Database Develop

Stock recovery and upgrading Lollipop with future OTAs after rooting

Hello everyone,
I'm back to a nexus 6 after a very short stint with a 6+.
A little background for my questions: This is the very first time that I rooted a phone. I'm rooting to only install these 3 apps:
adaway
titanium backup
greenify
I do not plan on using any custom ROMs or kernels.
I see from all the guides and tutorials that people also create a custom recovery whenever they root. I haven't done that yet and wasn't sure if I had to. I would like to maintain the stock recovery that I have currently so that I can go back to stock if I unRoot. My questions are:
1. Am I wrong in thinking that I can still use the stock recovery if I unRoot?
2. When a new OTA comes out and I flash it (since I'm rooted an no longer can install them automatically), will that also upgrade my still stock recovery properly?
3. Following up on the previous question, when I upgrade manually because I'm rooted, would that be a fresh install where I have to go in and configure things the way I like them again (system settings, apps and their settings, root the phone again, etc)?
Thanks in advance!

LordGrahf said:
Hello everyone,
I'm back to a nexus 6 after a very short stint with a 6+.
A little background for my questions: This is the very first time that I rooted a phone. I'm rooting to only install these 3 apps:
adaway
titanium backup
greenify
I do not plan on using any custom ROMs or kernels.
I see from all the guides and tutorials that people also create a custom recovery whenever they root. I haven't done that yet and wasn't sure if I had to. I would like to maintain the stock recovery that I have currently so that I can go back to stock if I unRoot. My questions are:
1. Am I wrong in thinking that I can still use the stock recovery if I unRoot?
2. When a new OTA comes out and I flash it (since I'm rooted an no longer can install them automatically), will that also upgrade my still stock recovery properly?
3. Following up on the previous question, when I upgrade manually because I'm rooted, would that be a fresh install where I have to go in and configure things the way I like them again (system settings, apps and their settings, root the phone again, etc)?
Thanks in advance!
Click to expand...
Click to collapse
1. No, you're not wrong. Recovery will stay stock and can be used normally
2. You can't simply flash the new OTA. This will not work manually nor automatically.
3. All you need to do is not flash the user data image and you will not loose your data, settings etc. You will loose root however. See bellow.
Google posts android stock images for each device typically before OTA hits your phone. That's what you want to grab and use for the update. Just make sure you don't run the automatic scripts that come with those images because you need to avoid flashing user data image.
OTA zip file does you no good unless you get your system back to unmodified stock.

Thank you sir!

obsanity said:
1. No, you're not wrong. Recovery will stay stock and can be used normally
2. You can't simply flash the new OTA. This will not work manually nor automatically.
3. All you need to do is not flash the user data image and you will not loose your data, settings etc. You will loose root however. See bellow.
Google posts android stock images for each device typically before OTA hits your phone. That's what you want to grab and use for the update. Just make sure you don't run the automatic scripts that come with those images because you need to avoid flashing user data image.
OTA zip file does you no good unless you get your system back to unmodified stock.
Click to expand...
Click to collapse
Based on the OP, it sounds like he has only rooted. Thus, the OTA will work fine. No need to flash image files.
Edit: I see that at least one other member has stated that an unroot still did not allow OTAs to function. That's a bit strange and unique. Not sure what root is modifying to prevent the OTA.

I'm kinda curious myself. I had no idea root killed OTA's. Maybe I wouldn't have done that if I knew that. I'm very new to the Nexus device. It's my 1st. I unlocked the bootloader and rooted already.
Sent from Mark's Nexus 6

crowbarman said:
Edit: I see that at least one other member has stated that an unroot still did not allow OTAs to function. That's a bit strange and unique. Not sure what root is modifying to prevent the OTA.
Click to expand...
Click to collapse
This is pretty scary. So you can unroot and GI back to stock and still can't update in anyway?

I have always side-loaded OTAs, I have never flashed anything.
After installing an OTA, on the next reboot, Android takes some time to optimize all your apps. Does this also happen after flashing a new system image? Thanks!

LordGrahf said:
This is pretty scary. So you can unroot and GI back to stock and still can't update in anyway?
Click to expand...
Click to collapse
not sure what you mean by GI, but according to some others, after uninstalling root via SuperSU an OTA will still not install. This should not be the case unless the boot or recovery images are modified. Easily fixed by following the procedures above to fastboot the stock images on your phone.
kjnangre said:
I have always side-loaded OTAs, I have never flashed anything.
After installing an OTA, on the next reboot, Android takes some time to optimize all your apps. Does this also happen after flashing a new system image? Thanks!
Click to expand...
Click to collapse
Yes, it behaves exactly the same.

crowbarman said:
Based on the OP, it sounds like he has only rooted. Thus, the OTA will work fine. No need to flash image files.
Edit: I see that at least one other member has stated that an unroot still did not allow OTAs to function. That's a bit strange and unique. Not sure what root is modifying to prevent the OTA.
Click to expand...
Click to collapse
Root on Lollipop is not what it used to be. There are files that need to be modified in order to allow root. That's why this time OTA will fail if you are rooted.
Un-rooting however, will allow OTA as long as it is done properly and all traces are covered up and returned to stock. If it does fail after you have un-rooted, go back to the developer of that un-root method and let the know they missed something.
Here is the best way to un-root. Flash all of the old stock images besides user data image.

obsanity said:
Root on Lollipop is not what it used to be. There are files that need to be modified in order to allow root. That's why this time OTA will fail if you are rooted.
Un-rooting however, will allow OTA as long as it is done properly and all traces are covered up and returned to stock. If it does fail after you have un-rooted, go back to the developer of that un-root method and let the know they missed something.
Here is the best way to un-root. Flash all of the old stock images besides user data image.
Click to expand...
Click to collapse
That makes sense. Is there a manual root procedure or list of required modifications for root out there? I did some precursors searches but Came up empty. Can't tell what's missing in SuperSU unroot without those details.

crowbarman said:
That makes sense. Is there a manual root procedure or list of required modifications for root out there? I did some precursors searches but Came up empty. Can't tell what's missing in SuperSU unroot without those details.
Click to expand...
Click to collapse
Explanation from Chainfire:
https://plus.google.com/113517319477420052449/posts/S5zoKTzKUW1

obsanity said:
Explanation from Chainfire:
https://plus.google.com/113517319477420052449/posts/S5zoKTzKUW1
Click to expand...
Click to collapse
Thanks for this. A good read, but I'm surprised nobody has demanded more details than 'patched the policies in SELinux'. Not that I don't trust Chain fire (I do) , but who really knows what has been done to our phones?

crowbarman said:
Thanks for this. A good read, but I'm surprised nobody has demanded more details than 'patched the policies in SELinux'. Not that I don't trust Chain fire (I do) , but who really knows what has been done to our phones?
Click to expand...
Click to collapse
That's the problem with Chainfire's work... he does not release source.
Again, best un-root method is to flash original images less user data.

obsanity said:
That's the problem with Chainfire's work... he does not release source.
Again, best un-root method is to flash original images less user data.
Click to expand...
Click to collapse
Thanks for sharing this info. Its a bit concerning tbh. Is there a cleaner way to root other than using superSU?

LordGrahf said:
Thanks for sharing this info. Its a bit concerning tbh. Is there a cleaner way to root other than using superSU?
Click to expand...
Click to collapse
I'm afraid not but Chainfire's is probably the cleanest possible. Koush was the one with an open source solution but he hasn't updated his to 5.0 yet.

obsanity said:
I'm afraid not but Chainfire's is probably the cleanest possible. Koush was the one with an open source solution but he hasn't updated his to 5.0 yet.
Click to expand...
Click to collapse
There is an argument that publishing the method would allow Google to close it that much quicker, I suppose.

crowbarman said:
Thanks for this. A good read, but I'm surprised nobody has demanded more details than 'patched the policies in SELinux'. Not that I don't trust Chain fire (I do) , but who really knows what has been done to our phones?
Click to expand...
Click to collapse
The base changes and reasoning for those changes are actually documented on my website. Specific policy adjustments are present in plain text in the supolicy executable, as any hex editor will show you. Those who really wanted to know rather than whine about OSS, know.
By far most policy adjustments just drop audit log output for contexts that are already permissive, though.
All that information is still completely useless unless you understand SELinux in detail and how it's implemented on Android, though.

I assume that the encryption doesn't get in the way of being able to flash the images?
When I went from 5.0 to 5.0.1 on my old Nexus 5 all I did was flash the two new 5.0.1 images I extracted from the full factory image, then re-rooted. This is far cleaner than reverting back to the previous image then doing an OTA. I've not had to update my N6 yet so I don't know if my method will work still, but I hope it does.

Chainfire said:
The base changes and reasoning for those changes are actually documented on my website. Specific policy adjustments are present in plain text in the supolicy executable, as any hex editor will show you. Those who really wanted to know rather than whine about OSS, know.
By far most policy adjustments just drop audit log output for contexts that are already permissive, though.
All that information is still completely useless unless you understand SELinux in detail and how it's implemented on Android, though.
Click to expand...
Click to collapse
Thanks for the additional information.
I did spend a fair amount of time reading your documentation but failed to utilize a hex editor. I am not 'whining' about the lack of open source, rather, simply mildly surprised, but your website aptly describes the challenges with 5.0. Many are used to various root methods being available.
Your solution is fine with me.. I love your work.
Edit: I thought I'd add that the discussion has devolved from the OP, which was whether an OTA can be applied after uninstalling root. The answer was no, due to the unknowns about what still might be modified following the uninstall via SuperSU.

Updating after root

Forgive me if this has been asked before. I did search, but I couldn't seem to find an answer to this.
I have a dev edition model. I really want to root, but have been holding off because there are bugs with the current build of Lollipop and I'm kind of hoping Moto will release a 5.02 update soon to kill the memory leak and other issues. That being said, I have really been itching for root.
If I did root, what would I have to do to this phone to update it to the new version? Would I have to completely return to stock and wipe? Or could I ADB sideload? Seems like I was reading that you can't update at all when you're rooted, even if you disable root.
Without any idea how much longer it'll be before the next update, I'm finding it harder and harder to hold off on root, but I don't want to go through hell to get it back to stock and update it.
Thanks for any help and sorry if this has already been asked.

From what I understand, root is fine. It is installing a custom recovery that will stop you from getting the OTA. You can very easily undo root. As a matter if fact, you can pretty easily reinstall the stock recovery also.

diggitydogg said:
From what I understand, root is fine. It is installing a custom recovery that will stop you from getting the OTA. You can very easily undo root. As a matter if fact, you can pretty easily reinstall the stock recovery also.
Click to expand...
Click to collapse
Thanks for the reply.
Most of the time, that's true. I have updated a lot of phones by simply unrooting, applying the update, and rooting again, or using ADB sideload and then just rooting. But from what I have been reading about the Moto X 2014, you have to completely restore it back to stock before doing anything, even if you just use the temp boot method to root.
Is that wrong? I can't seem to find any info that confirms either way.

I've installed custom recovery, how can I reverse it and install the original recovery for update?

One advantage of root is you'll have Titanium Backup, so even if you do have to do a full wipe before applying the update, you could just update it and restore everything back quickly using TiBu. With lollipop, apparently the update file checks for the entire system checksum as a whole instead of each file so any slight modification to the system will mostly require pure stock and this is the same even with the nexus. So yeah, you most likely have to wipe your device before updating. I'd say, wait till Xposed for Lollipop is out, its almost there, once it comes out go ahead and root it, it'll at least be worth the hassle then

If you're rooted with lollipop and want to take an OTA update you can flash stock recovery and the stock system image. At that point you should still have all apps/data and be able to take a OTA update. The recovery and system files should be the exact version you already have and of course anytime you flash realize you could lose data!

Steve-x said:
If you're rooted with lollipop and want to take an OTA update you can flash stock recovery and the stock system image. At that point you should still have all apps/data and be able to take a OTA update. The recovery and system files should be the exact version you already have and of course anytime you flash realize you could lose data!
Click to expand...
Click to collapse
Right. All you need to do is flash the stock /system partition and also the recovery if you replaced it. I don't know why everyone's talking about having to wipe the entire phone with the all the stock images.

How to install monthly Nexus security firmware updates without starting over?

Usually when a new Android OS version is released, I'll just start over from scratch by manually flashing the seven image files using fastboot. I then install the unencrypt kernel/boot image and also root.
Now that these security updates are coming out every month, is there an easier way in my specific situation to install the update only without having to start from scratch every time like above?

Flash the system image only (if radio is different, flash that too). That won't overwrite your user data/apps
Edit: When flashing the system.img, flash the cache.img as well (to be safe)

Thanks. That is pretty simple. I wish I asked this a long time ago so I could avoided a lot of resetting EVERYTHING up all the time. 2 more clarifications if you don't mind...
1) Would this also work for point releases, like say if a 5.1.2 comes out, or would it be better to reflash everything in that case?
2) No other steps like clear cache or anything? Just flash those 2, reboot, and then I should be good to go?

Toaplan said:
Thanks. That is pretty simple. I wish I asked this a long time ago so I could avoided a lot of resetting EVERYTHING up all the time. 2 more clarifications if you don't mind...
1) Would this also work for point releases, like say if a 5.1.2 comes out, or would it be better to reflash everything in that case?
2) No other steps like clear cache or anything? Just flash those 2, reboot, and then I should be good to go?
Click to expand...
Click to collapse
It should work just fine for point releases. For major releases (like when Android M is released), I will probably flash everything, and wipe everything (including userdata), and start from scratch ! lol!
In theory, it should work find even for major releases, but I'd rather start with a clean slate - especially with the new permissions manager that is being added in this release. I'd rather not take any old incompatible apps thru' - but that's just me
Clearing cache is usually not needed. I've heard of instances where some users get stuck on the Google boot logo for some reason when booting for the first time. If that happens, clearing cache seems to help.
To be safe, it may be a good idea to flash the cache.img too. It takes a few seconds. Better safe than sorry. I'll update my earlier post.

jj14 said:
...
Click to expand...
Click to collapse
Huge thanks. This should make things a lot easier for me.

Is this the system update that just got pushed to my phone? It looks like a small update, like 26MB?
Mine tried to install and failed. My phone is stock, latest official version, never rooted, but the bootloader is unlocked and it is running the no force encrypt kernel, which I believe is probably what is causing the issue?
Only way is to restore completely to stock, take the OTA and then install the no decrypt?

I got the OTA today to upgrade to M from L- (on verizon) where can I Find that system image to flash- I tried sideloading the OTA and it didn't take.

caecusscius said:
I got the OTA today to upgrade to M from L- (on verizon) where can I Find that system image to flash- I tried sideloading the OTA and it didn't take.
Click to expand...
Click to collapse
https://developers.google.com/android/nexus/images

SquireSCA said:
Is this the system update that just got pushed to my phone? It looks like a small update, like 26MB?
Mine tried to install and failed. My phone is stock, latest official version, never rooted, but the bootloader is unlocked and it is running the no force encrypt kernel, which I believe is probably what is causing the issue?
Only way is to restore completely to stock, take the OTA and then install the no decrypt?
Click to expand...
Click to collapse
I believe it's actually both of these things causing the OTA not to take. If anything, anything is changed from stock...no OTA. Bootloader unlocked, kernel, root, even just changing the build.prop (but you need root for that) would cause it to fail. I believe it checks every file and if anything in /system has changed, no OTA.
I've never messed around with the encryption pieces, but I'm wondering if you only flash the system.img (you'd need to re-root) if that would suffice or not as far as the update. You'd be flashing the entire system file instead of only the delta the OTA provides, but it's probably worth looking into.

Hmmm... Well, it takes 15 minutes to just wipe the phone and flash the new ROM with the toolkit, install my apps, copy my files over and set the phone up, so it isn't a big deal, I just want to make sure that I have the right version before I do that...
(LMY48M) That's the one that I want for the VZW N6, right?

I just use helium to backup my apps and everything. Even if I need to wipe it is a pretty easy restore process. I highly recommend helium backup.

hayzooos said:
I believe it's actually both of these things causing the OTA not to take. If anything, anything is changed from stock...no OTA. Bootloader unlocked, kernel, root, even just changing the build.prop (but you need root for that) would cause it to fail. I believe it checks every file and if anything in /system has changed, no OTA.
I've never messed around with the encryption pieces, but I'm wondering if you only flash the system.img (you'd need to re-root) if that would suffice or not as far as the update. You'd be flashing the entire system file instead of only the delta the OTA provides, but it's probably worth looking into.
Click to expand...
Click to collapse
Unlocked bootloader doesn't affect it, the customised kernel does though . But yes, you could just flash the system.img

One-time temp TWRP boot to install SuperSU

I think I already know the answer, but with a £550 device I'd rather double-check with the experts.
Is there any reason that I should not boot temporarily to TWRP to install SuperSU 2.62 ("fastboot boot twrp.img")? I don't believe that a permanent TWRP installation is a necessity, and if I understand Chainfire's comment correctly:
http://forum.xda-developers.com/apps/supersu/chainfire-systemless-root-android-6-0-t3271137
leaving the device as stock as possible, including stock recovery, means an easier upgrade path for OTAs. The best of both worlds - regular OTA security updates plus root.
Any reason that this would not work, and more importantly any reason that it might risk the integrity of my N6? I don't want an expensive paperweight...
Thanks...

dahawthorne said:
I think I already know the answer, but with a £550 device I'd rather double-check with the experts.
Is there any reason that I should not boot temporarily to TWRP to install SuperSU 2.62 ("fastboot boot twrp.img")? I don't believe that a permanent TWRP installation is a necessity, and if I understand Chainfire's comment correctly:
http://forum.xda-developers.com/apps/supersu/chainfire-systemless-root-android-6-0-t3271137
leaving the device as stock as possible, including stock recovery, means an easier upgrade path for OTAs. The best of both worlds - regular OTA security updates plus root.
Any reason that this would not work, and more importantly any reason that it might risk the integrity of my N6? I don't want an expensive paperweight...
Thanks...
Click to expand...
Click to collapse
having root = no ota, so having twrp is besides the point. anyways, twrp is one of the mist useful tools to have if you mod your device. you can make, and restore, a nandroid backup. if you make a mod, and it messes up, you probably wont noot anymore, but a nandtoid backup restored will bring your device back to how it was.

Yes, thanks, Simms, I get all that, but it's not really answering my question. Is there any problem with using temporary TWRP to install SuperSU?
Also if you read Chainfire's comment he makes it clear that his systemless root doesn't prevent OTA, whereas having a non-stock recovery might.

dahawthorne said:
I think I already know the answer, but with a £550 device I'd rather double-check with the experts.
Is there any reason that I should not boot temporarily to TWRP to install SuperSU 2.62 ("fastboot boot twrp.img")? I don't believe that a permanent TWRP installation is a necessity, and if I understand Chainfire's comment correctly:
http://forum.xda-developers.com/apps/supersu/chainfire-systemless-root-android-6-0-t3271137
leaving the device as stock as possible, including stock recovery, means an easier upgrade path for OTAs. The best of both worlds - regular OTA security updates plus root.
Any reason that this would not work, and more importantly any reason that it might risk the integrity of my N6? I don't want an expensive paperweight...
Thanks...
Click to expand...
Click to collapse
Don't usually encourage use of toolkits but Wug's toolkit includes and option to do this kind of one time boot, I don't know off the top of my head what actual process it uses for that or I'd just tell you that. But yea I'd just recommend leaving TWRP on and after first flashing it and booting into it twrp should prompt you something along the lines of keeping /system mounted as read-only, do that and make a backup including the "system image" and boot. Then in Advanced>uncheck "mount system as read-only."
Whenever an ota rolls around you can go back into twrp and restore that boot and system-image backup when you boot up android will replace twrp with stock recovery and the ota should work.

Thanks again - I appreciate the answer, but again it doesn't really answer my question. I've been using TWRP for years and I'm well aware of its benefits. What I want to know if there's any problem with using it as a one-off to install SuperSU, leaving stock recovery in place when I reboot so that TWRP can't interfere with the OTA.
I'm also very well aware of NRT, which again I've used for years and have donated to several times (excellent program), but I don't need it when "fastboot boot recovery twrp.img" will do the job faster.
Am I not explaining myself properly?

dahawthorne said:
Thanks again - I appreciate the answer, but again it doesn't really answer my question. I've been using TWRP for years and I'm well aware of its benefits. What I want to know if there's any problem with using it as a one-off to install SuperSU, leaving stock recovery in place when I reboot so that TWRP can't interfere with the OTA.
I'm also very well aware of NRT, which again I've used for years and have donated to several times (excellent program), but I don't need it when "fastboot boot recovery twrp.img" will do the job faster.
Am I not explaining myself properly?
Click to expand...
Click to collapse
nah there should be no problem with that.

theres no issue with it, just keep your bootloader unlocked, or you can have issues in the future. btw..
fastboot boot recovery recoveryname.img as opposed to fastboot flash

Thanks, both - I appreciate the help.

Just in case anyone might find the confirmation useful, yes, it did work. I used "fastboot boot twrp.img" to install SuperSU 2.62-3 and it's all working fine. If I understand Chainfore correctly in the link quoted above, using SuperSU's "full unroot" will allow the next OTA, then I can repeat the fastboot install, which should be far simpler than overwriting the system.img.

why would you want an OTA? this is XDA Developers, the worst ROM here is better than ANY OTA that you can have, plus you get it sooner and can try them all and have a backup of your favorite one. This sort of thing always makes me laugh!

I am glad to have brought some laughter and joy into your life. Though I hope that you can find better in your real life, right...?

buschris said:
why would you want an OTA? this is XDA Developers, the worst ROM here is better than ANY OTA that you can have, plus you get it sooner and can try them all and have a backup of your favorite one. This sort of thing always makes me laugh!
Click to expand...
Click to collapse
For noobs, Android Pay is one reason they may want to stick with factory stock with OTA capabilities. Systemless root is not easy for noobs to grasp.

question about maintaining root

So far I've been running my OP3T with stock rom with TWRP recovery and SuperSU to have root. This was mostly because I wanted the Adaway and titanium backup to work. I undid everything so I could update to the latest OxygenOS version, and now I'm on the stock recovery too, but with bootloader still unlocked I believe. I no longer have root after doing the upgrade as far as I can tell, still a bit new to all this flashing, haha. The last time I did this was when the nexus 4 came out
What is the best option for maintaining root while still being able to upgrade smoothly? I'm not against using one of the custom ROMs if that will help, but I do kinda like the stock rom so far!
thanks!

bluesrph said:
So far I've been running my OP3T with stock rom with TWRP recovery and SuperSU to have root. This was mostly because I wanted the Adaway and titanium backup to work. I undid everything so I could update to the latest OxygenOS version, and now I'm on the stock recovery too, but with bootloader still unlocked I believe. I no longer have root after doing the upgrade as far as I can tell, still a bit new to all this flashing, haha. The last time I did this was when the nexus 4 came out
What is the best option for maintaining root while still being able to upgrade smoothly? I'm not against using one of the custom ROMs if that will help, but I do kinda like the stock rom so far!
thanks!
Click to expand...
Click to collapse
This thread should answer all your questions and doubts
https://forums.oneplus.net/threads/...-or-custom-recovery-without-data-loss.479265/

saurabh40629 said:
This thread should answer all your questions and doubts
https://forums.oneplus.net/threads/...-or-custom-recovery-without-data-loss.479265/
Click to expand...
Click to collapse
Thank you, I have seen that post. I'm guessing any route I go I'll have to flash updates then? I was hoping to find a way to be able to use OTA updates.
I've also never been able to get rid of the dm-verity error, even after going back to stock and locking the bootloader. Is there anything I need to worry about with that or is it just an annoyance?
Sent from my OnePlus3T using XDA Labs

bluesrph said:
Thank you, I have seen that post. I'm guessing any route I go I'll have to flash updates then? I was hoping to find a way to be able to use OTA updates.
I've also never been able to get rid of the dm-verity error, even after going back to stock and locking the bootloader. Is there anything I need to worry about with that or is it just an annoyance?
Click to expand...
Click to collapse
Dm-verity u can bypass but bootloader one, you can not. Look at the apps, mods section.

bluesrph said:
Thank you, I have seen that post. I'm guessing any route I go I'll have to flash updates then? I was hoping to find a way to be able to use OTA updates.
I've also never been able to get rid of the dm-verity error, even after going back to stock and locking the bootloader. Is there anything I need to worry about with that or is it just an annoyance?
Sent from my OnePlus3T using XDA Labs
Click to expand...
Click to collapse
You shouldn't try to flash the partial OTAs while you are rooted and have a custom recovery installed. The partial zip will try to make specific changes in the restricted partitions (/system, /boot, /recovery, etc.) related to the update and prior modifications to these files may cause the update to fail and the phone to brick. You can still use the "Update" tab in the Settings menu to download the update though as OOS will detect root and download the full zip of the update for you. Simply flash the full zip in TWRP, wipe cache/dalvik, then flash SuperSU and you're good to go the next time an update rolls out. Updating by this method (rooting immedately after flashing update) will also prevent OOS from replacing TWRP with the stock recovery again. When you download the update, you'll know if it's the full zip if the file is >1 GB (they're usually ~1.4 GB,, whereas the partial zips are a few hundred MB).
Unlocked bootloader warning screen is cannot be removed without relocked and fully resetting (wiping) the phone. DM-verity warning screen can be removed by following this guide. Make sure that you are flashing the correct firmware for you current version of OOS though, flashing the wrong version can brick you phone.