on the research and development of privacy and security technology including substantial improvements to sandboxing, exploit mitigations and the permission model. It was founded in 2014 and was formerly known as CopperheadOS.

The features page provides an overview of the substantial privacy and security improvements added by GrapheneOS to the Android Open Source Project (AOSP). Many of the past features were contributed to AOSP, Linux and other projects to improve privacy and security for billions of users so they're no longer listed on the features page.

More info:
Official releases are available on the releases page (Not Magisk Patched) and installation instructions are on the install page.
GrapheneOS also develops various apps and services with a focus on privacy and security. Vanadium is a hardened variant of the Chromium browser and WebView specifically built for GrapheneOS. GrapheneOS also includes our minimal security-focused PDF Viewer, our hardware-based Auditor app / attestation service providing local and remote verification of devices, our modern privacy / security focused camera app, and the externally developed Seedvault encrypted backup which was initially developed for inclusion in GrapheneOS.

No Google apps or services

GrapheneOS will never include either Google Play services or another implementation of Google services like microG. It's possible to install Play services as a set of fully sandboxed apps without special privileges via our sandboxed Google Play compatibility layer. See the FAQ section for more details on our plans for filling in the gaps from not shipping Play services and Google apps.

Installation Instructions: Fashing-factory-image
Locking the bootloader is Optional but does increase the device security Locking-the-bootloader


Update Instructions: simply follow these instructions Updates-sideloading to sideload the latest patched OTA update package (You can update from any previous version if using full ota update)

Android OS Version: 14
Current Version: See Post #2
Download: See Post #2

Sources: GrapheneOS - AVBRoot - Magisk -
Patch Guide

PayPal Donation Link
 
Last edited:

FireRattus

Senior Member
Feb 26, 2022
243
168
Builds for Pixel 6 (Oriole)

Magisk-Patched GrapheneOS Factory Install Build
Full system install builds for clean and new installs

Build based on release#2023121200 (2023-12-12)
SourceForge_Download

Build based on release#2023091800 (2023-09-18)
SourceForge_Download

Build based on release#2023070500 (2023-07-05)
SourceForge_Download

Build based on release#2023061402 (2023-06-14)
SourceForge_Download

Build based on release#2023050100 (2023-05-01)
SourceForge_Download

Magisk Patched OTA Update packages
Full OTA Builds will let you update from any older version

Patched OTA based on release#2023121200 (2023-12-12)
SourceForge_Download

Patched OTA based on release#2023091800 (2023-09-18)
SourceForge_Download

Patched OTA based on release#2023070500 (2023-07-05)
SourceForge_Download

Patched OTA based on release#2023061402 (2023-06-14)
SourceForge_Download

Patched OTA based on release#2023050100 (2023-05-01)
SourceForge_Download

Builds for Pixel 6 Pro (Raven)

Always do a backup of your data before flashing any updates, just in case.

I make no promises that this works or that I will provide regular updates. I will attempt to provide updates when they are available and I have time, you may have issues with this rom, you could lose your data or brick your device (although it's very unlikely if you follow the instructions and use common sense)

I had to remove older download links, SourceForge doesn't like hosting so much
 
Last edited:

FireRattus

Senior Member
Feb 26, 2022
243
168
New Release #2022120300
Changes since the 2022113000 release:
  • kernel (Pixel 4, Pixel 4 XL, Pixel 4a): add back our change enabling ARM64_SSBD now that upstream issues with it are resolved for this branch
  • Sandboxed Google Play compatibility layer: avoid chain crash of GmsCompat app following process death from OOM killer, etc.
  • Vanadium: update Chromium base to 108.0.5359.79
  • kernel (Generic 5.15): update to latest GKI LTS branch revision including update to 5.15.76
  • kernel (Pixel 6, Pixel 6 Pro, Pixel 7, Pixel 7 Pro, Generic 5.10, Generic 5.15): update to latest GKI LTS branch revision
  • kernel (Pixel 6, Pixel 6 Pro, Pixel 7, Pixel 7 Pro): update Mali GPU driver to r37p0 (current release is r41p0 but there are substantial changes to the driver for the Tensor SoC on Pixels and it will take substantial work to upgrade all the way)
  • remove broken, obsolete upstream code causing install permissions defined by user install apps not being automatically granted for user installed apps installed before the app defining the permissions unless the app is reinstalled
  • Messaging: update MMS configuration database based on Google Messages 20221115_01_RC01
  • Dialer: update visual voicemail (VVM) configuration database based on Google Phone 90.0.477356402
  • Dialer: adjust VVM configuration database entries for compatibility with AOSP
Download in Post #2
 

nutzfreelance

Senior Member
Mar 6, 2022
250
71
does the full system install include the android 13 boot loader? if someone was still on A12 should they do a full oem update first?
 

FireRattus

Senior Member
Feb 26, 2022
243
168
brilliant thanks!! can i ask a reallly random stupid question please. if i have a stock pixel 6 rom, can i just run the ota update to keep present apps/data in place and to upgrade it to graphene or would that break my phone if not already running graphene?
You must install Graphene OS first, and if you want to lock the bootloader then you will need to erase your data anyway

People from GrapheneOS will permanently suspend your account on their forums for simply telling people that it is in fact possible to ROOT Graphene and Lock the Bootloder
They like to LIE to people and tell them it's impossible, while preventing anyone from contradicting them
 
Last edited:
  • Like
Reactions: ada12

Sbodezzi

Senior Member
Jul 5, 2013
77
24
I flashed the oriole image flawlessy, everythings seems to be fine except for the magisk manager that keeps crashing. I need to do something in order to make it works?

Edit: my bad, i was installing a super old version of magisk:rolleyes: Sorry.
Thank you so much for you hard work(y)
 
Last edited:
  • Like
Reactions: FireRattus

timuh

New member
Jul 23, 2009
4
0
i cant find any information if its possbile to use google pay and android auto again with a rooted grapheneos and working magisk modul.
i like graphene and the features but it sucks to use an iphone for my car and cant use my galaxy watch for paying something :/

any1 got an idea or is the only possibility to flash stock google for both apps
 

FireRattus

Senior Member
Feb 26, 2022
243
168
i cant find any information if its possbile to use google pay and android auto again with a rooted grapheneos and working magisk modul.
i like graphene and the features but it sucks to use an iphone for my car and cant use my galaxy watch for paying something :/

any1 got an idea or is the only possibility to flash stock google for both apps
You cannot use google pay with official Graphene, I mean it works with loyalty cards but not NFC payment cards
So you should not expect it to work with a magisk patched Graphene, maybe you can find some magisk module and a configuration to get safety net passing and google pay working. But I am not aware of anything that works with Graphene
 
  • Like
Reactions: timuh

boom15

Member
Oct 27, 2021
37
6
Why so much headache as go trough build for such simple task as resign especially for Graphene? Just get ota, follow instruction in readme.txt avbroot and that it.
I understand if you do any changes to source (patches, unneeded apps, own apps, implement of root). But just for locked bootloader? Bootloader locked or not doing it job.
If you loose and somebody stole your device how locked bootloader helps? Get your data from recovery (it stock, not custom) over adb shell if you use pass not possible. Find device or location not on graphene build. You can't pass Safetycheck or use phone for contactless payments (NFC)
So all that wind just not allow to thief reflash and use device?
 
Last edited:

FireRattus

Senior Member
Feb 26, 2022
243
168
Why so much headache as go trough build for such simple task as resign especially for Graphene? Just get ota, follow instruction in readme.txt avbroot and that it.
I understand if you do any changes to source (patches, unneeded apps, own apps, implement of root). But just for locked bootloader? Bootloader locked or not doing it job.
If you loose and somebody stole your device how locked bootloader helps? Get your data from recovery (it stock, not custom) over adb shell if you use pass not possible. Find device or location not on graphene build. You can't pass Safetycheck or use phone for contactless payments (NFC)
So all that wind just not allow to thief reflash and use device?
If you think it's too much headache, that's fine, it's not for you.
I prefer to build it from source myself using my own keys for the whole process, it may be possible as you say just to patch the provided ota with avbroot, but I haven't tested this and don't have any plans to

I don't want to argue about the potential security benefits or downsides, If you don't believe it's secure and you don't feel safe using it then just don't use it. I like my data being secure and not easily accessible, regular backups are important

You can't pass safetynet or use google pay for contactless payments on official graphene, so please take it up with them to fix that as rooting it isn't going to make you more likely to pass safetynet

The thief can always just reflash and use the device unless you disable OEM unlocking in the developer settings
But you should not do this, because if something happened and your phone started to boot loop or something then there would be no way to fix it and you will brick your device, but at least your data will be safe if you had the bootloader locked
 

boom15

Member
Oct 27, 2021
37
6
If you think it's too much headache, that's fine, it's not for you.
I prefer to build it from source myself using my own keys for the whole process, it may be possible as you say just to patch the provided ota with avbroot, but I haven't tested this and don't have any plans to

I don't want to argue about the potential security benefits or downsides, If you don't believe it's secure and you don't feel safe using it then just don't use it. I like my data being secure and not easily accessible, regular backups are important

You can't pass safetynet or use google pay for contactless payments on official graphene, so please take it up with them to fix that as rooting it isn't going to make you more likely to pass safetynet

The thief can always just reflash and use the device unless you disable OEM unlocking in the developer settings
But you should not do this, because if something happened and your phone started to boot loop or something then there would be no way to fix it and you will brick your device, but at least your data will be safe if you had the bootloader locked
Read one more time my comment
  1. I'm not said that I will or plan to use your guide to build. I said that it to much work for average person.
  2. I saw your post where you clearly state that you wanna locked bootloader. I pointed to easiest way to do that. Don't like it? Do what you like.
  3. For patching ota by using avbroot. I did it and tested on my own pixels(6a,2 -6, not pro) and not pushing you to do that. As all here I wanna show people another option.
  4. I don't need rom signed you or any one else. It personal rom and I do not have time and willing to inspect it. For me enough that I trust graphene team! I already build rom for my self with implemented of root, patching some graphene code, remove some apks and replaced it with mine and settings that I need. Of cause I sign but that rom it for me and my family not for public. So no any need in secondhand roms.
  5. I did't tell that you responcible for NFC, Saftynet pass just wanna point out that locking bootloader not helps with these issue.Not expect you fix that. You said that you didn't touch code. It's Graphene and it on their side. I used Graphene long enough to know advantages and disadvantages.
  6. And I as you don't intend to start security discussion here or with someone else. Don't worry and have a good day!
 
Last edited:
  • Like
Reactions: FireRattus

FireRattus

Senior Member
Feb 26, 2022
243
168
Read one more time my comment
  1. I'm not said that I will or plan to use your guide to build. I said that it to much work for average person.
  2. I saw your post where you clearly state that you wanna locked bootloader. I pointed to easiest way to do that. Don't like it? Do what you like.
  3. For patching ota by using avbroot. I did it and tested on my own pixels(6a,2 -6, not pro) and not pushing you to do that. As all here I wanna show people another option.
  4. I don't need rom signed you or any one else. It personal rom and I do not have time and willing to inspect it. For me enough that I trust graphene team! I already build rom for my self with implemented of root, patching some graphene code, remove some apks and replaced it with mine and settings that I need. Of cause I sign but that rom it for me and my family not for public. So no any need in secondhand roms.
  5. I did't tell that you responcible for NFC, Saftynet pass just wanna point out that locking bootloader not helps with these issue.Not expect you fix that. You said that you didn't touch code. It's Graphene and it on their side. I used Graphene long enough to know advantages and disadvantages.
  6. And I as you don't intend to start security discussion here or with someone else. Don't worry and have a good day!

1.I already know this, I thought this would be obvious. I think using Graphene OS at all is too much for the average person, the average person will just use their phone as it comes and never put a custom rom onto it. This was never intended for the average person.

2. I appreciate that there is an easier way to do it, But I already said I was going to do what I like instead.

3. I appreciate that you have tested this works, I will likely update the guide I have created with this information for people who don't want to build it from source but would also prefer to patch official builds with magisk themselves

4. I do highly recommend everyone does build it themself, I think you should not rely on and trust graphene to always provide updates that have not been modified in some malicious way, it's always possible they could get hacked and an update build could be silently replaced with a malicious version

5. Locking the bootloader has nothing to do with safetynet for me, It's more about the other protections that locking the bootloader enables, like making it much harder for someone to be able to access my data or use the phone without erasing the data
Thankfully there is several banking apps which work and even let you use NFC for payments, while you do not pass safetynet

6. I appreciate it, thank you. I hope you have a good day also.
 

FireRattus

Senior Member
Feb 26, 2022
243
168
I spent half of my week following your guide because with my old ass I7-3770K running Debian within VMware takes days since I didn't know there was another way. 😂The main building part (m target-files-package took 6,5 hours to complete) Reading what boom15 said I'd be very happy if I never had to go down this route ever again.

Thank both of you gentlemen for spreading information about this, I wound't be able to figure it out by myself.

I guess I only have to download the OTA from grapheneos.org/releases and follow avbroot's readme, right? (I feel like a retard right now for wasting that much time setting up my VM, it running out of disk space, reinstalling it, etc.. 😂😂)
I do completely understand and sympathize, I have already updated the guide with this simple method of patching graphene for those who are unable to or don't want to build it from source themselves
I think you have gained some valuable experience and knowledge though which will likely help you in the future with other endeavors.
At least you didn't spend a good couple of weeks trying to patch graphene with magisk manually before I even discovered AVBRoot was a thing, so glad that exists
 

FireRattus

Senior Member
Feb 26, 2022
243
168
New Release #2022121100
Missed a couple of update releases due to build errors then other errors I have finally resolved so

Changes since the 2022120300 release:
  • resolve upstream bug in Android 13 QPR1 causing screen brightness dimming on user profile changes
  • Settings: replace hard-wired refresh rate in the text for the smooth display toggle with the actual max refresh rate used for the device model (Android has the string hard-wired to say 90Hz and expects the device to provide an overlay with the correct string which isn't present in AOSP for Pixels)
  • kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Generic 5.10): update to latest GKI LTS branch revision including update to 5.10.156
  • kernel (Generic 5.15): update to latest GKI LTS branch revision including update to 5.15.77
  • Sandboxed Google Play compatibility layer: new infrastructure for controlling Play Store updates of Play Store and Play services with a max version of Play services and the Play Store set via GmsCompatCompat and an override toggle for allowing it to update to any version
  • Sandboxed Google Play compatibility layer: hide GrapheneOS Auditor variant (app.attestation.auditor) from the Play Store so it doesn't try to update it (note: we plan to fully switch to app.grapheneos.auditor.play for the Play Store and we can remove this workaround once we unpublish the GrapheneOS variant of the app there and stop updating it)
  • Pixel 7, Pixel 7 Pro: remove unused Google Camera SELinux policy
  • Auditor: update to version 67
  • Camera: update to version 58

    2022120700
  • Launcher: fix Recent Apps activity crashing when using the TalkBack screen reader due to an incorrect port of the Storage Scopes shortcut to Android 13 QPR1

    2022120600
  • full 2022-12-01 security patch level
  • full 2022-12-05 security patch level
  • rebased onto TQ1A.221205.011 release, which is the first quarterly maintenance/feature release for Android 13
  • Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro: rewrite under display fingerprint scanner integration
  • Sandboxed Google Play compatibility layer: set GmsCompat versionCode to 1000 (v1) to prepare for defining dependencies on the compatibility layer version for the Google Play apps mirrored in our app repository
  • Pixel 6, Pixel 6 Pro, Pixel 6a: use Scudo instead of hardened_malloc for camera service for consistency with the Pixel 7 and Pixel 7 Pro until memory corruption issues with it are resolved
  • add back support for OS device controls and wallet quick tiles
  • kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Generic 5.10): update to latest GKI LTS branch revision including update to 5.10.152
Download in Post #2
 
Last edited:
  • Like
Reactions: Mustkeg

KainoaK

New member
Dec 10, 2018
3
1
Do you think maybe putting releases on Github/Codeberg instead would be a good idea? Anonfiles tends to be very slow, and it'd be easier to keep track of everything with a repo
 

FireRattus

Senior Member
Feb 26, 2022
243
168
Do you think maybe putting releases on Github/Codeberg instead would be a good idea? Anonfiles tends to be very slow, and it'd be easier to keep track of everything with a repo
Am I able to upload to there easily with terminal? due to my slow internet I find that uploading with curl seems to be more reliable but I am happy to use a better host if I am able to, I tried several times unsuccessfully to upload the builds to xda
 

Top Liked Posts

  • There are no posts matching your filters.
  • 5
    Magisk Patched Unofficial GrapheneOS for the Pixel 6 / 6 Pro (oriole/raven)

    This ROM will allow you to lock the boot loader. Do not ever disable the OEM unlocking checkbox when using a locked bootloader with root.
    This is critically important. With root access, it is possible to corrupt the running system, for example by zeroing out the boot partition.
    In this scenario, if the checkbox is turned off, both the OS and recovery mode will be made unbootable and fastboot flashing unlock will not be allowed.
    This effectively renders the device hard bricked.

    I am not responsible for any harm you may do to your device, follow at your own risk etc etc, Rooting your device can potentially introduce security flaws, I am not claiming this to be secure. If you would like to have more security and peace of mind then I highly recommend you follow This Guide to build this rom using your own encryption keys.

    GrapheneOS is a privacy and security focused mobile OS with Android app compatibility developed as a non-profit open source project. It's focused on the research and development of privacy and security technology including substantial improvements to sandboxing, exploit mitigations and the permission model. It was founded in 2014 and was formerly known as CopperheadOS.

    The features page provides an overview of the substantial privacy and security improvements added by GrapheneOS to the Android Open Source Project (AOSP). Many of the past features were contributed to AOSP, Linux and other projects to improve privacy and security for billions of users so they're no longer listed on the features page.

    More info:
    Official releases are available on the releases page (Not Magisk Patched) and installation instructions are on the install page.
    GrapheneOS also develops various apps and services with a focus on privacy and security. Vanadium is a hardened variant of the Chromium browser and WebView specifically built for GrapheneOS. GrapheneOS also includes our minimal security-focused PDF Viewer, our hardware-based Auditor app / attestation service providing local and remote verification of devices, our modern privacy / security focused camera app, and the externally developed Seedvault encrypted backup which was initially developed for inclusion in GrapheneOS.

    No Google apps or services

    GrapheneOS will never include either Google Play services or another implementation of Google services like microG. It's possible to install Play services as a set of fully sandboxed apps without special privileges via our sandboxed Google Play compatibility layer. See the FAQ section for more details on our plans for filling in the gaps from not shipping Play services and Google apps.

    Installation Instructions: Fashing-factory-image
    Locking the bootloader is Optional but does increase the device security Locking-the-bootloader


    Update Instructions: simply follow these instructions Updates-sideloading to sideload the latest patched OTA update package (You can update from any previous version if using full ota update)

    Android OS Version: 14
    Current Version: See Post #2
    Download: See Post #2

    Sources: GrapheneOS - AVBRoot - Magisk -
    Patch Guide

    PayPal Donation Link
    3
    Builds for Pixel 6 (Oriole)

    Magisk-Patched GrapheneOS Factory Install Build
    Full system install builds for clean and new installs

    Build based on release#2023121200 (2023-12-12)
    SourceForge_Download

    Build based on release#2023091800 (2023-09-18)
    SourceForge_Download

    Build based on release#2023070500 (2023-07-05)
    SourceForge_Download

    Build based on release#2023061402 (2023-06-14)
    SourceForge_Download

    Build based on release#2023050100 (2023-05-01)
    SourceForge_Download

    Magisk Patched OTA Update packages
    Full OTA Builds will let you update from any older version

    Patched OTA based on release#2023121200 (2023-12-12)
    SourceForge_Download

    Patched OTA based on release#2023091800 (2023-09-18)
    SourceForge_Download

    Patched OTA based on release#2023070500 (2023-07-05)
    SourceForge_Download

    Patched OTA based on release#2023061402 (2023-06-14)
    SourceForge_Download

    Patched OTA based on release#2023050100 (2023-05-01)
    SourceForge_Download

    Builds for Pixel 6 Pro (Raven)

    Always do a backup of your data before flashing any updates, just in case.

    I make no promises that this works or that I will provide regular updates. I will attempt to provide updates when they are available and I have time, you may have issues with this rom, you could lose your data or brick your device (although it's very unlikely if you follow the instructions and use common sense)

    I had to remove older download links, SourceForge doesn't like hosting so much
    2
    Hi, I was wondering how long can I expect this project to be updated for?
    I was using Graphene for a bit now, but I think I might need magisk to get some stuff working again (Curve stopped working so I am going to try get Google Pay working with magisk).

    I was originally going to try some ROM called ProtonAOSP but apparently that's abandonware?

    So I just wanted to ask how long you're planning on running this for?
    I am planning to keep releasing updates for this as long as I will continue to use it, which is for the current foreseeable future
    Except you are easily able to patch Graphene yourself so you won't have to rely on me for updates
    Graphene I believe will continue to receive updates for years into the future

    I have created this guide which explains the process I went through to patch the ROM and also a more simple method just using AVBRoot https://xdaforums.com/t/guide-to-lo...-grapheneos-magisk-root.4510295/post-87630837

    Just using AVBRoot will allow you to use Magisk with Graphene and a locked bootloader https://github.com/chenxiaolong/avbroot
    2
    New Release #2023012500
    Changes since the 2023011000 release:
    • don't send IMSI / Phone number to SUPL server when SUPL is enabled (note: using SUPL is always an optional choice in APN configuration on GrapheneOS, unlike AOSP and the stock OS)
    • SELinux policy: drop auditing for apk_data_file execute/execute_no_trans (research is done)
    • SELinux policy: add back apk_data_file execute/execute_no_trans for adb shell for debugging use cases (removing it isn't really useful for hardening and we plan on hardening ADB for the verified boot model another way)
    • Settings: revert to standard Android 13 minimum threshold of 10% for automatic battery saver since lowering it below 10% doesn't work as intended without more invasive changes outside the scope of GrapheneOS
    • fully disallow installing instant apps instead of permitting ADB shell and system apps to do it (this will simplify future work)
    • extend self app-op spoofing used for Network permission compatibility to unsafeCheckOpRaw()
    • fix upstream bug causing crash from isServiceTokenValidLocked() being called without holding the lock
    • Sandboxed Google Play compatibility layer: support enabling compatibility layer for any package on debuggable builds to help with development
    • Sandboxed Google Play compatibility layer: coerce Play Store into not attempting to auto install AR services
    • Sandboxed Google Play compatibility layer: fix issues with Play Store updates of Play services
    • Sandboxed Google Play compatibility layer: avoid our implementation of the Play services location API returning null for getCurrentLocation() to avoid crashes in apps not handling it
    • Sandboxed Google Play compatibility layer: increment compatibility layer version to 1001
    • Sandboxed Google Play compatibility layer: use the most recent available version map in GmsCompatConfig to simplify defining configuration
    • Sandboxed Google Play compatibility layer: improve stack trace parser used for dynamic exception shims
    • Sandboxed Google Play compatibility layer: add shim for making Bluetooth adapter discoverable
    • Sandboxed Google Play compatibility layer: improve UX for "Action required in Play Store" notification
    • Sandboxed Google Play compatibility layer: add new shims to support requesting temporary screen capture from the user via the standard unprivileged approach for Chromecast screen casting (currently lacks shims to support audio capture)
    • GmsCompatConfig: add stub for LocationManager.registerGnssStatusCallback()
    • GmsCompatConfig: update max supported version of Play services and Play Store
    • stop re-enabling deprecated 2-button navigation option since Android no longer has official support for it and is gradually breaking support for it including making changes knowingly introducing bugs with it since it's not meant to be used (traditional 3-button navigation is still fully supported)
    • Settings: add GrapheneOS Camera to list of mandatory components since only system camera apps can provide the media capture intents required by other apps on Android 11 and above (can still be disabled via ADB but we want to avoid easy ways to break the OS in the UI)
    • kernel (Generic 5.15): update to latest GKI LTS branch revision including update to 5.15.80
    • extend the install available apps feature (allows Owner user to install apps in other users) to apps only installed in secondary profiles
    • Apps: update to version 13
    • add GrapheneOS fs-verity public key as a supported key
    • require fs-verity for installing system app updates (will be enforced at boot for verified boot enhancement in a future release due to the need to phase in the feature properly because of future out-of-band app updates on earlier OS releases)
    • Vanadium: update Chromium base to 109.0.5414.118
    • SettingsIntelligence: drop no longer required QUERY_ALL_PACKAGES permission now that more precise queries are defined upstream providing the necessary package visibility for Settings app search
    Download in Post #2
    1
    Graphene just removed my last objection by integrating call recording!!! With root and call recording this is the perfect ROM.