Lock your bootloader

If setup sent you here, your phone's bootloader is unlocked. The phone works, but it isn't protected the way it should be. Locking it takes a few minutes and erases the phone.

Why an unlocked bootloader is unsafe

Verified boot is off. The phone doesn't check that the OS it starts is the one you installed. A modified OS boots without complaint.
Anyone with the phone in hand can flash it over USB, replacing or changing the OS without knowing your PIN. With the bootloader locked, that isn't possible.
Tampering goes unnoticed. On a locked phone, a changed OS fails to boot or shows up in verified boot checks. Unlocked, there is nothing to catch it.
The PINs, the protected space and the duress PIN all rely on the OS being the one you installed. On an unlocked phone that can't be assumed.

Leaving the bootloader unlocked is only meant for development and testing.

Locking erases everything on the phone. Back up first, then set the phone up again after locking.

How to lock it

You need a computer with fastboot and the install zip of the os.ivan.gg build that is on the phone (or a newer one, flashed first). See the install guide for downloading and verifying it.

Back up anything you want to keep.
Boot into the bootloader: turn the phone off, then hold volume down while pressing power. Connect it to the computer.
If you aren't sure which build is on the phone, run ./flash-all.sh from the extracted install folder and wait until it finishes without errors.
From the same folder, flash our public key into avb_custom_key:
```
fastboot erase avb_custom_key
fastboot flash avb_custom_key avb_pkmd.bin
```
Go on only if flashing worked.
Lock:
```
fastboot flashing lock
```
Confirm on the phone with the volume keys and the power button. The phone is wiped and restarts.
From now on the phone shows a yellow notice on every boot: "Your device is loading a different operating system". That is expected for an OS with its own key and a locked bootloader. An orange warning instead means the bootloader is still unlocked. The yellow notice shows the fingerprint of the key the phone boots with. Compare it with ours (SHA-256 of avb_pkmd.bin):
```
65894abf 95040084 e7f27ff8 cb8e0d29
1b04abc2 66103fb8 8cef5e0c 8c8bf161
```
Once the phone boots and you've set it up, turn OEM unlocking off in Settings → System → Developer options.

Lock only when the build and the key match. If the key in avb_custom_key doesn't belong to the build on the phone, a locked phone won't boot. The way back is unlocking again (another wipe), which only works while OEM unlocking is still on. That is why OEM unlocking is turned off last.

Full install steps: install guide.