It turns out that even though newer versions of delta_generator set this
field for CoW v2 (unused), older versions did not.
Fixes: #493
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
The list of output files that are needed are known beforehand. There's
no need to dynamically open them.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
The e2e checksums were updated because the new lzma-rust2 version has
slight differences in compression ratio.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This was a regression from d874921a69.
extract_images()'s open_output parameter was requesting a WriteSeek
instead of a WriteAt, so it received multiple instances of Arc<File>
all with the same underlying File (and file offset).
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
File reopening was conflating ownership of file-like types with the fact
that they support parallel reads and writes at arbitrary offsets.
The Reopen trait has now been replaced with ReadAt and WriteAt traits,
which are implemented for types that support parallel I/O. If a type
compatible with the standard Read/Write/Seek traits is needed, a new
UserPosFile type can act as the bridge by storing its own userspace file
offset. For the opposite bridge, there's MutexFile, which implements
ReadAt/WriteAt by using locks to make the operations sequential. This is
only really used in the tests though.
This eliminates the need for the PSeekFile and SharedCursor types. The
standard File and Cursor types can be used instead, and if shared
ownership is needed, Arc can be used.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This will not make a meaningful performance difference for our use case,
but does not make things any more complex either.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
rawzip is a lower-level zip file library that is much more suited for
avbroot's use case. Its speed improvements aren't too important since
OTAs only have a handful of files, but it is a simpler layer of
abstraction and exposes more about zip file internals. We also no longer
need to maintain a perpetual fork of the zip library.
The only caveat is that rawzip (much like avbroot) is built around
writing zip files in a streaming fashion. To support `--zip-mode
seekable`, the output file is post-processed to copy the relevant data
descriptor fields to the local header. The unused data descriptors
remain in the file to avoid needing to shift file data, but this does
not violate the spec and Android's libziparchive accepts it just fine.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Prior to Rust 1.89, these tests were just skipped when cross-compiling.
Now, they are actually compiled and ran. Unfortunately, doctests don't
use the normal RUSTFLAGS environment variable, so we also need to set
RUSTDOCFLAGS or else the resulting dynamically linked executable will
fail to run on a non-Android host.
Upstream change: https://github.com/rust-lang/cargo/pull/15462
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
* Use "device" as a generic reference instead of "phone" throughout the project description as more than just phones can support custom AVB functionality.
* Finalize the clarification on signing key generation in the initial setup section introduced by commit https://github.com/chenxiaolong/avbroot/commit/2f964bf113512bd7ff33eb3e47116305a262e9fc.
* The "warning" in the merging snapshots section is marked in bold and uppercase, aligning with the rest of the text, while less important "notes" don't stand out in the same way.
Signed-off-by: Ivan <reddxae@proton.me>
This removes the need for the user to explicitly specify a public key to
verify against.
Issue: #482
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This adds a new `avbroot avb verify-device` subcommand, which is just
like the normal `verify` subcommand, except it reads the actual
partitions on the device. This is only available with the Android build
of avbroot since it needs to run on the actual device.
Fixes: #482
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
There is not much benefit for our use case to have kernel-level
openat-style sandboxing of paths. We already check all untrusted paths
for safety and the sandboxing prevented the use of symlinks that point
outside of the parent directory of specified paths.
This commit also moves the path safety checks to the util module to
avoid having multiple implementations spread out everywhere.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
The performance, both in CPU time and compression ratios, is very
comparable to liblzma. This lets us drop the last remaining
compression-related dependency written in C.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Previously, unless forced, `avbroot avb pack` would only re-sign an
image if the packing process changed the header (eg. root digest).
However, this isn't sufficient when packing an image after the user
modifies avb.toml manually. This is especially the case when packing a
vbmeta image, which never triggered the old check because it does not
contain a raw image.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Previously, Header::verify() tried to always decode the public_key
field, even if the header was unsigned. This prevented verifying
unsigned images with `avbroot avb verify`. Verifying unsigned images
referenced by signed images was unaffected.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
CHUNK_TYPE_RAW is the only chunk type that's guaranteed to not overflow
a u32 when its number of blocks is multiplied by the block size.
CHUNK_TYPE_FILL and CHUNK_TYPE_DONT_CARE require a u64.
Issue: #472
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Andrew Gunnerson