openssl supports passing the passphrase via a file descriptor, so let's
do that and avoid ever putting plaintext private keys on the filesystem,
even if it is a tmpfs.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
* Clarify boot image partitions. It is no longer the case that only
`boot` and `vendor_boot` are patched.
* Describe how to check if an OTA file is A/B.
* Remove mentions of signapk now that avbroot signs zips itself.
* Minor grammar changes.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Only OxygenOS 12 and 13 can work because older builds use the legacy
metadata file instead of the newer protobuf format.
Differences from Pixel devices:
* There's a recovery image. It contains otacerts.zip instead of
vendor_boot or boot. The image uses a version 4 `ANDROID!` header, not
`VNDRBOOT`.
* The payload.bin uses ZERO blocks with no sha256 checksum.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This hasn't broken anything in the past because the Pixel OTA payloads
haven't been using ZERO or DISCARD blocks.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Now that avbroot no longer needs to create huge temp files, just use the
OS's default temp directory.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
With this commit, avbroot now performs the entire OTA signing process
itself. This removes the 4 full .zip builds needed for signing before,
which means that avbroot can now do the full patching process in a
single pass.
Since signapk is no longer needed, the java dependency has been dropped.
This also means that avbroot no longer depends on glibc-based Linux
distros, which was the case before due to signapk's conscrypt
dependency.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
It was originally stored as <certificate basename>/ota.x509.pem due to a
brain fart. It was always intended to just be ota.x509.pem.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
The original AOSP ota_utils implementation is quite disk and memory heavy:
* ota_utils.FinalizeMetadata() performs metadata file replacement as
separate delete + add operations, which require an extra intermediate
zip to be written.
* ota_utils.FinalizeMetadata() keeps unneeded intermediate temporary
files around until common.Cleanup() is called.
* common.ZipDelete() deletes files by excluding entries when copying
from one zip to another. The data copy reads entire entries (including
the huge payload) into memory instead of copying chunks.
Additionally, ota_utils is a bit exception/crash-unsafe in general.
There are several places where temp files won't be cleaned up unless
everything is following the happy path.
This commit's reimplementation tries to use streaming and chunked
operations where possible and only keeps temporary files around as long
as needed. This is about as efficient as we can get while still relying
on AOSP's signapk.
(And we can finally get rid of the common.OPTIONS hackery!)
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
If any standard temp directory environment variables are set, then don't
use the output directory as the temp directory.
Issue: #22
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Systems where /tmp is on a tmpfs and have less free RAM may have trouble
with the patching process.
Signed-off-by: Andrew Gunnerson <chillermillerlong@hotmail.com>
Using /dev/shm breaks compatibility with non-Linux operating systems. On
Linux, most distros mount /tmp as a tmpfs anyway.
Fixes: #15
Signed-off-by: Andrew Gunnerson <chillermillerlong@hotmail.com>
Magisk commit ad0e6511e11ebec65aa9b5b916e1397342850319 stopped embedding
stub.apk into magiskinit, so we need to ensure it is extracted and
available to boot_patch.sh.
Signed-off-by: Andrew Gunnerson <chillermillerlong@hotmail.com>
This is the same as commit 163540b2b6,
except for the vbmeta image. Some older devices' vbmeta images were
originally signed by an RSA 4096 key.
Fixes: #9
Signed-off-by: Andrew Gunnerson <chillermillerlong@hotmail.com>
* Apply OTA certificate patch to the boot image if no `vendor_boot`
image exists.
* Only manually decompress ramdisk cpio archives if the boot image
header version is 4. `magiskboot` automatically decompresses older
header versions.
Fixes: #5
Signed-off-by: Andrew Gunnerson <chillermillerlong@hotmail.com>
openssl 1.1 does not support autodetecting whether the input file is PEM
or DER encoded.
Issue: #2
Signed-off-by: Andrew Gunnerson <chillermillerlong@hotmail.com>
The Pixel 7 series' init_boot image is signed with a SHA256_RSA2048
signature and avbroot can't use that algorithm because it expects RSA
4096 keys.
Signed-off-by: Andrew Gunnerson <chillermillerlong@hotmail.com>
Andrew Gunnerson