This helps guard against future directory structure changes. So far,
this has remained the same across Magisk versions 22 through 25.2.
The check can be overridden with `--ignore-magisk-version`.
Issue: #37
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
There are no interdependencies across different boot images, so run the
patches in parallel. It only saves a few seconds, but it's a free
optimization.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This commit reimplements the magiskboot patching process natively in
Python. By doing so, avbroot gains cross platform support and there's no
longer a need to execute an Android binary on a non-Android Linux system,
which had pitfalls that already had to be worked around.
Boot images and cpio archives are handled by new custom parsers added to
avbroot. Legacy lz4 compression is done by a wrapper around the python
lz4 library (a new dependency). Gzip compression is handled natively by
python. Other compression methods and OEM-specific boot image formats
are not supported because devices that use the modern Android A/B OTA
scheme do not use those.
Output files are still bit-for-bit reproducible across runs, but they
are different from what prior avbroot commits produced:
* avbroot's cpio writer follows GNU cpio and libarchive's behavior of
setting the mode field to 0 in the trailer entry. magiskboot sets the
mode to 0o755.
* When patching a vendor boot v4 image, the ramdisk table entries are
now updated correctly. Prior vendor boot images were only bootable
because:
* the image only contained a single ramdisk
* the single ramdisk shrunk in size, stayed the same, or grew little
enough to not exceed a page boundary
* the bootloader is lenient in validating boot image fields
magiskboot does not handle vendor boot v4 images correctly, but it
doesn't need to just for the regular root patch. avbroot made use of
it in an unsupported way to patch vendor boot ramdisks.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
openssl supports passing the passphrase via a file descriptor, so let's
do that and avoid ever putting plaintext private keys on the filesystem,
even if it is a tmpfs.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Only OxygenOS 12 and 13 can work because older builds use the legacy
metadata file instead of the newer protobuf format.
Differences from Pixel devices:
* There's a recovery image. It contains otacerts.zip instead of
vendor_boot or boot. The image uses a version 4 `ANDROID!` header, not
`VNDRBOOT`.
* The payload.bin uses ZERO blocks with no sha256 checksum.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Now that avbroot no longer needs to create huge temp files, just use the
OS's default temp directory.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
With this commit, avbroot now performs the entire OTA signing process
itself. This removes the 4 full .zip builds needed for signing before,
which means that avbroot can now do the full patching process in a
single pass.
Since signapk is no longer needed, the java dependency has been dropped.
This also means that avbroot no longer depends on glibc-based Linux
distros, which was the case before due to signapk's conscrypt
dependency.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
The original AOSP ota_utils implementation is quite disk and memory heavy:
* ota_utils.FinalizeMetadata() performs metadata file replacement as
separate delete + add operations, which require an extra intermediate
zip to be written.
* ota_utils.FinalizeMetadata() keeps unneeded intermediate temporary
files around until common.Cleanup() is called.
* common.ZipDelete() deletes files by excluding entries when copying
from one zip to another. The data copy reads entire entries (including
the huge payload) into memory instead of copying chunks.
Additionally, ota_utils is a bit exception/crash-unsafe in general.
There are several places where temp files won't be cleaned up unless
everything is following the happy path.
This commit's reimplementation tries to use streaming and chunked
operations where possible and only keeps temporary files around as long
as needed. This is about as efficient as we can get while still relying
on AOSP's signapk.
(And we can finally get rid of the common.OPTIONS hackery!)
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
If any standard temp directory environment variables are set, then don't
use the output directory as the temp directory.
Issue: #22
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Systems where /tmp is on a tmpfs and have less free RAM may have trouble
with the patching process.
Signed-off-by: Andrew Gunnerson <chillermillerlong@hotmail.com>
Using /dev/shm breaks compatibility with non-Linux operating systems. On
Linux, most distros mount /tmp as a tmpfs anyway.
Fixes: #15
Signed-off-by: Andrew Gunnerson <chillermillerlong@hotmail.com>
* Apply OTA certificate patch to the boot image if no `vendor_boot`
image exists.
* Only manually decompress ramdisk cpio archives if the boot image
header version is 4. `magiskboot` automatically decompresses older
header versions.
Fixes: #5
Signed-off-by: Andrew Gunnerson <chillermillerlong@hotmail.com>
Devices launching with Android 13, like the Pixel 7 series, put the
ramdisk containing first stage init in the init_boot partition instead
of the boot partition.
Signed-off-by: Andrew Gunnerson <chillermillerlong@hotmail.com>
This is more secure and reliable compared to forcibly enabling fastbootd
in recovery. All of the normal AVB and OTA update flows are preserved,
except with the user's custom keys.
Signed-off-by: Andrew Gunnerson <chillermillerlong@hotmail.com>
Andrew Gunnerson