Installing GrapheneOS on Pixel Phone from Qubes OS

User Support
1

Is it possible to install Graphene OS from Qubes? If yes, how does one go about doing it?

2 Likes
2

One probably can do it from a disposable sys-usb.

3

Do you have Chrome and network in your disposable sys-usb?

Thinking about it now, I could have just used my Windows HVM with one USB controller attached. But then again, I had that Windows laptop just standing there collecting dust… :wink:

4

I don’t see why it would be impossible to install Chrome and temporarily connect the network to sys-usb if needed. It’s going to be reset after that, right?

5

Who said impossible?

1 Like
6

I tried doing this and flashing from the command line, and it did not work. The Pixel goes through several reboots, and after a certain reboot the Pixel didn’t appear in the USB device manager GUI (though I didn’t dig any further with the terminal).

7

If you follow my suggestion, this should not be necessary. Your sys-usb has the usb devices connected directly and should behave like a standard Linux OS with the connected devices. You do not need to connect them anywhere.

1 Like
8

+1

Ive always found your method works best. I do it as so: make disposable usb Qube, attach the PCI device ID of the USB controller, start qube, install latest ADB, download g=GrapheneOS then run flash-all.sh from the GrapheneOS installer.

of course, if the keyboard is USB and not PS/2 then there can be some issues to work around.

1 Like
9

Related:

10

Command line install (this is quick and incomplete steps to follow)

In Fedora sys-usb, download, verify and extract the standalone platform-tools on Linux
Next, add the tools to your PATH in the current shell so they can be used without referencing them by file path, enabling usage by the flashing script.
$ export PATH="$PWD/platform-tools:$PATH"
$ fastboot --version

Download from grapheneos.org: factory.pub, Graphene OS image in zip file and zip.sig file.
Install in Debian signify-openbsd to verify the install (couldn’t find signify in Fedora)
Copy files to Debian AppVM and verify command:
$ signify-openbsd -Cqp factory.pub -x grapheneos-factory-2021.09.01.zip.sig && echo verified

PHONE (see online for full tutorial)
Enabling OEM unlocking
Unlocking the bootloader:
$ sudo fastboot flashing unlock

INSTALL
$ sudo ./flash-all.sh

If there’s a space problem (unable to allocate bytes…), delete tmp folder and try…
$ sudo mkdir tmp && sudo TMPDIR="$PWD/tmp" ./flash-all.sh

2 Likes
11

Got this finally working by
1/ adding Android udev rules in sys-usb qube
2/ increasing disk space for sys-usb
3/ using sys-usb qube directly (copying platform-tools and the image with qvm-copy-to-vm sys-usb ...

Definitely not the ideal Qubes-proper solution, but worked. I will try to figure out how to get the low-level access for flashing from a regular qube with access to internet etc. (rather than directly within sys-usb)

6 Likes
12

Thanks a lot for coming back and sharing your update :slight_smile:

1 Like
13

If you have an archlinux template, then you can create an HVM qube based on it passing only the usb device you intend to use (make sure to have at least 2GB RAM & 8GB of free storage), then installing the required packages with sudo pacman -S android-udev android-tools signify (connect the device after packages are installed to avoid permission errors) and following the official instructions.

2 Likes
14

Did you follow up on this?
It would be nice to have a community guide for this :handshake:

If you do not have time but a working solution please DM me and I will test and compile into a community guide.

15

please change the command existt after the line ‘copy files to Debian AppVM and verify command’ to :
ssh-keygen -Y verify -f allowed_signers -I contact@grapheneos.org -n "factory images" -s DEVICE_NAME-install-VERSION.zip.sig < DEVICE_NAME-install-VERSION.zip
that command could be found on CLI install guide | Install | GrapheneOS, using 'ctrl + F ‘verify’.

16

i won’t revommend to use $PWD/platform-tools:$PATH", i mean, it’s not bad to do $PWD, but i’m not sure whether it is due to $PWD recognized as that time i type the command OR NOT, but i think keeping platform-tools .zip or folder into ~!/ directory and just typing export PATH=“~/platform-tools:$PATH” is better, since i have to type it again when i mistyped other step.

  1. get root terminal, sudo su.
  2. fastboot flashing unlock
  3. extract ROM file(bsdtar, Xarchiver, whatever) and go to directory
  4. type export PATH=“~/platform-tools:$PATH” (if you didn’t pasted it on ~/, then you should have to write full directory you extracted platform-tools
  5. make sure terminal is root, then sudo bash flash-all.sh

i have grinded my last evening for this task.