Without workarounds, the bootloader can no longer be locked again after returning to stock from a custom ROM, or when switching from one custom ROM to another. I was able to verify this issue with the latest 15.1 bootloaders; 15.0 and prior bootloaders, on the other hand, are not affected. Specific versions are referenced below.
There is apparently a problem with the way boot.img is flashed in relation to AVB. See Workarounds and steps to reproduce for details of this.
Impact
Affected devices
Pixel 6a (verified)
Pixel 8a (verified)
I suspect all supported Google Pixel devices
Affected source custom ROMs, as tested
If coming from any of these ROMs (and perhaps others), and going to an affected destination release, you will not be able to lock the bootloader without workarounds:
Steps to reproduce for troubleshooting or testing:
Have boot.img files available from different ROMs - one from stock, one from something else.
For stock, the boot.img is inside the .zip file that starts with "image-" inside the factory zip.
To obtain a boot.img from another ROM, you can extract and flash a boot image from a /e/OS/'s recovery zip files for example (Pixel 6a, Pixel 8a).
Update an affected device to an affected release (just install the latest public stock Android), and unlock the bootloader if it's not already (fastboot flashing unlock).
Run commands.
fastboot flash boot stock/boot.img
fastboot flashing lock # should succeed. no need to lock
fastboot flashing unlock # if you locked above
fastboot flash boot custom_os/boot.img
fastboot flashing lock # (optional) as expected, should fail with "invalid android images"
fastboot flash boot stock/boot.img # back to stock's boot.img, which locked fine before
fastboot flashing lock # with QPR1 bootloader, still fails, and keeps failing!
Real-world steps to reproduce
Install a custom ROM like GrapheneOS on a Pixel 6a or Pixel 8a (or probably any Pixel) using their factory zip. Try to lock the bootloader to confirm it doesn't show an error (run fastboot flashing lock), but you do not need to lock it.
(Optional) Boot into the custom ROM and use it. Not necessary for reproduction.
Try to lock the bootloader (fastboot flashing lock).
Receive error invalid android images, skip locking. This also happens if you try to install another custom ROM using fastboot, e.g. CalyxOS.
Workarounds
Workaround 1
Flash a 15.0 bootloader and reboot into it. Then, flash boot.img again, and locking will work. Before locking, you can flash the 15.1 bootloader if you'd like, reboot into it, and then lock.
fastboot flash bootloader bootloader-bluejay-bluejay-15.0-11921129.img
fastboot reboot bootloader
fastboot flash boot boot.img
# flashing back to the newer bootloader is optional but works
fastboot flash bootloader bootloader-bluejay-bluejay-15.1-12292109.img
fastboot reboot bootloader
fastboot flashing lock
Workaround 2
Flash boot.img yet again in userspace fastboot. Unsure why this helps.
Description
Brief description
Without workarounds, the bootloader can no longer be locked again after returning to stock from a custom ROM, or when switching from one custom ROM to another. I was able to verify this issue with the latest 15.1 bootloaders; 15.0 and prior bootloaders, on the other hand, are not affected. Specific versions are referenced below.
There is apparently a problem with the way boot.img is flashed in relation to AVB. See Workarounds and steps to reproduce for details of this.
Impact
Affected devices
Affected source custom ROMs, as tested
If coming from any of these ROMs (and perhaps others), and going to an affected destination release, you will not be able to lock the bootloader without workarounds:
Unaffected source custom ROMs, as tested
If coming from any of these ROMs (and perhaps others), and going to an affected destination release, locking will still work fine:
Affected bootloaders / destination releases, as tested
Unaffected bootloaders / destination releases, as tested
Affected flash methods
Unaffected flash methods
Steps to reproduce for troubleshooting or testing:
fastboot flashing unlock).Real-world steps to reproduce
fastboot flashing lock), but you do not need to lock it.fastboot flashing lock).invalid android images, skip locking. This also happens if you try to install another custom ROM using fastboot, e.g. CalyxOS.Workarounds
Workaround 1
Flash a 15.0 bootloader and reboot into it. Then, flash boot.img again, and locking will work. Before locking, you can flash the 15.1 bootloader if you'd like, reboot into it, and then lock.
Workaround 2
Flash boot.img yet again in userspace fastboot. Unsure why this helps.
Workaround 3
flash bootline afterupdate-super.Further info
Downstream issue for CalyxOS:https://gitlab.com/CalyxOS/calyxos/-/issues/2907