This way, archives with hard links can pass through `cpio unpack` and
`cpio pack`, even though there's no explicit support for hard links.
This also changes the trailer entry logic to not set an inode number.
AOSP's mkbootfs and magiskboot both start at 300000 and increment by one
for each entry, including the trailer. However, GNU cpio, bsdcpio,
busybox, and toybox all set it to 0, which makes more sense given that
it doesn't represent anything on disk.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
There are several things we had to work around with quick-protobuf, like
forcing no_std mode to use BTreeMaps and avoiding helper functions to
read and write non-size-delimited messages. In addition, the pb-rs code
generator doesn't support adding #[derive]s to enums and the existing
support for adding derives to structs is broken due to incorrect string
concatenation.
Prost doesn't have these limitations and bugs. I originally avoided it
because prost_build required the external `protoc` binary, but now that
the protox library exists, the code generation can be done entirely in
Rust without external tools.
Prost also fully supports adding custom attributes to structs, enums,
and fields. This will be helpful for future payload unpack and pack
commands where the payload manifest would have to be serialized to TOML.
The e2e checksums had to be updated because prost's serialized bytes on
the wire differ from quick-protobuf, despite having the same semantic
meaning. Since all checksums need to be updated anyway, the Magisk apk
and OTA images have all been updated to the latest versions.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This also changes the serialization to use a `type` field instead of
spewing the enum variant name everywhere.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
The new commands behave exactly like the existing `avb` and `boot`
subcommands. This completes the last piece of the puzzle for exposing
useful interfaces to avbroot's internal parsers.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
The Magisk boot image patcher still reads all the entries into memory
for simplicity, but everything else now uses the streaming reader.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This prevents avbroot writing to locations where it shouldn't due to
manipulation from external processes. For example, replacing the output
directory for `avbroot ota extract` with a symlink.
Regardless of what symlinks or other changes an external process does to
the directory, the cap-std library will use the appropriate `openat2()`
options (or equivalent) to prevent writes outside of the directory.
Fixes: #166
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This is the only part of the payload that we have to read entirely into
memory. The limit is currently set to 1 MiB, which is around ~5-6x the
manifest size in all the e2e test suite's images.
Issue: #169
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This way we can't run out of memory if the zip entry lists an invalid
file size that's much bigger than the actual file.
Issue: #157
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This also limits the block size to 16384. There are currently no known
images that use anything larger than 4096.
Issue: #157
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This prevents avbroot from being killed for excessive memory usage due
to the entry header specifying a very large file name or file size
(larger than what's actually contained in the file).
This threshold for switching to incremental reallocation is 1 KiB for
file names and 1 MiB for file data.
Issue: #157
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Andrew Gunnerson