Installing postmarketOS with full disk encryption on a OnePlus 6
tl;dr: I installed postmarketOS, an βalternativeβ Linux-based operating system, on a OnePlus 6 phone, and it rocks.
What is postmarketOS
postmarketOS is a fantastic, much-needed, project.
One one level, postmarketOS is a Linux-based replacement for the default operating system on some phones. (Note: unlike LineageOS, and other similar alternative Android installations, postmarketOS is not Android.)
But, more importantly, postmarketOS is a way of reducing eWaste, and giving new life to devices which have been rendered unsupported by their manufacturers.
We believe that hardware should be used sustainably and not thrown away just because its creator no longer supports it. Your device should not track you or help others collect and sell your data, and it should not constantly demand your attention in order to show you advertisements. Your device is yours, and you should be able to use it as you wish. These are the goals that drive postmarketOS.
We canβt afford to churn through technology for the next shiniest thing, and a project which helps keep devices useful is vital.
Long live postmarketOS, and major applause for every one of you who works on, or has worked on, it.
Why a OnePlus 6?
I first used postmarketOS a few years ago, with an old tablet, and Iβve been yearning for an opportunity to try it again, but on more modern, more powerful, hardware. And the OnePlus 6 is well supported.
A fedi friend - thanks Justine! (Justineβs snac instance) - kindly sold me her OnePlus 6, so that I could give this a go.
Installing postmarketOS on a OnePlus 6 without full disk encryption
When I first got the device, I just wanted to give postmarketOS a try, so I used the pmOS WebUSB in-browser installer with Chromium (since it doesnβt work with Firefox).
It was incredibly slick. Very, very easy, and it resulted in a working postmarketOS installation with virtually no effort from me.
Genuinely, this is superb, and makes postmarketOS accessible to a much broader range of people, who may not be comfortable with a Linux terminal.
The default password is 147147
.
While I didnβt want an installation without full disk encryption, this experience was enough to convince me to try the seemingly more complicated installation to get full disk encryption working.
If you donβt want full disk encryption, and you have a supported device, this really is the way to go (IMHO).
Installing postmarketOS on a OnePlus 6 with full disk encryption
One cannot use the browser-based installer to an installation with full disk encryption, and I wanted full disk encryption.
To do that, one needs to use pmbootstrap
.
This was⦠more challenging.
On the first evening that I tried, I got postmarketOS installed, but I had terrible trouble with Unl0kr and full disk encryption - duplicate virtual keyboards sending multiple sets of keypresses, and, even when I had worked out that I didnβt need to use the button at the top of the screen to enable a keyboard, I could just use the invisible keyboard already on screen (but not showing), I could enter the passphrase, but it didnβt do anything.
Figuring that that couldnβt be the answer, I tried again on another evening and that time, it worked.
How I got there was informed by the wiki, but not by following it exactly. My feeling - and I could be wrong - is that the wiki might be more of an information dump than a proper guide. At least, it seems to contain a lot of steps which I did not need.
Or perhaps I just installed it wrongly and it will come back to bite me :)
Hereβs what I did:
I used Power + Volume Up to enter fastboot.
Then, I just double-checked that it was unlocked, even though that seemed obvious from the fact that the browser-based installation worked. (As an aside, Iβm not sure if there is a way of locking the bootloader again afterwards, for security.)
I ran
fastboot oem unlock
And it said that it was unlocked. Excellent.
I already had pmbootstrap
installed from a previous project with an aging Galaxy Tab (postmarketOS worked, but it was very slow, to the point of not being usable for my needs, sadly).
But I wiped that installation, and removed the config file (~/.config/pmbootstrap.cfg), then reinstalled it
pmbootstrap` again, from git. That way, I knew Iβd have an up to date version.
To start the configuration, I used
pmbootstrap init
This was quite straightforward, with the on-screen instructions. I chose the edge release, for oneplus enchilada, and I picked gnome-mobile.
At this point, I found it a little hard to follow the instructions to work out what I should do next.
I used
pmbootstrap install --fde
That gave me the option to set the user password and disk encryption password (two separate passwords).
The output of that told me to next run
pmbootstrap flasher flash_rootfs
The first time I did that, I got an error:
"Sending 'userdata' (2330166 KB) FAILED (remote: 'Requested download size is more than max allowed"
I restarted the bootloader (i.e. back into fastboot), then I ran the command again. (It turns out that this is covered in the wiki. I wish Iβd noticed that sooner :))
It completed successfully:
Sending sparse 'userdata' 1/4 (733013 KB) OKAY [ 16.708s]
Writing 'userdata' OKAY [ 0.001s]
Sending sparse 'userdata' 2/4 (782236 KB) OKAY [ 25.289s]
Writing 'userdata' OKAY [ 0.001s]
Sending sparse 'userdata' 3/4 (762948 KB) OKAY [ 19.869s]
Writing 'userdata' OKAY [ 0.001s]
Sending sparse 'userdata' 4/4 (51968 KB) OKAY [ 32.629s]
Writing 'userdata' OKAY [ 0.001s]
Finished. Total time: 94.531s
I then ran
pmbootstrap flasher flash_kernel
Again, I got an error, but a different one:
"fastboot: error: Failed to identify current slot"
Again, I restarted the bootloader (i.e. back into fastboot), then I ran the command again.
Same error.
I ran the command again without rebooting. This time it got further - it started to send the boot files - and then hung.
I ran the command again. This time, it showed βwaiting for deviceβ. So I restarted the bootloader, and it completed rapidly.
This felt like progress!
I rebooted the device:
fastboot reboot
noting that the wiki expressly said to reboot using fastboot rather than the device buttons, to ensure that everything was saved.
I then pressed a key on the device to reboot⦠and it booted into postmarketOS, with a working Unl0kr setup (no invisible / duplicate keyboards!), to enter my full disk encryption password.
Success! It worked.
I had a working postmarketOS installation, with full disk encryption, which I could decrypt.
Next steps
I spent some time yesterday evening setting it up.
It connected to Wi-Fi immediately, and I started installing some software.
I sent my first toot from it.
Iβm so impressed.
Iβm going to keep on playing with it, and using it, before I write up much more but, in a few days, I hope to add some thoughts about how I am getting on with it.
Even with full disk encryption, I donβt know enough about postmarketOS security to feel comfortable swapping my main phone (running GrapheneOS) to it yet. Perhaps Iβll learn more about it, and get comfortable, but right now, Iβm not in that place.
For now, I am chuffed to bits that Iβve got it work - thank you so much to everyone who has spent time on the postmarketOS project - and I am very much looking forward to getting to grips with it properly.
This isnβt just a fun technical project - although it is a fun technical project - it is part of an important movement of recognising and mitigating the impact of electronic waste and excess consumerism, and giving perfectly functional hardware a new lease of life, without ads or trackers.
Now wouldnβt it be nice if there was a postmarketOS for βsmartβ TVsβ¦