Install · os.ivan.gg

Commands below are for the computer you pick, guessed from your browser.

Installing erases everything on the phone. Unlocking the bootloader and locking it again each wipe all data. Back up first. This is an alpha from a personal research project: only install it on a phone you can afford to lose data on. See the terms.

Before you start

A supported Pixel with a build. The supported models are the ones GrapheneOS supports. Builds so far: Pixel 8 Pro (husky). Check devices. Never flash a build made for another model.
OEM unlocking must be possible. Some carrier-sold phones block it. If the switch in step 1 is greyed out, you can't install.
A computer running Windows 10 or 11, a current macOS, or a current Linux, with about 10 GB free. Not a virtual machine: USB passthrough is unreliable.
A good USB cable, ideally the one that came with the phone. Plug it straight into the computer, not into a hub or a front-panel port.
Backups of everything you want to keep.

Coming from GrapheneOS? Your phone runs GrapheneOS with a locked bootloader and GrapheneOS's key. Start at step 1 like everyone else: turn OEM unlocking back on (GrapheneOS's setup turns it off), unlock (a wipe), flash, flash our key, lock again. Our builds can't be installed over GrapheneOS without that wipe, and GrapheneOS updates won't install over ours.

01Enable OEM unlocking

On the phone, open Settings → About phone and tap Build number seven times to enable Developer options.
Open Settings → System → Developer options and turn on OEM unlocking. The phone may need an internet connection before the switch can be used.

02Get fastboot

You need Google's platform-tools, version 35.0.1 or newer. Download them into a folder of their own and use them from one terminal window for every step below. The PATH change only lasts for that window: if you close it, open a new one in the same folder and repeat the PATH line.

Windows

Open PowerShell from the Start menu (or Windows Terminal). Use a normal window, not Run as administrator. Then:

mkdir os-ivan-gg; cd os-ivan-gg
curl.exe -LO https://dl.google.com/android/repository/platform-tools-latest-windows.zip
tar -xf platform-tools-latest-windows.zip
$env:Path = "$pwd\platform-tools;$env:Path"
fastboot --version

Type curl.exe, not curl: in PowerShell, plain curl is a different command.

macOS

Open Terminal (Applications → Utilities). Then:

mkdir os-ivan-gg && cd os-ivan-gg
curl -LO https://dl.google.com/android/repository/platform-tools-latest-darwin.zip
unzip -q platform-tools-latest-darwin.zip
export PATH="$PWD/platform-tools:$PATH"
fastboot --version

macOS needs no driver.

Linux

Open a terminal. Then:

mkdir os-ivan-gg && cd os-ivan-gg
curl -LO https://dl.google.com/android/repository/platform-tools-latest-linux.zip
unzip -q platform-tools-latest-linux.zip
export PATH="$PWD/platform-tools:$PATH"
fastboot --version

Distribution packages of fastboot are often too old; use these. To flash without root you need the udev rules for Android devices: android-udev on Arch, android-sdk-platform-tools-common on Debian and Ubuntu. If fastboot later says the device is claimed or in use, stop fwupd for this session: sudo systemctl stop fwupd.service.

The last command prints the version. It must be 35.0.1 or newer.

03Connect the phone

Turn the phone off. Hold volume down and press power. The bootloader opens: a red warning triangle and the words Fastboot Mode. Don't press power again: that would pick Start and leave the bootloader.
Connect the phone to the computer and check that it's seen:
```
fastboot devices
```
It prints one line with the phone's serial number. If it prints nothing:

Windows

Windows 10 and 11 include a fastboot driver. If the phone still isn't listed, open Settings → Windows Update → Advanced options → Optional updates → Driver updates, install the Android bootloader interface driver (it may be called LeMobile Android Device), then unplug and reconnect. Google's USB driver for Windows also works.

macOS

Try another cable or another port on the computer itself, then reconnect.

Linux

Install the udev rules from step 2 if you haven't, then unplug and reconnect.

Still nothing: change the cable and avoid hubs. Bad cables are the most common cause.

04Unlock the bootloaderWipes the phone

fastboot flashing unlock

The phone asks for confirmation. Use the volume keys to select Unlock the bootloader and press power. This wipes the phone. It returns to the bootloader, unlocked.

05Download and verify

Releases are published at github.com/os-ivan-gg/releases, one release per build, tagged with the build number. Each holds the install zip, husky-install-<build>.zip, and a checksum file, SHA256SUMS-<build>. The release notes list the same SHA-256 values. Download both into the same folder, with <build> replaced by the newest build number:

Windows

curl.exe -LO https://github.com/os-ivan-gg/releases/releases/download/<build>/husky-install-<build>.zip
curl.exe -LO https://github.com/os-ivan-gg/releases/releases/download/<build>/SHA256SUMS-<build>
Get-FileHash husky-install-*.zip -Algorithm SHA256
Get-Content SHA256SUMS-*

Compare the hash with the line for the install zip in the checksum file and in the release notes. Windows prints it in capitals; the letters are the same.

macOS

curl -LO https://github.com/os-ivan-gg/releases/releases/download/<build>/husky-install-<build>.zip
curl -LO https://github.com/os-ivan-gg/releases/releases/download/<build>/SHA256SUMS-<build>
shasum -a 256 husky-install-*.zip
cat SHA256SUMS-*

Compare the hash with the line for the install zip in the checksum file and in the release notes.

Linux

curl -LO https://github.com/os-ivan-gg/releases/releases/download/<build>/husky-install-<build>.zip
curl -LO https://github.com/os-ivan-gg/releases/releases/download/<build>/SHA256SUMS-<build>
sha256sum -c --ignore-missing SHA256SUMS-*

It must print OK for the install zip. Also compare with the release notes.

Verify the SHA-256 against the release notes and the SHA256SUMS-<build> file. If they don't match, delete the file and download it again. Don't flash a file that doesn't match.

06Flash the build

Extract the zip and run its flash script, with the phone still in the bootloader and connected:

Windows

tar -xf husky-install-<build>.zip
cd husky-install-<build>
.\flash-all.bat

macOS and Linux

unzip -q husky-install-<build>.zip
cd husky-install-<build>
bash flash-all.sh

It flashes the firmware, restarts into the bootloader and flashes the OS. Don't touch or unplug the phone until it finishes and the phone is back in the bootloader. If it stops with an error, keep the full output: it's what's needed to help.

Linux

If it fails for lack of space in /tmp, run it as mkdir tmp && TMPDIR="$PWD/tmp" bash flash-all.sh.

07Flash our key

Still in the bootloader and in the same folder, flash our public key. The install zip includes it as avb_pkmd.bin:

fastboot erase avb_custom_key
fastboot flash avb_custom_key avb_pkmd.bin

The flash script may already do this; that is still to be confirmed on the first install, so run the commands anyway. Flashing the same key twice is harmless.

08Lock the bootloaderWipes the phone

Locking turns on full verified boot and stops anyone from flashing the phone over USB. Don't skip it: see why an unlocked bootloader is unsafe.

Lock only with our build and our key on the phone, together. If the avb_custom_key doesn't match the installed build, or the installed build isn't ours, the phone will refuse to boot once locked. Getting it back means unlocking the bootloader again (another wipe), which only works while OEM unlocking is still on. If flashing failed or you aren't sure what is on the phone, flash again before locking.

fastboot flashing lock

Confirm on the phone with the volume keys and the power button. This wipes the phone again.

09First boot

With Start selected in the bootloader, press power. From now on the phone shows a yellow notice on every boot: "Your device is loading a different operating system". That is expected for an OS signed with its own key on a locked bootloader. An orange warning instead means the bootloader is still unlocked.

The yellow notice shows the fingerprint of the key the phone boots with. Compare it with ours:

Verified boot key fingerprint (SHA-256 of avb_pkmd.bin)

65894abf 95040084 e7f27ff8 cb8e0d29 1b04abc2 66103fb8 8cef5e0c 8c8bf161

Once the phone has booted and you've checked it, go back to Developer options and turn OEM unlocking off. Leave it on until then.

Setting up

Everyday PIN Protected space PIN Reboot PIN Duress PIN

Setup offers the protected space right after the screen lock step. You can skip it and set it up later from Settings.
The everyday profile and the protected space both use PINs, of at least 6 digits.
All PINs share one length: the length of the everyday PIN you choose at setup. The protected space PIN, the duress PIN and the reboot PIN must have the same number of digits. Changing later to a longer PIN means setting the phone up again, so pick the length you want to keep.
The protected space PIN must differ from the everyday PIN. The duress and reboot PINs must differ from both.
The duress PIN is optional. The duress and reboot PINs are managed only inside the protected space, not from the everyday profile.
PIN auto-confirm (unlock without pressing enter) is off by default. You can turn it on in the everyday profile's Settings → Screen lock.
Fingerprint unlock works for the everyday profile only.
Calls work in the protected space. Text messages arrive in the everyday profile only.
Android's own private space can't be used beside the protected space. Setup won't create a protected space while a private space exists.
In the everyday profile the Vanadium browser is labelled "Browser".
The boot animation shows "os.ivan.gg" until the first setup is done, then the plain Android logo.

Updates

The built-in updater reads the rolling release tagged updates, which holds husky-ota_update-<build>.zip and the channel file husky-stable. Updates are signed with the same release key and checked on the phone before installing.
New GrapheneOS releases are tracked automatically: our changes are rebased and rebuilt on each new GrapheneOS stable release. Publishing a release is still done by hand, and each release says which GrapheneOS release it is based on.

About our keys

Builds are signed with our own keys, generated on 2026-10-13. Their certificates use CN=os.ivan.gg. These are not GrapheneOS's keys: official GrapheneOS releases and updates won't install over our builds, and ours won't install over theirs without a wipe. A locked phone only boots a build whose key is in avb_custom_key.

The signing keys are kept with an offline backup by the maintainer.

Going back

To leave os.ivan.gg, follow the install guide of the OS you want (for example GrapheneOS) from the unlock step. That wipes the phone. If you go back to the stock OS, run fastboot erase avb_custom_key before locking the bootloader.