Android 11 OTAs use the same `payload.bin` format, but lack the
`metadata.pb` protobuf representation of the OTA metadata. This commit
adds support for parsing the legacy plain-text `metadata` format. Like
before, the output files will still contain both the legacy and
protobuf representations.
Note that the legacy format allowed OEMs to specify arbitrary key/value
pairs. These will be discarded during patching because they cannot be
represented in the protobuf format, which is used in avbroot's internal
representation.
Issue: #195
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
During the migration to avbroot 2.0, these options have been renamed. Reflect this in the Readme.
Signed-off-by: Pascal Roeleven <dev@pascalroeleven.nl>
Previously, the AVB `algorithm_type` field was unconditionally being set
to a value that is compatible with the AVB private key. However, for
indirectly-signed boot images, the value should be set to `None`. Pixel
bootloaders accept the incorrect value, but other devices' bootloaders
might not.
Issue: #186
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Some partitions, like system_ext in the Pixel Experience build for
`avicii`, use SHA1 for the dm-verity hash tree. This is technically
valid, so allow the `avb verify` command to compute these hashes. SHA1
will still be rejected when creating AVB images.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This is still not the ideal API, but it makes the code quite a bit more
readable since we no longer have to pass around closures everywhere that
multithreaded reads and writes to the same file are needed.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
avbroot currently has a check to ensure that AVB signature verification
isn't completely disabled by non-zero vbmeta header flags. This is done
to ensure that the user isn't given a false sense of security when the
OS is built in an insecure way. This commit makes a few changes better
reject insecure OTAs.
The first change is extending the non-zero flags check to all vbmeta
images. Previously, only vbmeta images that needed to be updated as a
result of patching/re-signing were checked.
The second change is ensuring that there are no critical partitions
present in `payload.bin`, but missing from the vbmeta descriptors. For
example, if the vbmeta descriptor for `system.img` is missing, the
patching process will fail with a fatal error that cannot be bypassed.
Unfortunately, it's not feasible to check every partition because there
is no known device where every partition is protected by AVB. Google's
Tensor-based devices are the best and only have a single partition not
protected by AVB: `modem`. Qualcomm-based devices have many partitions
not protected by AVB. OnePlus devices have many partitions that are
checked directly (against the appended header) and thus, aren't listed
in any vbmeta image.
Due to this, only partitions that AOSP understands are checked. OEM-
specific partitions (which, security-wise, may be just as important) are
not checked.
The third change is ensuring that there's only a single root of trust
among the vbmeta images. This way, it's impossible to have, for example,
a `vbmeta_unused` image that contains all the descriptors and an empty
`vbmeta` image that's actually read by the bootloader.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
There are a ton of options and simply displaying them in a giant list is
not very readable.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This way, archives with hard links can pass through `cpio unpack` and
`cpio pack`, even though there's no explicit support for hard links.
This also changes the trailer entry logic to not set an inode number.
AOSP's mkbootfs and magiskboot both start at 300000 and increment by one
for each entry, including the trailer. However, GNU cpio, bsdcpio,
busybox, and toybox all set it to 0, which makes more sense given that
it doesn't represent anything on disk.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
There are several things we had to work around with quick-protobuf, like
forcing no_std mode to use BTreeMaps and avoiding helper functions to
read and write non-size-delimited messages. In addition, the pb-rs code
generator doesn't support adding #[derive]s to enums and the existing
support for adding derives to structs is broken due to incorrect string
concatenation.
Prost doesn't have these limitations and bugs. I originally avoided it
because prost_build required the external `protoc` binary, but now that
the protox library exists, the code generation can be done entirely in
Rust without external tools.
Prost also fully supports adding custom attributes to structs, enums,
and fields. This will be helpful for future payload unpack and pack
commands where the payload manifest would have to be serialized to TOML.
The e2e checksums had to be updated because prost's serialized bytes on
the wire differ from quick-protobuf, despite having the same semantic
meaning. Since all checksums need to be updated anyway, the Magisk apk
and OTA images have all been updated to the latest versions.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This also changes the serialization to use a `type` field instead of
spewing the enum variant name everywhere.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Andrew Gunnerson