"Play Protect Certification" says my bootloader is unlocked when it isn't

EndoPlant

Hi there,

I've been a happy GrapheneOS user for 2-ish years on my pixel 7 pro. I've run into an issue where an app in the google play store "Root Board Game" says "This app won't work for your device" when searched. When I check the google play store settings, it says "Device is not certified", which I assume is related. When I click "Fix device issue" it claims my bootloader is unlocked. It isn't, I relocked it when I initially installed GrapheneOS as the instructions tell you to, and double checked just now using fastboot tools which returned: "unlocked: no".

I've tried clearing cache for google play store and services, rebooting device, all without any change.

All my other apps including banking apps work fine.

I'm on GrapheneOS version 2025040400

Does anyone know of a workaround/fix for this? I'd like to be able to use that app if possible.

Thanks in advance.

Watermelon

EndoPlant dregrinfuces This issue isn't caused by anything faulty on your devices, nor by Google Play being sandboxed. It happens because Google doesn't want GrapheneOS devices with a locked bootloader to pass Play Protect certification because they're not preinstalling Google Play on the OS with invasive access. Even if it didn't have invasive access, Google Play is still proprietary, and GrapheneOS is an open source project. And they still want their OS to be minimal out of the box it seems, so they let users who want to avoid Google Play avoid it by not installing it, giving us choice :)

Google Play is lying to you that your devices have an unlocked bootloader. It can be easily tested for by any app. Any app can see that the bootloader is locked with a custom verified boot key installed.

There's no workaround to fix this. Google needs to stop banning GrapheneOS users with a locked bootloader, and app developers need to stop using Play Integrity.

To the OP I'd suggest sending the developers of the app a letter by email sticking to my suggestions here:
https://discuss.grapheneos.org/d/20117-i-cant-install-a-critical-health/7
And I'd love to hear if it helped!

dregrinfuces

I'll just chime in that I was looking at the Google Play Store on my Pixel 9a and, just like you, it says the device isn't certified and that the bootloader is unlocked. But, it IS locked. I wonder if this is just an artifact of the Play Store being sandboxed.