This will not make a meaningful performance difference for our use case,
but does not make things any more complex either.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
rawzip is a lower-level zip file library that is much more suited for
avbroot's use case. Its speed improvements aren't too important since
OTAs only have a handful of files, but it is a simpler layer of
abstraction and exposes more about zip file internals. We also no longer
need to maintain a perpetual fork of the zip library.
The only caveat is that rawzip (much like avbroot) is built around
writing zip files in a streaming fashion. To support `--zip-mode
seekable`, the output file is post-processed to copy the relevant data
descriptor fields to the local header. The unused data descriptors
remain in the file to avoid needing to shift file data, but this does
not violate the spec and Android's libziparchive accepts it just fine.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Prior to Rust 1.89, these tests were just skipped when cross-compiling.
Now, they are actually compiled and ran. Unfortunately, doctests don't
use the normal RUSTFLAGS environment variable, so we also need to set
RUSTDOCFLAGS or else the resulting dynamically linked executable will
fail to run on a non-Android host.
Upstream change: https://github.com/rust-lang/cargo/pull/15462
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
* Use "device" as a generic reference instead of "phone" throughout the project description as more than just phones can support custom AVB functionality.
* Finalize the clarification on signing key generation in the initial setup section introduced by commit https://github.com/chenxiaolong/avbroot/commit/2f964bf113512bd7ff33eb3e47116305a262e9fc.
* The "warning" in the merging snapshots section is marked in bold and uppercase, aligning with the rest of the text, while less important "notes" don't stand out in the same way.
Signed-off-by: Ivan <reddxae@proton.me>
This removes the need for the user to explicitly specify a public key to
verify against.
Issue: #482
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This adds a new `avbroot avb verify-device` subcommand, which is just
like the normal `verify` subcommand, except it reads the actual
partitions on the device. This is only available with the Android build
of avbroot since it needs to run on the actual device.
Fixes: #482
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
There is not much benefit for our use case to have kernel-level
openat-style sandboxing of paths. We already check all untrusted paths
for safety and the sandboxing prevented the use of symlinks that point
outside of the parent directory of specified paths.
This commit also moves the path safety checks to the util module to
avoid having multiple implementations spread out everywhere.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
The performance, both in CPU time and compression ratios, is very
comparable to liblzma. This lets us drop the last remaining
compression-related dependency written in C.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Previously, unless forced, `avbroot avb pack` would only re-sign an
image if the packing process changed the header (eg. root digest).
However, this isn't sufficient when packing an image after the user
modifies avb.toml manually. This is especially the case when packing a
vbmeta image, which never triggered the old check because it does not
contain a raw image.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Previously, Header::verify() tried to always decode the public_key
field, even if the header was unsigned. This prevented verifying
unsigned images with `avbroot avb verify`. Verifying unsigned images
referenced by signed images was unaffected.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
CHUNK_TYPE_RAW is the only chunk type that's guaranteed to not overflow
a u32 when its number of blocks is multiplied by the block size.
CHUNK_TYPE_FILL and CHUNK_TYPE_DONT_CARE require a u64.
Issue: #472
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Previously, we automatically promoted SHA-1 to SHA-256 because SHA-1 is
insecure, but there are devices that don't support SHA-256. It's safer
to just keep using the original hash algorithm.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Previously, we computed the expected property files string (based on
AOSP's rules) and checked if the string in the OTA metadata was a
byte-for-byte match. This would fail for OTAs with strings that differ
from how AOSP generates them. This could be additional files or just
different ordering of the entries.
This commit changes the approach to just verify that the property file
entries is a valid subset of the zip file entries. We no longer try to
compute the expected value.
This does not change what avbroot generates when patching an OTA. Newly
generated property files strings always follow AOSP's rules.
Fixes: #469
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
The zip crate gained support for streaming writes in its master branch,
so we can finally upgrade from our ancient fork of it. The new
implementation is done a bit differently, with seekable writers having
the ZipWriter<W> type and streaming writers having the
ZipWriter<StreamWriter<W>> type. This forces us to add a new wrapper
type since we have to switch between them at runtime.
We still need to maintain a (hopefully temporary) fork of the crate due
to a few issues:
1. There's no way to get the original underlying writer instance back
after finalizing a streaming zip. A fix for this has been submitted
upstream:
https://github.com/zip-rs/zip2/pull/367
2. The streaming writes implementation does not include the magic
signature for data descriptors. While the zip spec says the magic
value is optional and parsers should not require it, older versions
of Android's libziparchive do. A fix for this has been submitted
upstream:
https://github.com/zip-rs/zip2/pull/368
3. There is currently no way to get the data offset of zip entries.
avbroot requires this to fill in the OTA metadata's "property files"
entries, which Android uses to read file data without parsing the zip
file structures.
This new zip update produces files that are slightly different to
before. The "version made by" and "version needed to extract" fields are
now set to their minimum possible values. Previously, the zip crate was
hardcoded to use versions 4.6 and 2.0, respectively.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Andrew Gunnerson