Alan Gaudet
FW-02 · Rev 20260913

Oriole ROM

A self-built, self-signed LineageOS for a spare Pixel 6, used to run risky phone steps first.

Boots on the test phone

See it on the bench

Description

My LineageOS fork for the Pixel 8 already has a signed build. Every remaining step on that phone would wipe the handset I use daily, and its go or no-go question, whether banking apps run on a self-signed build, is still open. A spare Pixel 6 takes the same fork layer and runs the destructive steps first, so the Pixel 8 inherits a procedure that has already worked once.

Block diagram

  1. LineageOS 23.2
  2. Fork overlays
  3. Own-key signing
  4. fastboot update
  5. Pixel 6

Decisions

Give the test phone its own signing identity

Cloning the Pixel 8 build would have copied its release keys. Sharing one identity would give an app signed with the platform key on the experimental phone platform privileges on the working phone, with no revocation short of reflashing both. The Pixel 6 generated its own keys, and the phone verifies its boot chain against that AVB root. It cost one milestone and a second key set to keep.

Build the Google apps into the verified image

The usual Google apps package installs by mounting /product read-write, and vbmeta_system covers that partition with a dm-verity hashtree signed under this project's root, so nothing on the phone can re-sign the result. The apps are built into /product and /system_ext instead, by inheriting the vendor product makefile. Verity still enforces with the apps present. Any change to the app payload now means a full rebuild and reflash.

Stay on Android 16

Android 17 would need newer branches of the gs101, oriole, raviole and kernel device trees plus matching vendor blobs, and none of them exist. Getting there would mean porting four device repositories. I kept the project on LineageOS 23.2 and made it the scaffold for the Pixel 8 and a future Pixel 10. The accepted cost is that the vendor blobs carry an older security patch level than the platform.

Errata

  • The written flash procedure drops the fastbootd reboot and the super-partition update, so followed by hand it stops partway. The flash that worked used fastboot update, which reads the sequence from the image.
  • The bootloader stays unlocked, so the phone reports an orange verified-boot state. Relocking with the custom AVB key is untested.

Revision history

20260913 Google apps built into /product and /system_ext; the phone boots with verity enforcing.
20260912.4 First flash: the ROM boots on the Pixel 6 and verifies against the project's own AVB root.
20260912.3 Flash bundle and the written stock-to-ROM procedure.
20260912.2 First signed user build with the project's release keys and the gs101 AVB chain.