As I understand it, if an Android device’s bootloader is locked (
fastboot oem lock), it should check the installed system on boot to verify that it’s signed with some (the manufacturer’s?) signing keys. I’ve seen several warnings not to lock the bootloader again after installing a custom ROM like LineageOS because the bootloader would complain about the modified system image and refuse to boot.
However, I have two Android devices on which I have installed custom ROMs:
- The Fairphone 3 (FP3), where I installed /e/ OS
- The OnePlus One (bacon), where I installed LineageOS 18.1 (with microG)
I’ve subsequently re-locked the bootloader on both devices and, surprisingly, not experienced any issues so far. For the Fairphone 3, I originally assumed that this works because /e/ OS is officially supported by the manufacturer, so I thought that the /e/ OS images are probably signed with some official keys. However, I don’t think there is any such support in the case of the OnePlus One (which is also long out of manufacturer support by now). Another hint is this forum post on the Fairphone forums, which reports the following:
I relocked the bootloader (fastboot flashing lock), it automatically wiped my user data, and booted successfully! Also, after restoring my data, I was able to upgrade from last-week’s release to the new release of today - all without problems.
Now, this does raise a lot of security questions though. I did not realize that LineageOS, /e/ and even Fairphone where all signing their builds with google test keys - essentially rendering the OS build integrity checks meaningless… I guess in fact that means that it doesnt really matter which keys are being used, as they are simply not checked? Any key would be accepted?
So, my question is: Why does running /e/ OS or LineageOS with a locked bootloader work in these cases? What is the significance of the Google test keys here – do the bootloaders just always accept them?