common.py really wants sys.argv[0] to be just an executable name with no
path or extension.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
It's not worth adding a new dependency just to use FileRenameInfoEx
with FILE_RENAME_FLAG_POSIX_SEMANTICS.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
openssl does not support reading the passphrase from file descriptors on
Windows. Using an environment variable is the next best option.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This commit reimplements the magiskboot patching process natively in
Python. By doing so, avbroot gains cross platform support and there's no
longer a need to execute an Android binary on a non-Android Linux system,
which had pitfalls that already had to be worked around.
Boot images and cpio archives are handled by new custom parsers added to
avbroot. Legacy lz4 compression is done by a wrapper around the python
lz4 library (a new dependency). Gzip compression is handled natively by
python. Other compression methods and OEM-specific boot image formats
are not supported because devices that use the modern Android A/B OTA
scheme do not use those.
Output files are still bit-for-bit reproducible across runs, but they
are different from what prior avbroot commits produced:
* avbroot's cpio writer follows GNU cpio and libarchive's behavior of
setting the mode field to 0 in the trailer entry. magiskboot sets the
mode to 0o755.
* When patching a vendor boot v4 image, the ramdisk table entries are
now updated correctly. Prior vendor boot images were only bootable
because:
* the image only contained a single ramdisk
* the single ramdisk shrunk in size, stayed the same, or grew little
enough to not exceed a page boundary
* the bootloader is lenient in validating boot image fields
magiskboot does not handle vendor boot v4 images correctly, but it
doesn't need to just for the regular root patch. avbroot made use of
it in an unsupported way to patch vendor boot ramdisks.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
openssl supports passing the passphrase via a file descriptor, so let's
do that and avoid ever putting plaintext private keys on the filesystem,
even if it is a tmpfs.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
* Clarify boot image partitions. It is no longer the case that only
`boot` and `vendor_boot` are patched.
* Describe how to check if an OTA file is A/B.
* Remove mentions of signapk now that avbroot signs zips itself.
* Minor grammar changes.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Only OxygenOS 12 and 13 can work because older builds use the legacy
metadata file instead of the newer protobuf format.
Differences from Pixel devices:
* There's a recovery image. It contains otacerts.zip instead of
vendor_boot or boot. The image uses a version 4 `ANDROID!` header, not
`VNDRBOOT`.
* The payload.bin uses ZERO blocks with no sha256 checksum.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This hasn't broken anything in the past because the Pixel OTA payloads
haven't been using ZERO or DISCARD blocks.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Now that avbroot no longer needs to create huge temp files, just use the
OS's default temp directory.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
With this commit, avbroot now performs the entire OTA signing process
itself. This removes the 4 full .zip builds needed for signing before,
which means that avbroot can now do the full patching process in a
single pass.
Since signapk is no longer needed, the java dependency has been dropped.
This also means that avbroot no longer depends on glibc-based Linux
distros, which was the case before due to signapk's conscrypt
dependency.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
It was originally stored as <certificate basename>/ota.x509.pem due to a
brain fart. It was always intended to just be ota.x509.pem.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
The original AOSP ota_utils implementation is quite disk and memory heavy:
* ota_utils.FinalizeMetadata() performs metadata file replacement as
separate delete + add operations, which require an extra intermediate
zip to be written.
* ota_utils.FinalizeMetadata() keeps unneeded intermediate temporary
files around until common.Cleanup() is called.
* common.ZipDelete() deletes files by excluding entries when copying
from one zip to another. The data copy reads entire entries (including
the huge payload) into memory instead of copying chunks.
Additionally, ota_utils is a bit exception/crash-unsafe in general.
There are several places where temp files won't be cleaned up unless
everything is following the happy path.
This commit's reimplementation tries to use streaming and chunked
operations where possible and only keeps temporary files around as long
as needed. This is about as efficient as we can get while still relying
on AOSP's signapk.
(And we can finally get rid of the common.OPTIONS hackery!)
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
If any standard temp directory environment variables are set, then don't
use the output directory as the temp directory.
Issue: #22
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Systems where /tmp is on a tmpfs and have less free RAM may have trouble
with the patching process.
Signed-off-by: Andrew Gunnerson <chillermillerlong@hotmail.com>
Using /dev/shm breaks compatibility with non-Linux operating systems. On
Linux, most distros mount /tmp as a tmpfs anyway.
Fixes: #15
Signed-off-by: Andrew Gunnerson <chillermillerlong@hotmail.com>
Magisk commit ad0e6511e11ebec65aa9b5b916e1397342850319 stopped embedding
stub.apk into magiskinit, so we need to ensure it is extracted and
available to boot_patch.sh.
Signed-off-by: Andrew Gunnerson <chillermillerlong@hotmail.com>
Andrew Gunnerson