good to know that there’s a workaround! out of curiosity though, what images does the “restore” part refer too? is it just the stock boot.img? because it looks like I don’t have it on my device since I just flashed the one you’ve posted earlier in the thread and Magisk complains about about the lack of a stock backup. but if it’s just that, then I guess I’ll just get the one packed in the .zip from the Calyx website and follow the rest of the steps properly.
Yes, it just restores the boot partition 
When you reinstall Magisk, I would go the fastboot boot route, makes OTA updates a lot quicker.
There’s also the option in the app to install Magisk to the other slot after an update and before rebooting, but I haven’t tried that yet. Not sure if Android Verified Boot likes a patched boot partition on the first boot after upgrading 
1 Like
that worked just perfect, I’m now rooted on the latest update. thank you for holding my hand through the process (:
2 Likes
This worked great on stock FPOS 
I’ll have to check my backups before trying that on Calyx, but if it works there as well this would speed up OTA updates & rerooting immensely! 
Update: Works great on Calyx as well 
would you be willing to share how to install Magisk and root in CalyxOS using the other slot?
Sure, installation works like it always has:
Just use the Calyx boot.img from the Factory Images instead. I’ve already uploaded patched CalyxOS 3.5.0 & CalxyOS 3.5.1 boot.imges, so you can skip ahead to the 3rd step.
Once an OTA update arrives follow those steps:
- In Magisk press
Uninstall Magisk → “Restore Images” - Install OTA-update and don’t reboot
- In Magisk select
Install and choose “Install to Inactive Slot (Atfer OTA)”, reboot and have fun
As always don’t follow any of those steps without proper backups!!!11
2 Likes
When I install Magisk and root, does the bootloader have to remain unlocked? Or do I just have to unlock the bootloader every time after OTA-updates to reinstall Magisk?
Also, with root and Magisk, will SafetyNet attestation still work?
Yes (AFAIK as magisk changes the boot image it would result in a bootloader integrity check failure when locking the bootloader).
2 Likes
I’ve answered that same question just 12 hours before you asked, please try to use the search function 
You’ll find that answer in the root topic as well: FP4 Root Access is possible, maybe a bit risky - #61 by Aaanze
TL;DR it’s possible, but it’s complicated and by no means reliable. If you depend on SafteyNet for something important, I’d suggest not to use Magisk.
2 Likes
Thanks a lot for all the info. I’ll try to do better with the search function. The thread is very long and both Magisk and bootloader are very common words. But it’s probably best to go through that thread in more detail anyways.
I wish someone would just make a signed rom with root built-in. I don’t get nor do I agree with the notion that having root is inherently less secure. It’s a strawman argument imho, but that’s a discussion for another thread …
Thanks again @hirnsushi (btw I like the username)
1 Like
Additionaly, now that Magisk has been upgraded to version 24 for quite a while introducing noticable changes including zygisk, the modules mentionned in the quoted post are now outdated.
Long story “short” it is still possible to get a SafetyNet pass and a working gpay app with:
Magisk 24 installed
with the following settings:
- Zygisk enabled
- Exclusion List enabled (with google framework, play store, gpay checked)
and the following modules installed:
- GPay SQL Fix
- MagiskHide Props config
- SQLite3 Universal Binaries
- Universal SafetyNet Fix 2.2.1
2 Likes
I’m curious: how are you doing a proper backup?
In the FP2 i’m using TWRP nandroid backups, but for FP4 it’s not yet available due to decryption issue.
For my taste, app by app backup and restore (e.g. Titanium) is quite time-consuming… Thus I’m not yet motivated to play around with Calyx /e/ iodé etc. because I need my FP4 as a daily driver…
I use the built-in SeedVault backup that has made it’s way to upstream Lineage as well. You get asked if you wan’t to restore from that source during first boot, but I haven’t tested that (will do in the coming days), so I can’t vouch for it (yet).
I consider my phone still in “testing mode”, so I only run a subset of the apps I usually would and just back those up manually to the external SD card as well, since I don’t trust SeedVault without having tested it. Having it on an external SD makes (disaster) recovery much faster and I usually have everything going again in a matter of minutes.
I’ve used different backup systems in the past, most recently Neo-Backup, but I consider those backups only a last resort, if possible I install everything fresh and only restore in-app settings backups where available. Much less weird permission issues and other randomness that way 
I tested Seedvault once on the FP2 with LOS and was not very exited😉 it did not back up all apps and I dont know if it would back-up app data like chat history (dont think so) or just e.g. login etc (edit: no not even login credentials, so if at all only the pure app)…
1 Like
All what backed up was restored.
No issues detected.
But it cannot backup all apps and apps data.
But in combination with in app backup functionality, it is 99% enough for me…
1 Like
You are both absolutely right, totally forgot about that 
Sadly SeedVault respects if apps don’t want to be backed up, but those wouldn’t be backed up by Google Cloud Backup either and are often the ones that are problematic to restore when backed up by a 3rd party backup app.
Like @AlphaElwedritsch I have strategies in place for the few apps I care about that don’t support SeedVault backups:
- Firefox (has Firefox Sync)
- K-9 Mail (has settings export, userdata not relevant)
- Signal (has built-in auto backup)
- Syncthing-Fork (has settings export, userdata not relevant)
That’s it for me and with that everything I need is covered. For all other data and to get the backups saved to multiple places (one backup is no backup) I use syncthing-fork.
1 Like
Appdata backups have always been a major pain on android. Even the official google backup does not backup everything. Apps can opt-out of backups and banking and lots of security oriented apps (like authenticators) make use of that. At least Seedvault shows an overview of which apps can and cannot be backed up. So that’s a plus.
Backing up every app and it’s appdata unfortunately requires root access, which is a pain in itself. Again, an argument for root (not being able to backup all own data is definitely less secure, not more).
so… how’s the battery life for you Calyx folks? it seems that my phone likes to run hot, and it drains the battery about twice as fast as it used to on /e/OS (based on Android 11). I’m using all the same apps and settings and everything, and according to the (crippled) battery stats, Android System is the main culprit most of the time.
I noticed it almost immediately after the install and thought that maybe the OS needs to do its thing before settling down, but it’s now been two weeks of me having to carry a charging cable to work.