• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

[ROM][Unofficial][10.0][microG][signed]hardened LineageOS 17.1 Oneplus 3/3T

Search This thread
Answer me wider please. So is it possible to consider that Xposed is a hole in security? And because of this, author disabled opportunity to install Xposed in this firmware?
@nvertigo67 has already perfectly explained this, also in his recent response.

Just to add to this:
I did not actively disable stuff by means of "yeah, let's block feature 'xyz' " (unless I have put an option in the Settings leaving the user a choice), but I knowingly decided to include many hardening features from the GrapheneOS project into my ROM; which puts a significantly stricter limitation in place in regards of what the OS core components are allowed versus non-core components and 3rd party stuff ("user space"). The aim is to reduce the attack surface of especially yet unknown potential attacks.
The fact that Xposed, Gapps and other stuff cannot be flashed and/or do not work properly because of that is neither surprising, nor unwanted.
 

nvertigo67

Senior Member
Dec 28, 2011
6,020
12,330
The fact that Xposed, Gapps and other stuff cannot be flashed and/or do not work properly because of that is neither surprising, nor unwanted.
*lol* Bro, you made my day. That's humble. I'd call these effects "proof of concept" or "proof of hardening in place" - "neither surprising, nor unwanted" is an awesome phrase in this context! Still laughing... :) :) :)
 
  • Like
Reactions: thomasnsr
LineageOS 18.1

Hi all,

a LineageOS 18.1 test build is available here:

It has the same features, as described in the OP for this 17.1 build, with the following additions:
- AuroraDroid app replaces F-Droid app to access F-Droid repositories
- Option to only use fingerprint unlock for apps and not for the device
- Optional timeout for Bluetooth and WLAN connections
- Some more hardening features ported from GrapheneOS
- Kernel is based on the upstreamed kernel of this build (with many necessary adaptations for 18.1, of course)
- Sec. string 2021-08-05

Right now, this is still a test build, this means:
I truly appreciate any feedback (especially, if things don't work as expected). And there definitely will be an update for 17.1 with ASB patches for September. It is possible to "dirty-flash" over this 17.1 build, but make a backup in TWRP before, to be able to get back.

Feedback appreciated - Thanks & regards, M.

EDIT:
Kernel source: https://github.com/lin18-microG/android_kernel_oneplus_msm8996/tree/lin-18.1-mse2
Build Manifest: https://github.com/lin18-microG/local_manifests/tree/lin-18.1-hmalloc

EDIT2 (2021-08-22):
Seems the kernel needs more rework: on my device, it always crashes after a while. If you use the "original" LineageOS kernel (e.g. extract and flash boot.IMG from an official LineageOS ROM Zip), it will work.
 
Last edited:
LineageOS 18.1 - 2nd Test build

I have chosen a different approach for now with the kernel and created a 2nd test build here, which seems to run well:

Kernel source: https://github.com/lin18-microG/android_kernel_oneplus_msm8996/tree/lin-18.1-mse3
Build Manifest: https://github.com/lin18-microG/local_manifests/tree/lin-18.1-hmalloc

Please test and provide feedback!
Assuming this build runs smoothly and stable, I plan to provide a last time a 17.1 build with September ASB and afterwards LineageOS 18.1 builds.

Regarding Kernel:
I haven't yet abandoned the idea of a fully upstreamed kernel, which I used to provide so far for my 16.0 and 17.1 builds.
However, right now I am struggling to find the root cause of the kernel panics in my upstreamed kernel (branch 'lin-18.1-mse2').
Main reason is, that pstore doesn't work either right now, which makes it impossible to get proper logs. Any help appreciated!
For the time being, the working kernel used is the official Lineage 18.1 kernel with the missing official ASB patching plus further patches - taken from the updater script of Divest-OS (and a lot of manual work to get the proper commit history).
 

Cashmeousside

Member
Apr 8, 2017
6
2
OnePlus 3T
Hey!
I've been using this test build mk2 for nearly a day. And its very good. Kudos!
The issue that I've come across is that using the touchscreen gestures on screen off causes the device to reboot.
I apologise for no logs as my phone can only charge through the USB port (hardware issue)
 
  • Like
Reactions: MSe1969
Hey!
I've been using this test build mk2 for nearly a day. And its very good. Kudos!
The issue that I've come across is that using the touchscreen gestures on screen off causes the device to reboot.
I apologise for no logs as my phone can only charge through the USB port (hardware issue)
Thanks for the feedback, I can confirm your observation:
Code:
09-01 22:32:40.306  2784  3296 F libc    : Fatal signal 6 (SIGABRT), code -1 (SI_QUEUE) in tid 3296 (InputReader), pid 2784 (system_server)
09-01 22:32:40.492  2784  3297 I HidlSensorManager: hidl_ssvc_poll: spurious wake up, back to work
09-01 22:32:40.495  7016  7016 I crash_dump64: obtaining output fd from tombstoned, type: kDebuggerdTombstone
09-01 22:32:40.496  2229  2229 I tombstoned: received crash request for pid 3296
09-01 22:32:40.501  7016  7016 I crash_dump64: performing dump of process 2784 (target tid = 3296)
09-01 22:32:40.564  7016  7016 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
09-01 22:32:40.565  7016  7016 F DEBUG   : LineageOS Version: '18.1-20210830-UNOFFICIAL-microG-signed-oneplus3'
09-01 22:32:40.565  7016  7016 F DEBUG   : Build fingerprint: 'OnePlus/OnePlus3/OnePlus3T:8.0.0/OPR1.170623.032/02281230:user/release-keys'
09-01 22:32:40.565  7016  7016 F DEBUG   : Revision: '0'
09-01 22:32:40.565  7016  7016 F DEBUG   : ABI: 'arm64'
09-01 22:32:40.566  7016  7016 F DEBUG   : Timestamp: 2021-09-01 22:32:40+0200
09-01 22:32:40.566  7016  7016 F DEBUG   : pid: 2784, tid: 3296, name: InputReader  >>> system_server <<<
09-01 22:32:40.566  7016  7016 F DEBUG   : uid: 1000
09-01 22:32:40.566  7016  7016 F DEBUG   : signal 6 (SIGABRT), code -1 (SI_QUEUE), fault addr --------
09-01 22:32:40.566  7016  7016 F DEBUG   : Abort message: 'Inlined method resolution crossed dex file boundary: from android.view.KeyEvent org.lineageos.lineageparts.gestures.KeyHandler.handleKeyEvent(android.view.KeyEvent) in /system/priv-app/LineageParts/LineageParts.apk/0x31659ec220 to int lineageos.providers.LineageSettings$System.getInt(android.content.ContentResolver, java.lang.String, int) in /system/framework/org.lineageos.platform.jar/0x3165918b60. This must be due to duplicate classes or playing wrongly with class loaders. The runtime is in an unsafe state.'

Have already an idea how to avoid this...
 

NWD

New member
Aug 15, 2009
2
4
I tried Divest-OS earlier today, since it stated I might be able to lock the bootloader, it worked, but still gave a message about a dodgy ROM when it booted...

I tried flashing your ROM using the same method (thanks to this tip https://www.reddit.com/r/OnePlus3T/comments/hubb7r ) it seems to be working fine...

Locked BootLoader (no messages during reboots)
Encrypted with Boot Password and LockScreen Password

Thanks for the hard work you put in to keep this hardware working :)
 
Last edited:

NWD

New member
Aug 15, 2009
2
4
Thought it'd be a good idea to post these instructions in case anyone else needs them...

Code:
0. Install TWRP if needed...
fastboot flash recovery twrp.img

1. Boot into FastBoot/Bootloader run command ->
fastboot devices

2. To re-Lock the bootloader (select no (bug in op3 firmware))
fastboot oem lock

3. Reboot into TWRP

Format Data
Wipe All Partitions

3b. Reboot back into TWRP

4. Run adb sideload, then run commands

adb devices

adb sideload lineage-18.1-20210901-UNOFFICIAL-microG-signed-oneplus3.zip

5. Reboot phone manually in TWRP

Encrypt Phone, Set Boot PIN/Pass etc...

Done :)
 
  • Like
Reactions: thomasnsr

borisSweden

Senior Member
May 10, 2021
73
3
How do I stop wifi from shutting down when the screen turns off stays idle? Also any tips on how to configure GPS settings? I downloaded all NLP apps from F-droid. Accuracy is 10m while OOS was around 5m.
I also wonder if I need to contact LOS team for GnssStatus.getCarrierFrequencyHz() API support or does the ROM follow OxygenOS code?
 
How do I stop wifi from shutting down when the screen turns off stays idle?
Could you please give a more explicit example?

Also any tips on how to configure GPS settings? I downloaded all NLP apps from F-droid. Accuracy is 10m while OOS was around 5m.
OOS uses, as any stock ROM, the genuine Google spy services as coarse location provider. It has to be admitted, that the accuracy is really good, but to the price of Google knowing your location at any time.
Seems that the combo of GPS and Google's Wifi DB is able to better calibrate the location.
Just a guess...

I also wonder if I need to contact LOS team for GnssStatus.getCarrierFrequencyHz() API support or does the ROM follow OxygenOS code?
The ROM is a modified LineageOS, which itself is a modified AOSP - no idea about the specifics of OOS.
 

borisSweden

Senior Member
May 10, 2021
73
3
Could you please give a more explicit example?


OOS uses, as any stock ROM, the genuine Google spy services as coarse location provider. It has to be admitted, that the accuracy is really good, but to the price of Google knowing your location at any time.
Seems that the combo of GPS and Google's Wifi DB is able to better calibrate the location.
Just a guess...


The ROM is a modified LineageOS, which itself is a modified AOSP - no idea about the specifics of OOS.
IDK what I did but wifi work now, battery optimization must have done something or its the wifi enhancer in dev options.

Yeah your explanation pretty much answers why GNSS isnt that good. But which NLP apps do I need? Not all of them of course.

I sent a PM to the LOS team and Im waiting for their answer.
 
Yeah your explanation pretty much answers why GNSS isnt that good. But which NLP apps do I need? Not all of them of course.
Depends on your personal preference. I think for the address resolution, there is only Nominatim. For the Coarse location, I in fact see two options (personal opinion):

a. With the shipped Mozilla one, you have a very good "allrounder". However, you may dislike, that it also requires internet connection, as it uses Mozilla's servers to calculate your location, based on your device's provided data. You don't need an account for that, but at least a "fingerprint" of your device is being tracked.

b. I personally use the combo of GSM Location Provider and DéjàVu - it is less accurate, but entirely "offline".
GSM Location provider needs to initially download cell tower data to build a database and yes, whenever you feel like it, you download an update - but the location calculation itself happens offline (after downloading the cell tower data, you can even cut the internet connection for that app, if you like). DéjàVu simply watches, when your GPS is on, locations and nearby WiFi ID's and stores, if certain combinations happen "statistically often enough", such points. Hence it learns (no internet connection!), where you are located usually and at least those points are identified with a remarkable accuracy.

If you use coarse location for things like weather widget and/or supporting a faster initial GPS fix, "b." is sufficient.
"a." is less effort and more accurate, but the location calculation happens at a server, which needs to keep track of your device - without account and hence somehow "pseudonymously".
 

mar.ste

Member
Aug 11, 2011
39
7
Wanted to revive my still good but unused 3T and since OnePlus is not delivering anymore security patches I ditched OxygenOS. Intalled this ROM and for now all ok. In the next days I'll play with it and if good I'll swith to it my main phone!
 
  • Like
Reactions: MSe1969

borisSweden

Senior Member
May 10, 2021
73
3
Depends on your personal preference. I think for the address resolution, there is only Nominatim. For the Coarse location, I in fact see two options (personal opinion):

a. With the shipped Mozilla one, you have a very good "allrounder". However, you may dislike, that it also requires internet connection, as it uses Mozilla's servers to calculate your location, based on your device's provided data. You don't need an account for that, but at least a "fingerprint" of your device is being tracked.

b. I personally use the combo of GSM Location Provider and DéjàVu - it is less accurate, but entirely "offline".
GSM Location provider needs to initially download cell tower data to build a database and yes, whenever you feel like it, you download an update - but the location calculation itself happens offline (after downloading the cell tower data, you can even cut the internet connection for that app, if you like). DéjàVu simply watches, when your GPS is on, locations and nearby WiFi ID's and stores, if certain combinations happen "statistically often enough", such points. Hence it learns (no internet connection!), where you are located usually and at least those points are identified with a remarkable accuracy.

If you use coarse location for things like weather widget and/or supporting a faster initial GPS fix, "b." is sufficient.
"a." is less effort and more accurate, but the location calculation happens at a server, which needs to keep track of your device - without account and hence somehow "pseudonymously".
Alrigth, I deleted GSMLocationNlPBackend, RadioCells.orgRF, Apple UnifiedNlP.

BTW, are there apps like location.service.google and izat.location.qualcomm ?

Also what do I need to do for RCS chat to work? Is it because of Safety Net?
 
BTW, are there apps like location.service.google and izat.location.qualcomm ?
Not aware - could you please explain in more detail, what you mean?

Also what do I need to do for RCS chat to work? Is it because of Safety Net?
I am not really experienced in the "RCS" topic (I use Signal as messenger and SMS app), so I have searched a little.
How did you attempt to use RCS? I.e. which app did you install? G* messages?
As G* hasn't opened the APIs to app developers, this seems to be some "exclusive" feature combo of the Google messages app and the G* proprietary spy services...
If that's the case, I can't give you any good advice - proprietary G* apps are usually very deeply integrated with the genuine G* spy services, especially, when it comes to making use of even undocumented functions, so in general, proprietary G* apps tend to work worse with microG. I don't think this is due to Safety net, as Google normally uses SN for REAL needs (not like some other app manufacturers, who even use it for no valid reason, like e.g. the app of a known fastfood franchise).
 

mar.ste

Member
Aug 11, 2011
39
7
Wanted to revive my still good but unused 3T and since OnePlus is not delivering anymore security patches I ditched OxygenOS. Intalled this ROM and for now all ok. In the next days I'll play with it and if good I'll swith to it my main phone!
Installed few apps, and they seems good but for now I have one fail: for some reason lichess (a wonderful and open source chess application with a vibrant community) is not able to connect to play games, even though I was able to login to the server: there is some traffic blocking functionality?
ps: not sure if useful but I still didn't insert my SIM and I'm still using wifi connection (luckily I've FTTH here :))
 
Last edited:
Installed few apps, and they seems good but for now I have one fail: for some reason lichess (a wonderful and open source chess application with a vibrant community) is not able to connect to play games, even though I was able to login to the server: there is some traffic blocking functionality?
I don't know the details about lichess. Can you somehow produce a log or at least more details about the error, which you face?
 

Top Liked Posts

  • There are no posts matching your filters.
  • 3
    New build with October ASB - FINAL

    Hello all,
    a new build is available for download and also offered as OTA update in the Updater app:
    • ASB Security string 2021-10-05
    • Bromite browser and Webview updated to 93.0.4577.83
    • The official kernel tag is still the same as last month, but I have picked the commits after the tag
    As already announced earlier, this probably is the final build. I will tomorrow create a new Lineage 18.1 thread for this device and recommend you to update at your convenience. Btw, the 18.1 build with October ASB, which will be announced in the new thread, is here.

    Happy flashing!
    Regards, M.
    2
    But I have another issue and that is AOSP keyboard.Is suggestions Play Service based?
    No. AOSP delivers dictionaries as part of the ROM, that's it.

    Can I find a good 3 language keyboard. Its optimized for one language at the time.
    Good question, Idk - looking forward to suggestions from others as well...

    And is the idea with hardened ROM that Im supposed to lock the bootloader after installing as rooting is discouraged?
    You CAN re-lock the bootloader on the op3/t, yes. The advantage of doing so however is not huge.

    Normally, with a Stock ROM having a restricted recovery refusing to flash "non-original" stuff, a locked boot loader prevents flashing a custom recovery and hence prevents accessing and altering the data and system components of the phone, and if the BL is unlocked, the /data partition will be purged for security reasons to make sure, that e.g. the data of a stolen phone cannot be accessed by unlocking the BL and flashing a custom/special recovery.

    On this phone, I would assume you have TWRP as recovery, which will allow all, what is needed also with a locked BL, so it is important to encrypt your /data partition with a proper passphrase.

    Remains the question of apps aiming at checking the BL state - the 17.1 kernel overrides some of those flags anyhow (the 18.1 kernel of the test builds not yet). I myself doing development don't lock the BL, because for me, things like fastboot boot test-boot.img need to work.

    There still might be some advantages to lock the BL, I think @nvertigo67 has a deeper inside to this and may want to step in.

    Thankfully banking,payment and ID apps dont check root in Sweden but Android Pay,
    The root checking of banking/payment apps is anyhow only 'security theater', but it's annoying.

    Really?
    I don't have difficulties - but I only use it to access the LineageOS chat (probably very limited scope of what Slack can be used for...)
    2
    LineageOS 18.1 thread
    As announced, the new LineageOS 18.1 thread has been posted.
    1
    Wanted to revive my still good but unused 3T and since OnePlus is not delivering anymore security patches I ditched OxygenOS. Intalled this ROM and for now all ok. In the next days I'll play with it and if good I'll swith to it my main phone!
    1
    Don't know how to produce a log.

    Google is yoir friend: https://www.google.com/search?q=android+get+logs+from+device

    Be an user - not a costumer.
  • 18
    This thread is dedicated to provide hardened Lineage-OS 17.1 builds with microG included for the OnePlus 3/3T with current security patches.

    It is the successor of my Lineage 16.0 thread.
    It may be worth to also look there, if you are looking for information.

    Features of this ROM
    Download here
    • Pre-installed microG and F-Droid like LineageOS for microG project (own fork)
    • Pre-installed AuroraStore
    • OTA Support
    • eSpeakTTS engine
    • Bromite as default browser
    • Additional security hardening features listed below
    • Cloudflare as default DNS (instead of Google)
    • Privacy-preferred default settings
    • Optional blocking of Facebook- and Google-Tracking (Settings - Network & Internet)
    • Optional disable captive portal detection or choose from various providers (default is GrapheneOS and not Google; Settings - Network & Internet)
    • Firewall UI (under Trust)
    • Increased max. password length of 64
    • No submission of IMSI/phone number to Google when GPS is in use
    • Default hosts file with many blocked ad/tracking sites
    • Privacy-enhanced Bromite SystemWebView
    • Extra control of sensor access for additionally installed user apps (Special access under app permissions)
    • Kernel kept up to date with ASB patches and Google kernel/common 'android-3.18' branch
    • Debloated from Oneplus blobs for Alipay, WeChatpay, Soter and IFAA
    • Hardened bionic lib and constified JNI method tables


    Current release levels
    Security string: 2021-10-05
    AOSP tag: 10.0.0_r41
    Bromite System Webview: M93


    Source-code and build instructions
    Kernel: https://github.com/lin17-microg/android_kernel_oneplus_msm8996/tree/lin-17.1-mse3
    Build manifest: https://github.com/lin17-microg/local_manifests/tree/lin-17.1-microG


    Installation Instructions

    YOU ARE RESPONSIBLE SOLELY YOURSELF FOR ANY ACTIONS YOU DO WITH YOUR DEVICE !!!

    Please note - I won't explain any single aspect (e.g. how to install 'fastboot' on your PC or troubleshoot USB connectivity issues under Windows). Search the net and consult the search engine of your choice or look here in XDA, there is plenty of information available.

    Pre-Requisites
    • If you come from OxygenOS Stock ROM, make sure to update to the latest offered software version (if not, no issue).
    • Have fastboot and adb installed on your PC and make sure, you can connect via USB to your device in fastboot mode and via adb
    • An unlocked bootloader (see e.g. LineageOS install instructions)
    • OxygenOS 9.0.6 firmware, which is needed for LineageOS 17.1 - see next section
    • Download the most current .ZIP file of the ROM and place it to your phone's internal memory

    OxygenOS 9.0.6 Firmware
    If you come from my LineageOS 16.0 build - or any Android 9 or 10 based ROM, you most probably have already the proper firmware.
    And yes, LineageOS 17.1 is Android 10, but the latest firmware for this device has been published by Oneplus for Android 9.
    How to find out about your current firmware, if you use a Custom ROM:
    Connect as root via adb to your phone and enter the command adb shell cat /system/vendor/firmware_mnt/verinfo | grep Time_Stamp
    If the result is "Time_Stamp": "2019-11-04 21:25:29", you are on the latest firmware, if the date/time is earlier, you need to update the firmware. THIS THREAD has got more information for you.
    If you come from an Oreo (Android 8.x) Custom ROM, READ THE OP OF THIS THREAD CAREFULLY !
    I can't explain it better and I am not going to repeat or summarize this. It really is in your interest to carefully read it - you have been notified and warned. Please also pay attention to the last section named "Alipay, WeChatpay, Soter and IFAA" - I strongly recommend to use the debloated firmware.


    Install TWRP recovery
    If you come from stock ROM and have just unlocked your boot loader, this is the next thing to do. I recommend to use the TWRP recovery for the OnePlus 3/3T. The following instructions are based on TWRP.
    To install TWRP, download the twrp-x.x.x-x-oneplus3.img file (Note: replace "x.x.x-x" in the following instructions with the respective values from the real file name) to your PC, connect the phone via USB to your PC, get it into 'fastboot mode' and enter the following command on your PC:
    Code:
    fastboot flash recovery twrp-x.x.x-x-oneplus3.img
    Afterwards, directly boot into 'recovery mode' (enter fastboot reboot on your PC and hold Power and vol.down) - DO NOT boot into the phone's Android system after having flashed TWRP! Once TWRP has been launched, you may decide to reboot your phone and install the ROM at any time later. But the first boot after flashing TWRP must be TWRP in recovery mode.

    Advanced Wipe
    ONLY perform the steps described here, if you come from Stock ROM or a different Custom ROM!

    Boot into recovery mode. In TWRP, choose "Wipe", "Advanced" and specify "Dalvik", "System", "Cache" and "Data" to be wiped. Make sure NOT to wipe "Internal memory". Swipe to confirm the deletion and get back into the main menu.

    DO NOT flash Gapps!
    This ROM comes with pre-installed microG. So don't attempt to flash Gapps.

    Install ROM
    In the TWRP main menu, choose "Install". A file manager appears to let you navigate to your internal memory (path /sdcard). Choose the .ZIP file of our ROM and swipe to flash.
    If you update from a previous version of my ROM, including my LineageOS 16.0 build, you don't need to perform a wipe. If you come from a different ROM (or stock firmware), make sure that you have performed the Wipe steps above.
    When finished flashing, return to the main menu, choose "Reboot" and then "System", which will cause your phone to boot into Lineage OS 17.1 - be patient, the first boot after flashing a new ROM takes quite long!


    Dealing with signed builds
    Please note, that this builds is signed with an own key. When you come from a different build, you cannot directly "dirty-flash" this build. You have to perform a "clean flash" (recommended), or - you do this on your own risk - you may try the below steps.

    This happens at your own risk - make a backup with TWRP before!
    • Download and extract the file migration.sh from this archive
    • This file helps you to migrate from a build signed with the publicly available test keys (i.e. all builds around, which do not state that they are signed). If you come from another signed build (e.g. official LineageOS), you have to adapt the file accordingly (see below links).
    • boot into TWRP
    • push the migration.sh file to the directory /data/local on your device and mount the /system partition in TWRP (you can do so using the dedicated TWRP's menu entry)
    • launch the built-in terminal in TWRP, cd into /data/local, make migration.sh executable (chmod +x) and execute the command ./migration.sh official
    • (In case you receive an error, try sh ./migration.sh official instead)
    • flash the ROM .zip
    • wipe Cache and Dalvik/ART Cache
    • reboot system
    More background information and the "theory behind" can be found in the LineageOS wiki and AOSP reference.



    Bug reports:
    If you have a problem, please create a post with these informations:
    Original Kernel shipped with this rom:
    Build Date:
    And try to get log as described here
    Please note that I can't and won't support issues with builds using a different kernel or Xposed.
    In regards to microG, I will try my best to help when it is related to this ROM (I use it myself), but any questions of the type "the YXZ-app can't do <some sort of fancy xyz Google functionality> properly" are better asked in the respective microG forums.

    Credits
    AOSP project
    LineageOS project
    microG project
    Graphene OS project
    csagan5 (Bromite)
    WhyOrean (Aurora)
    nvertigo67 (for the modded 9.x firmware and for collaboration)
    9
    Change log

    2021-10-14 - FINAL

    • ASB Security string 2021-10-05
    • Bromite System Webview and Browser updated to 93.0.4577.83
    • Kernel upstreamed (note: tag equals last months tag)

    2021-09-12
    • ASB Security string 2021-09-05
    • Kernel upstreamed to tag ASB-2021-09-05_3.18
    • microG microG 0.2.22.212658-2

    2021-08-08
    • ASB Security string 2021-08-05
    • Kernel upstreamed to tag ASB-2021-08-05_3.18
    • Bromite System Webview and Browser updated to 92.0.4515.134
    • F-Droid updated to 1.13
    • Fix in WiFi randomization

    2021-07-10
    • ASB Security string 2021-07-05
    • Kernel upstreamed to tag ASB-2021-07-05_3.18
    • Bromite System Webview and Browser updated to 91.0.4472.146
    • microG 0.2.21.212158-2
    • AuroraStore 4.0.7

    2021-06-13
    • ASB Security string 2021-06-05
    • Kernel upstreamed to tag ASB-2021-06-05_3.18
    • Kernel WLAN driver (qcacld-2.0) patched to include mitigations against "Frag" vuln.
    • Bromite System Webview and Browser updated to 91.0.4472.102
    • microG 0.2.19211515-9

    2021-05-09
    • ASB Security string 2021-05-01
    • Kernel upstreamed to tag ASB-2021-05-05_3.18
    • Bromite System Webview and Browser updated to 90.0.4430.204
    • microG upstreamed (no version change)
    • Update: AuroraServices 1.1.1

    2021-04-10
    • ASB Security string 2021-04-01
    • Kernel upstreamed to tag ASB-2021-04-05_3.18
    • Bromite System Webview and Browser updated to 90.0.4430.59
    • F-Droid updated to 1.12
    • Update: AuroraStore 4.0.4 with AuroraServices 1.1.0

    2021-03-08
    • Security string 2021-03-05
    • Kernel upstreamed to tag ASB-2021-03-05_3.18
    • Bromite System webview updated to 88.0.4324.207
    • Bromite Browser updated to 88.0.4324.207
    • F-Droid 1.11
    • microG 0.2.18.204714

    2021-02-04
    • Security string 2021-02-05
    • Kernel upstreamed to tag ASB-2021-02-05_3.18
    • Bromite System webview updated to 88.0.4324.141
    • Bromite Browser updated to 88.0.4324.141
    • F-Droid 1.10-alpha-234
    • microG 0.2.17.204714-5

    2021-01-15 - Initial build
    • Pre-installed microG (0.2.16.204713-10) and F-Droid like the LineageOS for microG project (own fork)
    • Pre-installed AuroraStore
    • Bromite as default browser (87.0.4280.106)
    • eSpeak TTS engine (FOSS TTS solution)
    • Additional security hardening features listed below:
    • Cloudflare as default DNS (instead of Google)
    • Privacy-preferred default settings
    • Optional blocking of Facebook- and Google-Tracking (Settings - Network & Internet)
    • Optional disable captive portal detection or choose from various providers (default is GrapheneOS and not Google; Settings - Network & Internet)
    • Firewall UI (under Trust)
    • Increased max. password length of 64
    • No submission of IMSI/phone number to Google when GPS is in use
    • Default hosts file with many blocked ad/tracking sites
    • Privacy-enhanced Bromite SystemWebView (87.0.4280.131)
    • Extra control of sensor access for additionally installed user apps (Special access under app permissions)
    • Constified JNI method tables and hardened bionic lib
    7
    LineageOS 18.1

    Hi all,

    a LineageOS 18.1 test build is available here:

    It has the same features, as described in the OP for this 17.1 build, with the following additions:
    - AuroraDroid app replaces F-Droid app to access F-Droid repositories
    - Option to only use fingerprint unlock for apps and not for the device
    - Optional timeout for Bluetooth and WLAN connections
    - Some more hardening features ported from GrapheneOS
    - Kernel is based on the upstreamed kernel of this build (with many necessary adaptations for 18.1, of course)
    - Sec. string 2021-08-05

    Right now, this is still a test build, this means:
    I truly appreciate any feedback (especially, if things don't work as expected). And there definitely will be an update for 17.1 with ASB patches for September. It is possible to "dirty-flash" over this 17.1 build, but make a backup in TWRP before, to be able to get back.

    Feedback appreciated - Thanks & regards, M.

    EDIT:
    Kernel source: https://github.com/lin18-microG/android_kernel_oneplus_msm8996/tree/lin-18.1-mse2
    Build Manifest: https://github.com/lin18-microG/local_manifests/tree/lin-18.1-hmalloc

    EDIT2 (2021-08-22):
    Seems the kernel needs more rework: on my device, it always crashes after a while. If you use the "original" LineageOS kernel (e.g. extract and flash boot.IMG from an official LineageOS ROM Zip), it will work.
    7
    New build available with March ASB patches

    Hi all, new build available for download, will soon also be offered as OTA update through the Updater app.

    • Security string 2021-03-05
    • Kernel upstreamed to tag ASB-2021-03-05_3.18
    • Bromite System webview updated to 88.0.4324.207
    • Bromite Browser updated to 88.0.4324.207
    • F-Droid 1.11
    • microG 0.2.18.204714
    Happy flashing!
    Regards, M.

    EDIT: OTA update now offered through Updater app
    6
    New build available with February ASB patches

    Hi all, new build available for download, will soon also be offered as OTA update through the Updater app.
    • Security string 2021-02-05
    • Kernel upstreamed to tag ASB-2021-02-05_3.18
    • Bromite System webview updated to 88.0.4324.141
    • Bromite Browser updated to 88.0.4324.141
    • F-Droid 1.10-alpha-234
    • microG 0.2.17.204714-5
    Happy flashing!
    Regards, M.