From 8ea08ef98c551069a2da2b5b21ad7dfe15d69235 Mon Sep 17 00:00:00 2001
From: Andrew Gunnerson <accounts+github@chiller3.com>
Date: Thu, 7 Aug 2025 23:10:24 -0400
Subject: [PATCH] cli/avb: Warn when verifying image with insecure flags

Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
---
 avbroot/src/cli/avb.rs | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/avbroot/src/cli/avb.rs b/avbroot/src/cli/avb.rs
index 1f74ea0..b136066 100644
--- a/avbroot/src/cli/avb.rs
+++ b/avbroot/src/cli/avb.rs
@@ -463,6 +463,10 @@ pub fn verify_headers(
         info!("{name} has an unsigned vbmeta header");
     }
 
+    if header.flags != 0 {
+        warn!("{name} has insecure flags: {:#x}", header.flags);
+    }
+
     for descriptor in &header.descriptors {
         let Some(target_name) = descriptor.partition_name() else {
             continue;