This is useful when the OTA contains partition images that are signed
with the AOSP test keys.
Issue: #569
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
* Use "device" as a generic reference instead of "phone" throughout the project description as more than just phones can support custom AVB functionality.
* Finalize the clarification on signing key generation in the initial setup section introduced by commit https://github.com/chenxiaolong/avbroot/commit/2f964bf113512bd7ff33eb3e47116305a262e9fc.
* The "warning" in the merging snapshots section is marked in bold and uppercase, aligning with the rest of the text, while less important "notes" don't stand out in the same way.
Signed-off-by: Ivan <reddxae@proton.me>
This adds a new `avbroot avb verify-device` subcommand, which is just
like the normal `verify` subcommand, except it reads the actual
partitions on the device. This is only available with the Android build
of avbroot since it needs to run on the actual device.
Fixes: #482
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
The performance, both in CPU time and compression ratios, is very
comparable to liblzma. This lets us drop the last remaining
compression-related dependency written in C.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
While avbroot initially started as a way to allow a rooted boot image to
be used with a locked bootloader, it has evolved much since then.
Nowadays, many folks use it to make modifications to their OTAs that
don't involve enabling root access. avbroot also has many subcommands
for packing and unpacking various Android image formats that people use
without ever using avbroot's main OTA patching functionality.
This commit updates the project description to reflect this and
simplifies the wording a bit.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Devices that launch with Android <14 generally use gzip as the CoW
compression algorithm. This never changes because future full OTAs
always need to be installable from the version of Android the device
launched with.
However, for users that don't care about the upgrade path from old
versions of Android, a new --vabc-algo option can be used to switch from
gz to lz4 compression. This can cut down the OTA installation time by
more than 2/3rds when installing via a custom OTA updater app. On my
Pixel Tablet, the installation time for the update_engine DOWNLOADING
phase decreased from 32:05 to 9:41. Note that this has absolutely no
effect on the performance when sideloading from recovery mode because
that does not use CoW.
When this new option is used, all dynamic partitions need to be
extracted from the OTA during patching so that the CoW estimates can be
recomputed. This will slow down the patching process and use up more
temporary disk space.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This is analogous to the existing --skip-recovery-ota-cert option,
except for the system image.
Discussion: #417
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
For consistency with decode-avb. The old syntax will remain supported
indefinitely for backwards compatibility.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This also adds a new --none option so that these two components can be
extracted without extracting any partition images.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Previously, we only supported extracting all images or the subset of
images that could potentially be patched by avbroot. This was
unnecessarily slow if the user only needed to extract a specific image.
This commit also deprecates and hides the `--boot-only` option, though
the functionality will remain indefinitely.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
avbroot will not support patching these internal OTAs because it
requires modifying filesystems and creating incremental OTAs. However,
it should be possible to do this manually if someone really wants to try
out a 16K page size kernel.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This commit adds a new `--zip-mode` parameter to `avbroot ota patch` to
control whether the patched OTA zip is written with data descriptors or
not. By default, the `streaming` mode is used, which matches the current
behavior where the zip is hashed for signing as it is being written. The
new `seekable` mode fully writes the zip before rereading it to hash the
contents.
The new mode is useful for devices with broken zip parsers that fail to
properly handle data descriptors.
All of the end-to-end tests have been duplicated to test both modes.
Adding the seekable mode necessitated a couple other changes:
* BufWriter is no longer used. Type erasure is very painful in Rust, so
we need to keep the writer types the same for both the streaming and
seekable modes. BufWriter is unusable in the seekable mode because we
need to be able to read back what was written, which isn't supported.
* HolePunchingWriter has been removed. It was a simple way to produce
sparse files by seeking whenever a write buffer consists fully of
zeros. When combined with BufWriter, there was previously never a
situation where this was undesirable. However, with the new seekable
mode and the zip library's pattern of writing one field at a time, the
final 2 zero bytes (representing an empty archive comment) is never
written and the file size is not increased either.
Removing this is not a big deal since we no longer use stripped OTAs
for the end-to-end tests. Those were really the only OTAs that
benefitted from sparse files. A real OTA has very few zero bytes due
to compression.
Issue: #328
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Older versions of fastboot have bugs that cause the reboot to fastbootd
mode to be skipped, causing failures when flashing dynamic partitions.
Fixes: #314
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
By default, the helper program is invoked in a way that is compatible
with avbtool's --signing_helper. However, the arguments have been
extended slightly to allow passing in the passphrase file or environment
variable for non-interactive use.
Fixes: #310
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
The precompiled binaries are compiled for aarch64 API 31, which should
work for every device that avbroot supports.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
OnePlus seems to be getting worse and worse with some devices not being
recoverable.
Issue: #290
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This allows the user to boot GSIs signed by the same key. The option is
disabled by default because some Android builds disable DSU support by
removing all keys to reduce the attack surface. We don't want to
reenable DSU support on these builds unless the user asks for it.
Closes: #286
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
`fastboot flashall` is identical to the `fastboot update` command used
by the Pixel factory images, except it reads from a directory instead of
a zip file. It knows how to flip between the fastboot and fastbootd
modes without user intervention.
Fixes: #252
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Patching the image was never implemented because it's specific to
OnePlus devices where the bootloader does not respect the custom root of
trust.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
We'll switch to using `fastboot flashall` in the future once that has
been implemented and tested.
Fixes: #252
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Previously, overriding otacerts.zip in the system partition required the
user to flash a Magisk/KernelSU module that would bind mount over the
file during boot. While this worked well enough, it's insufficient for
unrooted setups, which has become more important since unrooting is the
only safe way to use the new OEM repair mode feature. With the stock
otacerts.zip, the OEM's default OTA updater app could run and install an
OS upgrade that's not signed by the user's key.
With this commit, the raw otacerts.zip bytes in the system partition are
directly replaced with a new zip that contains the user's certificate.
This method was inspired by @pascallj's comment in #216 suggesting
intentionally corrupting the otacerts.zip data in the filesystem.
Because avbroot does not have filesystem parsers for ext4/f2fs/erofs, we
rely on a heuristic-based search on the raw filesystem image. The file
is always smaller than one block (which is at least 4096 bytes on all
known devices), so the file data is stored contiguously on disk and in
the case of erofs, won't be compressed. None of the three filesystems
are copy-on-write and thus, have no filesystem-level data checksums. For
the dm-verity layer one level up, avbroot already knows how to recompute
the hash tree and FEC data.
To ensure that there are no false positives, any match that the search
finds must correctly parse as a valid zip and every entry within the zip
must have a filename that ends in .x509.pem. This matches what
update_engine expects from a proper otacerts.zip file.
Since the new approach is doing a raw search and replace, the old and
new files must have the same size. When the new zip is smaller, null
bytes are added to the zip archive comment field to pad to the correct
size. When the new zip is larger, avbroot will attempt the following to
try and make the file size smaller:
1. Enable zip deflate compression
2. Strip the X.509 signature from the certificate
3. Clear out the issuer RDN sequence from the certificate
4. Clear out the subject RDN sequence from the certificate
The latter three changes work because Android never performs any PKI
operations with the certificate. There is no CA certificate chain. The
X.509 certificate file is nothing more than a way to transport an RSA
public key.
avbroot requires the user's key to be RSA 4096. If the original zip had
the same key size, then none of these shrinking methods are needed. If
it contained an RSA 2048 key, then the first two modifications are
usually sufficient. The latter two modifications should only be needed
if the user picked a really long subject value when generating the
certificate.
With these new changes, the OTA patching time will approximately double
on a system with an SSD and modern CPU. This is dominated by the time it
takes to XZ-compress the system partition image. The compression is
already parallelized and scales linearly with the number of cores.
There's likely not much more that can be done to further speed this up.
Finally, these new changes are currently excluded from the e2e tests
because including the system partition in the stripped OTAs would
increase the file size by an order of magnitude. This could potentially
be solved in the future by generating our own small OTAs to use for
testing instead of running against real device OTAs.
Fixes: #225
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
During patching, all boot images are now extracted and the individual
patchers can inspect them to determine which ones need modifications.
This replaces the previous mechanism of detecting which boot images to
patch based on the name alone.
With this new method, the --boot-partition and --otacerts-partitions
options are no longer needed. The former option is kept (but ignored
with a warning message) for backwards compatibility, but the latter is
completely removed because it never made it to a stable release.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
* Split out requirements from the warnings/caveats section and move it
to the top. Hopefully this helps new users determine whether they can
even use avbroot quicker.
* Split usage section into separate usage, initial install, and updates
sections. This should hopefully make the steps much easier to follow
without a bunch of steps being prefixed with `[Initial setup only]`.
* Explicitly state what arguments are required for Magisk, KernelSU, and
unrooted setups instead of directing users to the advanced usage
section.
* Don't assume that everyone will use Magisk in the other sections.
* Explicitly state the assumption that the device should already running
the OS build that the user wants to patch during initial install.
* Add step to updates section for installing an updated Magisk or
KernelSU app.
* Move command for building the modules from the modules section to the
building from source section.
* Update sample error message in the clear vbmeta flags section to match
what avbroot will actually print out.
* General rewording to try and make things clearer (especially reducing
parenthesized parts).
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Android 11 OTAs use the same `payload.bin` format, but lack the
`metadata.pb` protobuf representation of the OTA metadata. This commit
adds support for parsing the legacy plain-text `metadata` format. Like
before, the output files will still contain both the legacy and
protobuf representations.
Note that the legacy format allowed OEMs to specify arbitrary key/value
pairs. These will be discarded during patching because they cannot be
represented in the protobuf format, which is used in avbroot's internal
representation.
Issue: #195
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
During the migration to avbroot 2.0, these options have been renamed. Reflect this in the Readme.
Signed-off-by: Pascal Roeleven <dev@pascalroeleven.nl>
Andrew Gunnerson