Manually update rooted Nexus 5 when OTA fails

I’ve been postponing Android updates on my rooted Nexus 5 for quite some time due to consistently getting an error when installing Over-The-Air (OTA) updates. I kept choosing “later” when the update notification popped up. I knew I could manually update the phone through sideloading, as I had done to root it in the first place, but was worried I’d lose all data on the device.

After close to a year of this, I decided to bite the bullet. Yes, a year is way too long a time, especially since the device didn’t receive any security updates anymore. It’s interesting how time flies when you’re putting something off till later.

So, I read up on the latest update procedure and gave it a try. Turns out all data and settings were preserved. The following explains the steps – in hopes of it being useful to others, and for myself next time around.

The issue

When installing OTA updates I was consistently getting a variation of the following error:

E:Invalid command argument
Finding update package...
Opening update package...
Verifying update package...
E:Failed to verify whole-file signature
E:Signature verification failed
Intalling update...
Package expects build fingerprint of google/hammerhead/hammerhead:5.0.1/LRX22C/1602158:user/release-keys or google/hammerhead/hammerhead:5.1/LMY47I/1767468:user/release-keys; this device has google/hammerhead/hammerhead:4.4/KRT16M/893803:user/release-keys
E:Error in /cache/update.zip
(Status 7)

Installation aborted.
Rebooting...

The phone was running Android 5.0 with a custom recovery image (ClockworkMod Recovery). Based on the error message it seems the release keys on the device were not matching the ones the update was expecting. Why it had release keys for Android 4.4 although it was running 5.0, I cannot say.

Sideload update onto device

The following steps require a separate computer with the adb tools installed and available in PATH.

Download the appropriate OTA update image for the device from here. In the current case I am updating to Android 6.0 and will use filenames referencing that image.
Verify the checksum of the image: although the Android update mechanism has validation built-in, verifying the image early saves time in case of corrupted download. The last portion of the filename is the first 8 characters of its SHA256 checksum; the full SHA256 checksum is also shown next to the download link. On Mac OS X, the SHA256 checksum can be easily computed with gsha256sum, which is part of the coreutils Homebrew formula:
```
$ brew install coreutils
# [installing coreutils...]
$ gsha256sum hammerhead-ota-mob30h-672f59e1.zip
672f59e1c1f441df229026ffbc42d4dc125f2548e3e258a07f18d71e1c5974f7  hammerhead-ota-mob30h-672f59e1.zip
# first 8 characters of checksum match against the filename (672f59e1)
# the whole checksum matches the one on website
```
Enable USB debugging on the device by going to Settings > Developer options. Note: Developer options is hidden by default. To make it available, go to Settings > About phone and tap Build number seven times. Return to the previous screen to find Developer options.
With the device powered on, connect it to the computer via USB and execute:
```
$ adb devices
# should find and list the device
```
Reboot into recovery mode by executing:
```
$ adb reboot recovery
```
The device is now in recovery mode and an Android logo with red exclamation mark appears on screen.
Hold power button and press volume-up once, and a menu will appear. Select the option of Apply update from ADB. When using ClockworkMod Recovery, choose Install zip, then Install zip from sideload.

Sideload the image onto the device:

$ adb sideload hammerhead-ota-mob30h-672f59e1.zip

Once the update finishes, reboot the device by choosing Reboot the system now.
When using ClockworkMod Recovery on a rooted phone, it will ask to fix root access. Choose Yes - Root device (/system/xbin/su).
Phone reboots and the bootup animation appears for about 10 mins. Boot process should not be interrupted! After that Android might optimize the installed apps.
The device is now updated.

For increased device security USB debugging should be disabled after finishing the update procedure.

Optional: install TWRP

There are a couple of more advanced and feature-complete alternatives to the default Android recovery image. The most common ones are TWRP and ClockworkMod Recovery (CWM Recovery). The following will install TWRP onto the device.

Download the appropriate TWRP from here.
Reboot into the bootloader:
```
$ adb reboot bootloader
```

Flash recovery image onto device:

$ fastboot flash recovery twrp-3.0.2-0-hammerhead.img

Choose Recovery with the volume keys and press power in order to boot into the new recovery image. This must be done directly after flashing (without reboot) since the stock Android ROM reverts to the default recovery image upon bootup:

Note: many devices will replace your custom recovery automatically during first boot. To prevent this, use Google to find the proper key combo to enter recovery. After typing fastboot reboot, hold the key combo and boot to TWRP. Once TWRP is booted, TWRP will patch the stock ROM to prevent the stock ROM from replacing TWRP. If you don’t follow this step, you will have to repeat the install.
Swipe the slider to patch the stock ROM and make TWRP the default recovery image.
Reboot.

Optional: root the device

It seems the device loses root when following the steps above. Not sure why that happens – whether it’s because of the update itself or because of flashing the recovery. The following steps root the device.

Download latest SuperSU from here.
Enter TWRP recovery (press and hold volume down + power, select Recovery).
Do not let TWRP install SuperSU!

Sideload the SuperSU archive downloaded previously:

$ adb sideload UPDATE-SuperSU-v2.65-20151226141550.zip

Reboot might be slow and loop a couple of times. Do not interrupt it!

The device should now be rooted.

Optional: restore GSM/3G

Despite all of the above steps having completed successfully, the updated device could not connect to GSM/3G. It did not even show an IMEI number in the About phone screen. Turns out it needed re-flashing of the radio image. Not sure whether the radio image is excluded in a sideloaded update or whether there was an issue in the update process.

The following steps flashes the radio image to restore GSM/3G functionality.

Unpack the OTA update image downloaded previously:

$ unzip -d unpacked hammerhead-ota-mob30h-672f59e1.zip
$ cd unpacked

Reboot into the bootloader:
```
$ adb reboot bootloader
```
Flash the radio image onto device:
```
$ fastboot flash radio radio.img
```
Reboot.

The device should now register to GSM and 3G.