Would I break anything by installing another build of the same custom OS, but with a different signature, using a custom recovery tool?

Question

I am about to get a device for which, so far, only an unofficial LineageOS build exists. A merge request to officially support this device is underway, but as always with LineageOS, no ETA.

A bunch of forum posts mention that there may be issues when signatures do not match. I remember that, when moving from CyanogenMod to its successor LineageOS, there was a special migration process (as the migration implied a change of the OS signature iirc):

• Install a special, migration-only build of LineageOS (intended only for migration from CyanogenMod, not for permanent usage)
• Boot up LineageOS once
• Install a regular LineageOS build over it

Also now, I am seeing discussions about migration paths from an unofficial build of LineageOS to an official one (again, with different signatures). However, I have not yet seen a clear explanation as to what the signature does and what would break if the signature does not match. Presumably any update tool would reject an update with a different signature. However, custom recovery tools (TWRP for sure) allow for signature checks to be skipped, hence this would not be an issue. Anything else I am missing?

My planned update path is the following:

• Using TWRP (or possibly, LineageOS Recovery), create a backup of the data partition on my present device.
• Unlock the bootloader of the new device.
• Install either TWRP (if available) or LineageOS Recovery on the new device.
• Install the still-unofficial LineageOS build on the new device.
• Using the recovery tool, restore the data backup on the new device.
• Use the new device.
• When an official LineageOS build becomes available, reboot into recovery and install it.
• Continue to use the new device, now with an official LineageOS build.

When switching from Nexus S to OnePlus One, I followed the first six steps and this worked without any issues. Both devices were on the same CyanogenMod version, albeit both were official builds, presumably with the same signature. Thus, as long as the OS signature does not change, the above process is proven to work – save for individual apps doing some extra verification, the effects of which would only affect that particular app.

Would I be able to use the same procedure to upgrade to a build of the same OS but with a different signature? If not, what would be broken by the signature not matching?

Answer 1

Moving the entire /data partition to a different device no longer works with modern Android devices, as that partition is now encrypted. As far as I found out, the encryption method varies from device to device – either full disk encryption or file-based encryption. The recovery tool would therefore be able to either decrypt the partition, or back up the encrypted data and its keys. The second option would only work if both devices use the same encryption method.

As of September 2022, TWRP does not seem to be able to back up, or restore, encrypted partitions, and LineageOS Recovery does not include backup functionality at all. I am not aware of other Android recovery tools, so currently I am not aware of a way to move the /data partition to a different device.

That means the only way to back up /data would be from within the OS. If you are root, you could try taring the directory on one device (storing it on the SD card), then restore it on the other, though I have no idea if that works. Otherwise, NeoBackup (available on F-Droid) can do a batch backup of all installed apps with their data.

For the signature part, that leaves us with upgrading between official and unofficial builds. Examining a key migration script for LineageOS reveals that it modifies two files: /data/system/packages.xml and /data/system/packages-backup.xml. These contain a list of all installed packages and, among others, their signatures. According to the instructions on the LineageOS wiki, the signatures need to be changed before updating to an OS image with different signatures.

Admittedly, that still doesn’t fully answer my original question. Presumably either the recovery tool will refuse to update if signatures do not match, or the new OS will throw tons of errors on boot because all of the system app signatures have changed, possibly forcing you to revert to the old OS or even wipe your data partition. However, there is a migration path if you really need to move to an OS image with different signatures.