Starting with a Secure Operating System

Todo

Insert introductory text.

CalyxOS

If you want an operating system focused on privacy and security, but don’t want to go through the hassle of installing and configuring it yourself from scratch, just get a CalyxOS Membership from the Calyx Institute.

GrapheneOS

The Google Pixel phones are regarded as being the most secure smart phones on the market. If you have one, or you don’t mind buying one, then you’ll want to install GrapheneOS, which can only be installed on Pixel devices.

LineageOS

If you don’t want to give Google another dime, then LineageOS is the way to go.

Work in Progress

Still working through the details here.

Check the list of their supported devices to ensure your phone is supported, or to ensure you purchase one that is. In my case, I went with a Motorola Edge 20.
Start going through the installation instructions.

Note

I was unable to get this to work on Fedora, but the documentation suggests trying another machine/OS. I tried running an Ubuntu virtual machine (VM) on top of my Fedora host, but no luck there either. I was finally able to get it to work on a different machine running Ubuntu as the host OS.
1. Follow the linked instructions for installing adb and fastboot on Linux.
2. Then set up adb.
3. And set up fastboot.
Return to the installation instructions, and ensure you’ve met all the basic requirements.
Move on to ensuring you have the correct firmware version.
Next unlock the bootloader.
1. Go to the phone’s Settings → System → Developer options and turn on OEM unlocking. (This option may not become available for a few days after enabling developer mode.)
2. Pull up the instructions at Motorola Support.
3. Read through everything and click Proceed Anyway.
4. Follow the instructions to get the Device ID. When you paste it into the field on the page, make sure there aren’t any extraneous characters (e.g., whitespace), and then click Can my device be unlocked?
5. Scroll down, agree to the terms, and click Request Unlock Key, and you should receive an email with the key.
  Note
  
  If the Motorola Support site is being flaky in step (d) when you try to paste your Device ID to see if it’s unlockable, here’s a workaround: The Device ID is separated into four parts with # characters. Navigate to the following URL, pasting in the corresponding parts (without the # characters).
  https://en-us.support.motorola.com/cc/productRegistration/unlockPhone/<part 1>/<part 4>/<part 3>
  That will trigger the email with your unlock key.
6. Follow the intructions to use the key to unlock the bootloader.
7. After the bootloader is unlocked, start the phone and it’ll be wiped. That means you’ll need to set it up again from scratch (e.g., connect to WiFi and enable developer mode).