Pixel 6 Pro XL Graphene OS Install Procedure

README.md

GrapheneOS Installation Guide for Pixel 6 Pro

This guide documents the command-line installation procedure for GrapheneOS on a Google Pixel 6 Pro (codename: raven) from an Ubuntu 24.04 host system.

Table of Contents

• Prerequisites
• Device Preparation
• Host System Setup
• Bootloader Unlock
• Download and Verify Factory Images
• Flash GrapheneOS
• Lock Bootloader
• Post-Installation
• Verification
• Troubleshooting

Prerequisites

Hardware Requirements

• Google Pixel 6 Pro (non-carrier-locked)
• USB-C cable (high-quality, preferably the cable shipped with the device)
• Computer running Ubuntu 24.04 LTS with:
  • Minimum 2GB free memory
  • Minimum 32GB free storage
  • Direct USB port access (avoid USB hubs)

Software Requirements

• Ubuntu 24.04 LTS (fully updated)
• Internet connection for downloading factory images (~1.6GB)

Device Preparation

Enable Developer Options

1. Navigate to Settings > About phone
2. Tap Build number seven times until developer mode is enabled

Enable OEM Unlocking

1. Navigate to Settings > System > Developer options
2. Enable OEM unlocking
   • Requires active internet connection for carrier lock verification

Note: The device must not be carrier-locked. Carrier variants may have OEM unlocking permanently disabled.

Host System Setup

Install Required Packages

sudo apt update
sudo apt install -y android-sdk-platform-tools-common openssh-client libarchive-tools

The android-sdk-platform-tools-common package provides udev rules for non-root USB device access.

Download and Configure Platform Tools

Ubuntu's packaged fastboot is outdated. Download the official standalone platform-tools:

cd ~/graphene

# Download platform-tools
curl -O https://dl.google.com/android/repository/platform-tools_r35.0.2-linux.zip

# Verify checksum
echo 'acfdcccb123a8718c46c46c059b2f621140194e5ec1ac9d81715be3d6ab6cd0a  platform-tools_r35.0.2-linux.zip' | sha256sum -c

# Extract
bsdtar xvf platform-tools_r35.0.2-linux.zip

# Verify installation
./platform-tools/fastboot --version

Expected output:

fastboot version 35.0.2-12147458

Disable fwupd Service

The fwupd service can interfere with fastboot device communication:

sudo systemctl stop fwupd.service

Note: This change is temporary and reverts on reboot.

Bootloader Unlock

Boot into Fastboot Mode

1. Power off the device
2. Hold Volume Down while pressing Power
3. Continue holding Volume Down until "Fastboot Mode" appears with a red warning triangle
4. Do not select any menu options

Connect and Verify Device

Connect the device via USB and verify detection:

./platform-tools/fastboot devices

Expected output:

<SERIAL_NUMBER>    fastboot

Verify device model:

./platform-tools/fastboot getvar product

Expected output:

product: raven

Unlock the Bootloader

./platform-tools/fastboot flashing unlock

On the device:

1. Use Volume buttons to select "Unlock the bootloader"
2. Press Power to confirm

Warning: This operation wipes all device data.

After confirmation:

1. Press Power to select "Start"
2. Allow the device to boot (factory reset occurs)
3. At the setup wizard, reboot back into fastboot mode:
   • Hold Volume Down + Power until reboot
   • Continue holding Volume Down until "Fastboot Mode" appears

Download and Verify Factory Images

Download Signing Key

curl -O https://releases.grapheneos.org/allowed_signers

Key contents (for verification):

[email protected] ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIUg/m5CoP83b0rfSCzYSVA4cw4ir49io5GPoxbgxdJE

Identify Latest Release

curl -s https://releases.grapheneos.org/raven-stable | head -1

This returns the current stable version number.

Download Factory Images

Replace <VERSION> with the version from the previous command:

curl -O https://releases.grapheneos.org/raven-install-<VERSION>.zip
curl -O https://releases.grapheneos.org/raven-install-<VERSION>.zip.sig

Example for version 2025112100:

curl -O https://releases.grapheneos.org/raven-install-2025112100.zip
curl -O https://releases.grapheneos.org/raven-install-2025112100.zip.sig

Verify Signature

ssh-keygen -Y verify -f allowed_signers -I [email protected] -n "factory images" -s raven-install-<VERSION>.zip.sig < raven-install-<VERSION>.zip

Expected output:

Good "factory images" signature for [email protected] with ED25519 key SHA256:AhgHif0mei+9aNyKLfMZBh2yptHdw/aN7Tlh/j2eFwM

Extract Factory Images

bsdtar xvf raven-install-<VERSION>.zip

Flash GrapheneOS

Verify Device Connection

Ensure device is in fastboot mode and connected:

./platform-tools/fastboot devices

Execute Flash Script

cd raven-install-<VERSION>
PATH="../platform-tools:$PATH" bash flash-all.sh

The script performs the following operations:

1. Flashes bootloader to both slots
2. Flashes radio/modem firmware
3. Writes GrapheneOS verified boot key
4. Erases and flashes system partitions
5. Formats userdata and metadata

Important: Do not disconnect the device or interact with it during flashing. The device will reboot multiple times automatically.

Upon completion, the device returns to fastboot mode.

Lock Bootloader

Locking the bootloader enables verified boot and prevents unauthorized modifications.

cd ~/graphene
./platform-tools/fastboot flashing lock

On the device:

1. Use Volume buttons to select "Lock the bootloader"
2. Press Power to confirm

Warning: This operation wipes all device data.

After confirmation:

1. Press Power to select "Start"
2. The device boots into GrapheneOS

Post-Installation

First Boot

• Initial boot may take 1-2 minutes
• A yellow warning screen appears briefly showing the verified boot key fingerprint
• This warning is expected for any non-stock OS with a locked bootloader

Disable OEM Unlocking

During the GrapheneOS setup wizard:

1. On the final configuration screen, locate the OEM unlocking toggle
2. Ensure it remains checked (default) to disable OEM unlocking
3. This prevents bootloader unlock without factory reset

Alternatively, after setup:

1. Navigate to Settings > System > Developer options
2. Disable OEM unlocking

Verification

Verified Boot Key Hash

On Pixel 6 Pro, the boot screen displays the full SHA-256 hash of the verified boot public key. Compare against the official GrapheneOS key:

439b76524d94c40652ce1bf0d8243773c634d2f99ba3160d8d02aa5e29ff925c

Hardware Attestation

For cryptographic verification of device integrity:

1. Install the Auditor app from the GrapheneOS App Store
2. Use a second Android device with Auditor to perform QR code verification
3. Optionally, configure remote attestation via https://attestation.app

Troubleshooting

Device Not Detected

# Verify udev rules are installed
dpkg -l | grep android-sdk-platform-tools-common

# Reconnect device after installing udev rules
# Check dmesg for USB connection events
dmesg | tail -20

OEM Unlocking Unavailable

• Ensure device is connected to the internet
• Verify device is not carrier-locked
• Factory reset may be required after enabling OEM unlocking on Pixel 6 series

Flash Script Fails Mid-Process

Common causes:

• USB cable quality issues
• USB hub interference
• fwupd service claiming device

Resolution:

1. Use a different USB cable (preferably OEM)
2. Connect directly to motherboard USB port
3. Ensure fwupd.service is stopped
4. Reboot device into fastboot mode
5. Re-run flash script (safe to re-execute)

Insufficient Temporary Storage

If /tmp has insufficient space:

mkdir tmp
TMPDIR="$PWD/tmp" bash flash-all.sh

References

• GrapheneOS Install Guide
• GrapheneOS Releases
• Android Platform Tools
• Auditor Documentation

License

This documentation is provided for reference purposes. GrapheneOS is developed by the GrapheneOS project. Google Pixel is a trademark of Google LLC.