Version 2.3.3

Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>

CHANGELOG.md

@@ -7,6 +7,21 @@
     to update the actual links at the bottom of the file.
 -->
 
+### Version 2.3.3
+
+* Add support for XZ-compressed ramdisks ([Issue #203], [PR #207])
+* Merge property and kernel command line AVB descriptors when replacing partitions ([Issue #203], [PR #208])
+
+### Version 2.3.2
+
+* Improve error messages when using `--replace` with an image that has the wrong AVB descriptor type ([Issue #201], [PR #202])
+* Automatically update legacy `dm=` kernel command line descriptor when packing AVB images ([Issue #203], [PR #205])
+* Automatically promote insecure hash algorithms (eg. sha1) to sha256 when packing AVB images ([Issue #203], [PR #206])
+
+### Version 2.3.1
+
+* Mark Magisk 264xx as supported ([PR #199])
+
 ### Version 2.3.0
 
 * Fix missing `--help` text for `avbroot avb unpack`'s `--ignore-invalid` option ([PR #183])
@@ -100,6 +115,8 @@ Behind-the-scenes changes:
 [Issue #157]: https://github.com/chenxiaolong/avbroot/issues/157
 [Issue #160]: https://github.com/chenxiaolong/avbroot/issues/160
 [Issue #166]: https://github.com/chenxiaolong/avbroot/issues/166
+[Issue #201]: https://github.com/chenxiaolong/avbroot/issues/201
+[Issue #203]: https://github.com/chenxiaolong/avbroot/issues/203
 [PR #130]: https://github.com/chenxiaolong/avbroot/pull/130
 [PR #132]: https://github.com/chenxiaolong/avbroot/pull/132
 [PR #133]: https://github.com/chenxiaolong/avbroot/pull/133
@@ -143,3 +160,9 @@ Behind-the-scenes changes:
 [PR #191]: https://github.com/chenxiaolong/avbroot/pull/191
 [PR #196]: https://github.com/chenxiaolong/avbroot/pull/196
 [PR #197]: https://github.com/chenxiaolong/avbroot/pull/197
+[PR #199]: https://github.com/chenxiaolong/avbroot/pull/199
+[PR #202]: https://github.com/chenxiaolong/avbroot/pull/202
+[PR #205]: https://github.com/chenxiaolong/avbroot/pull/205
+[PR #206]: https://github.com/chenxiaolong/avbroot/pull/206
+[PR #207]: https://github.com/chenxiaolong/avbroot/pull/207
+[PR #208]: https://github.com/chenxiaolong/avbroot/pull/208

Cargo.lock

@@ -121,7 +121,7 @@ checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
 
 [[package]]
 name = "avbroot"
-version = "2.3.0"
+version = "2.3.3"
 dependencies = [
  "anyhow",
  "assert_matches",
@@ -565,7 +565,7 @@ dependencies = [
 
 [[package]]
 name = "e2e"
-version = "2.3.0"
+version = "2.3.3"
 dependencies = [
  "anyhow",
  "attohttpc",
@@ -679,7 +679,7 @@ dependencies = [
 
 [[package]]
 name = "fuzz"
-version = "2.3.0"
+version = "2.3.3"
 dependencies = [
  "avbroot",
  "honggfuzz",
@@ -2104,7 +2104,7 @@ dependencies = [
 
 [[package]]
 name = "xtask"
-version = "2.3.0"
+version = "2.3.3"
 dependencies = [
  "anyhow",
  "clap",

Cargo.toml

@@ -4,7 +4,7 @@ members = ["avbroot", "e2e", "fuzz", "xtask"]
 resolver = "2"
 
 [workspace.package]
-version = "2.3.0"
+version = "2.3.3"
 license = "GPL-3.0-only"
 edition = "2021"
 repository = "https://github.com/chenxiaolong/avbroot"

README.extra.md

@@ -30,6 +30,8 @@ This subcommand packs a new AVB image from the `avb.toml` file and, for appended
 * To force an image to be signed, use `--key <path> --force`.
 * To force an image to be unsigned, use `--force` without specifying `--key`.
 
+Note that if the image is an appended image and its hash or hash tree descriptor uses an insecure algorithm, like `sha1`, then it will automatically be promoted to `sha256`.
+
 ### Repacking an AVB image
 
 ```bash

README.md

@@ -1,48 +1,112 @@
 # avbroot
 
-avbroot is a program for patching Android A/B-style OTA images for root access while preserving AVB (Android Verified Boot) using custom signing keys. It is compatible with both Magisk and KernelSU.
+avbroot is a program for patching Android A/B-style OTA images for root access while preserving AVB (Android Verified Boot) using custom signing keys. It is compatible with both Magisk and KernelSU. If desired, it can also just re-sign an OTA without enabling root access.
 
 Having a good understanding of how AVB and A/B OTAs work is recommended prior to using avbroot. At the very least, please make sure the [warnings and caveats](#warnings-and-caveats) are well-understood to avoid the risk of hard bricking.
 
 **NOTE:** avbroot 2.0 has been rewritten in Rust and no longer relies on any AOSP code. The CLI is fully backwards compatible, but the old Python implementation can be found in the `python` branch if needed.
 
+## Requirements
+
+* Only devices that use modern A/B partitioning are supported. This is the case for most non-Samsung devices launched with Android 10 or newer. To check if a device uses this partitioning scheme, open the OTA zip file and check that:
+
+  * `payload.bin` exists
+  * `META-INF/com/android/metadata` (Android 10-11) or `META-INF/com/android/metadata.pb` (Android 12+) exists
+
+* The device must support using a custom public key for the bootloader's root of trust. This is normally done via the `fastboot flash avb_custom_key` command. All Pixel devices with unlockable bootloaders support this, as well as most OnePlus devices. Other devices may support it as well, but there's no easy way to check without just trying it.
+
 ## Patches
 
 avbroot applies two patches to the boot images:
 
-* Magisk is applied to the `boot` or `init_boot` image, depending on device, as if it were done from the Magisk app.
+* The `boot` or `init_boot` image, depending on device, is patched to enable root access. For Magisk, the patch is equivalent to what would be normally done by the Magisk app.
 
-* The `boot`, `recovery`, or `vendor_boot` image, depending on device, is patched to replace the OTA signature verification certificates with the custom OTA signing certificate. This allows future patched OTAs to be sideloaded after the bootloader has been locked. It also prevents accidental flashing of the original OTA package while booted into recovery.
+* The `boot`, `recovery`, or `vendor_boot` image, depending on device, is patched to replace the OTA signature verification certificates with the custom OTA signing certificate. This allows future patched OTAs to be sideloaded from recovery mode after the bootloader has been locked. It also prevents accidental flashing of the original unpatched OTA.
 
 ## Warnings and Caveats
 
-* The device must use modern (non-legacy-SAR) A/B partitioning. This is the case on newer Pixel and OnePlus devices. To check if a device uses this partitioning scheme, open the OTA zip file and check that:
+* **Always leave the `OEM unlocking` checkbox enabled when using a locked bootloader with root.** This is critically important. Root access allows the boot partition to potentially be overwritten, either accidentally or intentionally, with an image that is not properly signed. In this scenario, if the checkbox is turned off, both the OS and recovery mode will be made unbootable and `fastboot flashing unlock` will not be allowed. This effectively renders the device **_hard bricked_**.
 
-  * `payload.bin` exists
-  * `META-INF/com/android/metadata` (Android 11) or `META-INF/com/android/metadata.pb` (Android 12+) exists
+    Repeat: **_ALWAYS leave `OEM unlocking` enabled if rooted._**
 
-* The device must support using a custom public key for the bootloader's root of trust. This is normally done via the `fastboot flash avb_custom_key` command. All Pixel devices with unlockable bootloaders support this, as well as most OnePlus devices. Other devices may support it as well, but there's no easy way to check without just trying it.
+* Any operation that causes an improperly-signed boot image to be flashed will result in the device being unbootable and unrecoverable without unlocking the bootloader again (and thus, triggering a data wipe). This includes:
 
-* **Do not ever disable the `OEM unlocking` checkbox when using a locked bootloader with root.** This is critically important. With root access, it is possible to corrupt the running system, for example by zeroing out the boot partition. In this scenario, if the checkbox is turned off, both the OS and recovery mode will be made unbootable and `fastboot flashing unlock` will not be allowed. This effectively renders the device **_hard bricked_**.
+    * Performing a unpatched A/B OTA update while booted into Android via the OS' default updater. This can be blocked via a Magisk/KernelSU module (see: [Blocking A/B OTA Updates](#blocking-ab-ota-updates)).
 
-* Any operation that causes an unsigned or differently-signed boot image to be flashed will result in the device being unbootable and unrecoverable without unlocking the bootloader again (and thus, triggering a data wipe). This includes:
+    * The `Direct install` method for updating Magisk. Magisk updates **must** be done by repatching the OTA, not via the app.
 
-    * Performing a regular (unpatched) A/B OTA update. This can be blocked via a Magisk module (see: [Blocking A/B OTA Updates](#blocking-ab-ota-updates)).
+    If the boot image is ever modified, **do not reboot**. [Open an issue](https://github.com/chenxiaolong/avbroot/issues/new) for support and be very clear about what steps were done that lead to the situation. If Android is still running and root access works, it might be possible to recover without wiping and starting over.
 
-    * The `Direct install` method for updating Magisk. Magisk updates must be done by repatching as well.
+## Usage
+
+1. Make sure the [caveats listed above](#warnings-and-caveats) are understood. It is possible to hard brick by doing the wrong thing!
+
+2. Download the latest version from the [releases page](https://github.com/chenxiaolong/avbroot/releases). To verify the digital signature, see the [verifying digital signatures](#verifying-digital-signatures) section.
+
+    avbroot is a standalone executable. It does not need to be installed and can be run from anywhere.
+
+3. Follow the steps to [generate signing keys](#generating-keys).
+
+4. Patch the OTA zip. The base command is:
+
+    ```bash
+    avbroot ota patch \
+        --input /path/to/ota.zip \
+        --key-avb /path/to/avb.key \
+        --key-ota /path/to/ota.key \
+        --cert-ota /path/to/ota.crt \
+    ```
+
+    Add the following additional arguments to the end of the command depending on how you want to configure root access.
+
+    * To enable root access with Magisk:
+
+        ```bash
+        --magisk /path/to/magisk.apk \
+        --magisk-preinit-device <name>
+        ```
+
+        If you don't know the Magisk preinit partition name, see the [Magisk preinit device section](#magisk-preinit-device) for steps on how to find it.
+
+        If you prefer to manually patch the boot image via the Magisk app instead of letting avbroot handle it, use the following arguments instead:
+
+        ```bash
+        --prepatched /path/to/magisk_patched-xxxxx_yyyyy.img
+        ```
+
+    * To enable root access with KernelSU:
+
+        ```bash
+        --prepatched /path/to/kernelsu/boot.img \
+        --boot-partition @gki_kernel
+        ```
+
+    * To leave the OS unrooted:
+
+        ```bash
+        --rootless
+        ```
+
+    For more details on the options above, see the [advanced usage section](#advanced-usage).
+
+    If `--output` is not specified, then the output file is written to `<input>.patched`.
+
+5. The patched OTA is ready to go! To flash it for the first time, follow the steps in the [initial setup section](#initial-setup). For updates, follow the steps in the [updates section](#updates).
 
 ## Generating Keys
 
-avbroot signs a few components while patching an OTA zip:
+avbroot signs several components while patching an OTA zip:
 
-* the root `vbmeta` image
-* the boot image `vbmeta` footers (if the original ones were signed)
+* the boot images
+* the vbmeta images
 * the OTA payload
 * the OTA zip itself
 
-The boot-related components are signed with an AVB key and OTA-related components are signed with an OTA key. They can be the same RSA keypair, though the following steps show how to generate two separate keys.
+The first two components are signed with an AVB key and latter two components are signed with an OTA key. They can be the same key, though the following steps show how to generate two separate keys.
 
-1. Generate the AVB and OTA signing keys:
+When patching OTAs for multiple devices, generating unique keys for each device is strongly recommended because it prevents an OTA for the wrong device being accidentally flashed.
+
+1. Generate the AVB and OTA signing keys.
 
     ```bash
     avbroot key generate-key -o avb.key
@@ -55,44 +119,23 @@ The boot-related components are signed with an AVB key and OTA-related component
     avbroot key extract-avb -k avb.key -o avb_pkmd.bin
     ```
 
-3. Generate a self-signed certificate for the OTA signing key. This is used by recovery for verifying OTA updates.
+3. Generate a self-signed certificate for the OTA signing key. This is used by recovery to verify OTA updates when sideloading.
 
     ```bash
     avbroot key generate-cert -k ota.key -o ota.crt
     ```
 
-The commands above are provided for convenience. avbroot is compatible with any standard PKCS8-encoded 4096-bit RSA private key and X509 certificate (eg. like those generated by openssl).
+The commands above are provided for convenience. avbroot is compatible with any standard PKCS8-encoded 4096-bit RSA private key and PEM-encoded X509 certificate, like those generated by openssl.
 
 If you lose your AVB or OTA signing key, you will no longer be able to sign new OTA zips. You will have to generate new signing keys and unlock your bootloader again (including a data wipe). Follow the [Usage section](#usage) as if doing an initial setup.
 
-## Usage
+## Initial setup
 
-1. Make sure the caveats listed above are understood. It is possible to hard brick by doing the wrong thing!
+1. Reboot into fastboot mode and unlock the bootloader if it isn't already unlocked. This will trigger a data wipe.
 
-2. Download the latest version from the [releases page](https://github.com/chenxiaolong/avbroot/releases). To verify the digital signature, see the [verifying digital signatures](#verifying-digital-signatures) section.
+2. When setting things up for the first time, the device must already be running the correct OS. Flash the original unpatched OTA if needed.
 
-3. Follow the steps to [generate signing keys](#generating-keys).
-
-4. Patch the full OTA ZIP.
-
-    ```bash
-    avbroot ota patch \
-        --input /path/to/ota.zip \
-        --key-avb /path/to/avb.key \
-        --key-ota /path/to/ota.key \
-        --cert-ota /path/to/ota.crt \
-        --magisk /path/to/magisk.apk
-    ```
-
-    If `--output` is not specified, then the output file is written to `<input>.patched`.
-
-    **NOTE:** If you are using Magisk version >=25211, you need to know the preinit partition name (`--magisk-preinit-device <name>`). For details, see the [Magisk preinit device section](#magisk-preinit-device).
-
-    If you prefer to use an existing boot image patched by the Magisk app or you want to use KernelSU, see the [advanced usage section](#advanced-usage).
-
-5. **[Initial setup only]** Unlock the bootloader. This will trigger a data wipe.
-
-6. **[Initial setup only]** Extract the patched images from the patched OTA.
+3. Extract the partition images from the patched OTA that are different from the original.
 
     ```bash
     avbroot ota extract \
@@ -100,49 +143,71 @@ If you lose your AVB or OTA signing key, you will no longer be able to sign new
         --directory extracted
     ```
 
-7. **[Initial setup only]** Flash the patched images and the AVB public key metadata. This sets up the custom root of trust. Future updates are done by simply sideloading patched OTA zips.
+    If you are using KernelSU, also add `--boot-partition @gki_kernel` to the command.
+
+4. Flash the partition images that were extracted.
+
+    This can be done by manually running `fastboot flash <partition> extracted/<partition>.img` for each image in the `extracted/` directory or by using the following script:
 
     ```bash
-    # Flash the boot images that were extracted
     for image in extracted/*.img; do
         partition=$(basename "${image}")
         partition=${partition%.img}
 
         fastboot flash "${partition}" "${image}"
     done
+    ```
 
-    # Flash the AVB signing public key
+5. Set up the custom AVB public key in the bootloader.
+
+    ```bash
     fastboot erase avb_custom_key
     fastboot flash avb_custom_key /path/to/avb_pkmd.bin
     ```
 
-8. **[Initial setup only]** Run `dmesg | grep libfs_avb` as root to verify that AVB is working properly. A message similar to the following is expected:
+6. **[Optional]** Before locking the bootloader, reboot into Android once to confirm that everything is properly signed.
+
+    Install the Magisk or KernelSU app and run the following command:
+
+    ```bash
+    adb shell su -c 'dmesg | grep libfs_avb'
+    ```
+
+    If AVB is working properly, the following message should be printed out:
 
     ```bash
     init: [libfs_avb]Returning avb_handle with status: Success
     ```
 
-9. **[Initial setup only]** Lock the bootloader. This will trigger a data wipe again. **Do not uncheck `OEM unlocking`!**
+7. Reboot back into fastboot and lock the bootloader. This will trigger a data wipe again.
+
+    Remember: **Do not uncheck `OEM unlocking`!**
 
     **WARNING**: If you are flashing CalyxOS, the setup wizard will [automatically turn off the `OEM unlocking` switch](https://github.com/CalyxOS/platform_packages_apps_SetupWizard/blob/7d2df25cedcbff83ddb608e628f9d97b38259c26/src/org/lineageos/setupwizard/SetupWizardApp.java#L135-L140). Make sure to manually reenable it again from Android's developer settings. Consider using [avbroot's `oemunlockonboot` Magisk module](#oemunlockonboot-enable-oem-unlocking-on-every-boot) to automatically ensure OEM unlocking is enabled on every boot.
 
+8. That's it! To install future OS, Magisk, or KernelSU updates, see the [next section](#updates).
+
+    For extra safety, consider flashing [avbroot's Magisk/KernelSU modules](#avbroot-modules).
+
 ## Updates
 
-To update Android or Magisk:
+Updates to Android, Magisk, and KernelSU are all done the same way by patching (or repatching) the OTA.
 
-1. Follow step 4 in [the previous section](#usage) to patch the new OTA (or an existing OTA with a newer Magisk APK).
+1. If Magisk or KernelSU is being updated, first install their new `.apk`. If you happen to open the app, make sure it **does not** flash the boot image. Cancel the boot image update prompts if needed.
 
-2. Reboot to recovery mode. If stuck at a `No command` screen, press the volume up button once while holding down the power button.
+2. Follow the step in the [usage section](#usage) to patch the new OTA.
 
-3. Sideload the patched OTA.
+3. Reboot to recovery mode. If the screen is stuck at a `No command` message, press the volume up button once while holding down the power button.
 
-4. Reboot.
+4. Sideload the patched OTA with `adb sideload`.
+
+5. That's it!
 
 ## Reverting to stock firmware
 
 To stop using avbroot and revert to the stock firmware:
 
-1. Unlock the bootloader. This will trigger a data wipe.
+1. Reboot into fastboot mode and unlock the bootloader. This will trigger a data wipe.
 
 2. Erase the custom AVB public key.
 
@@ -152,35 +217,34 @@ To stop using avbroot and revert to the stock firmware:
 
 3. Flash the stock firmware.
 
-## avbroot Magisk modules
+4. That's it! There are no other remnants to clean up.
 
-avbroot's Magisk modules can be found on the [releases page](https://github.com/chenxiaolong/avbroot/releases) or they can be built locally by running:
+## avbroot modules
 
-```bash
-cargo xtask modules -a
-```
+avbroot's Magisk/KernelSU modules can be downloaded from the [releases page](https://github.com/chenxiaolong/avbroot/releases).
 
-This requires Java and the Android SDK to be installed. The `ANDROID_HOME` environment variable should be set to the Android SDK path.
+### `clearotacerts`: Block OTA Updates from default updater app
 
-### `clearotacerts`: Blocking A/B OTA Updates
+Unpatched OTA updates are already blocked when booted into recovery mode because the original OTA certificate has been replaced with the custom certificate. However, this doesn't prevent the Android's system updater app from attempting to install an unpatched OTA update.
 
-Unpatched OTA updates are already blocked in recovery because the original OTA certificate has been replaced with the custom certificate. To disable automatic OTAs while booted into Android, turn off `Automatic system updates` in Android's Developer Options.
+Disabling the system updater app is recommended. To do so:
 
-The `clearotacerts` module additionally makes A/B OTAs fail while booted into Android to prevent accidental manual updates. The module simply overrides `/system/etc/security/otacerts.zip` at runtime with an empty zip so that even if an OTA is downloaded, signature verification will fail.
+* Stock OS: Turn off `Automatic system updates` in Android's Developer Options.
+* Custom OS: Disable the system updater app (or block its network access) from Settings -> Apps -> See all apps -> (three-dot menu) -> Show system -> (find updater app).
 
-At least in CalyxOS, the Updater app does not respect the `Automatic system updates` setting and may enter an infinite loop downloading the OTA update and restarting the download when signature verification fails. If this happens on your ROM, you can try to either remove network access from the Updater app or disable the Updater app altogether (if your ROM allows you to do so). In CalyxOS, it is possible to go to `Settings > Apps > See all apps`, open the three-dot menu, `Show system`, then find the `System updater` app and disable it.
+As an extra safety measure, flashing the `clearotacerts` module will intentionally make OTAs fail to install while booted into Android. It does so by overriding `/system/etc/security/otacerts.zip` with an empty zip containing no certificates so that even if an OTA is downloaded, signature verification will fail. This may cause some custom OS' system updater app to get stuck in an infinite loop downloading an OTA update and then retrying when signature verification fails, so make sure the system updater app is disabled.
 
-Alternatively, see [Custota](https://github.com/chenxiaolong/Custota) for a custom OTA updater app that pulls from a self-hosted OTA server.
+As an alternative to this module, see [Custota](https://github.com/chenxiaolong/Custota) for a custom OTA updater app that installs updates from a self-hosted OTA server.
 
 ### `oemunlockonboot`: Enable OEM unlocking on every boot
 
-To help reduce the risk of OEM unlocking being accidentally disabled (or intentionally disabled as part of some OS's initial setup wizard), this module will attempt to enable the OEM unlocking option on every boot.
+To help reduce the risk of OEM unlocking being accidentally disabled (or intentionally disabled as part of some OS' initial setup wizard), this module will attempt to enable the OEM unlocking option on every boot.
 
 The logs for this module can be found at `/data/local/tmp/avbroot_oem_unlock.log`.
 
 ## Magisk preinit device
 
-Magisk versions 25211 and newer require a writable partition for storing custom SELinux rules that need to be accessed during early boot stages. This can only be determined on a real device, so avbroot requires the partition's block device name to be specified via `--magisk-preinit-device <name>`. To find the partition name:
+Magisk versions 25211 and newer require a writable partition for storing custom SELinux rules that need to be accessed during early boot stages. This can only be determined on a real device, so avbroot requires the partition to be explicitly specified via `--magisk-preinit-device <name>`. To find the partition name:
 
 1. Extract the boot image from the original/unpatched OTA:
 
@@ -191,9 +255,9 @@ Magisk versions 25211 and newer require a writable partition for storing custom
         --boot-only
     ```
 
-2. Patch the boot image via the Magisk app. This **MUST** be done on the target device! The partition name will be incorrect if patched from Magisk on a different device.
+2. Patch the boot image via the Magisk app. This **MUST** be done on the target device or a device of the same model! The partition name will be incorrect if patched from Magisk on a different device model.
 
-    The Magisk app will include a line like the following in the output:
+    The Magisk app will print out a line like the following in the output:
 
     ```
     - Pre-init storage partition device ID: <name>
@@ -223,6 +287,8 @@ avbroot ota verify \
     --public-key-avb /path/to/avb_pkmd.bin
 ```
 
+This command works for any OTA, regardless if it's patched or unpatched.
+
 If the `--cert-ota` and `--public-key-avb` options are omitted, then the signatures are only checked for validity, not that they are trusted.
 
 ## Tab completion
@@ -265,15 +331,15 @@ Invoke-Expression (& avbroot completion -s powershell)
 
 ### Using a prepatched boot image
 
-avbroot can replace the boot image with a prepatched image instead of applying the Magisk root patch itself. This is useful for using a boot image patched by the Magisk app or for KernelSU. To use a prepatched boot image, pass in `--prepatched <boot image>` instead of `--magisk <apk>`. When using `--prepatched`, avbroot will skip applying the Magisk root patch, but will still apply the OTA certificate patch.
+avbroot can replace the boot image with a prepatched image instead of applying the root patch itself. This is useful for using a boot image patched by the Magisk app or for KernelSU. To use a prepatched Magisk boot image, pass in `--prepatched <boot image>` instead of `--magisk <apk>`. When using `--prepatched`, avbroot will skip applying the Magisk root patch, but will still apply the OTA certificate patch.
 
-For KernelSU, also pass in `--boot-partition @gki_kernel` for both the `patch` and `extract` commands. avbroot defaults to Magisk's semantics where the boot image containing the GKI ramdisk is needed, whereas KernelSU requires the boot image containing the GKI kernel. This only affects devices launching with Android 13, where the GKI kernel and ramdisk are in different partitions (`boot` vs. `init_boot`), but it is safe and recommended to always use this option for KernelSU.
+For KernelSU, also pass in `--boot-partition @gki_kernel` for both the `patch` and `extract` commands. avbroot defaults to Magisk's semantics where the boot image containing the GKI ramdisk is needed, whereas KernelSU requires the boot image containing the GKI kernel. This only affects devices launching with Android 13+, where the GKI kernel and ramdisk are in different partitions (`boot` vs. `init_boot`), but it is safe and recommended to always use this option for KernelSU.
 
 Note that avbroot will validate that the prepatched image is compatible with the original. If, for example, the header fields do not match or a boot image section is missing, then the patching process will abort. The checks are not foolproof, but should help protect against accidental use of the wrong boot image. To bypass a somewhat "safe" subset of the checks, use `--ignore-prepatched-compat`. To ignore all checks (strongly discouraged!), pass it in twice.
 
 ### Skipping root patches
 
-avbroot can be used for just resigning an OTA by specifying `--rootless` instead of `--magisk`/`--prepatched`. With this option, the patched OTA will not be rooted. The only modification applied is the replacement of the OTA verification certificate so that the OS can be upgraded with future (patched) OTAs.
+avbroot can be used for just re-signing an OTA by specifying `--rootless` instead of `--magisk`/`--prepatched`. With this option, the patched OTA will not be rooted. The only modification applied is the replacement of the OTA verification certificate so that the OS can be upgraded with future (patched) OTAs.
 
 ### Replacing partitions
 
@@ -288,7 +354,7 @@ This has no impact on what patches are applied. For example, when using Magisk,
 Some Android builds may ship with a root `vbmeta` image with the flags set such that AVB is effectively disabled. When avbroot encounters these images, the patching process will fail with a message like:
 
 ```
-ValueError: vbmeta flags disable AVB: 0x3
+Verified boot is disabled by vbmeta's header flags: 0x3
 ```
 
 To forcibly enable AVB (by clearing the flags), pass in `--clear-vbmeta-flags`.
@@ -297,7 +363,7 @@ To forcibly enable AVB (by clearing the flags), pass in `--clear-vbmeta-flags`.
 
 avbroot prompts for the private key passphrases interactively by default. To run avbroot non-interactively, either:
 
-* Supply the passphrases via files:
+* Supply the passphrases via files.
 
     ```bash
     avbroot ota patch \
@@ -352,11 +418,19 @@ The output binary is written to `target/release/avbroot`.
 
 Debug builds work too, but they will run significantly slower (in the sha256 computations) due to compiler optimizations being turned off.
 
-By default, the build links to the system's bzip2 and liblzma libraries, which are the only external libraries avbroot depends on. To compile and statically link these two libraries, pass in `--features static`.
+By default, the executable links to the system's bzip2 and liblzma libraries, which are the only external libraries avbroot depends on. To compile and statically link these two libraries, pass in `--features static`.
+
+To build avbroot's modules from source, run:
+
+```bash
+cargo xtask modules -a
+```
+
+This requires Java and the Android SDK to be installed. The `ANDROID_HOME` environment variable must be set to the Android SDK path.
 
 ## Verifying digital signatures
 
-First, save the public key to a file listing the keys to be trusted.
+First, save the public key to a file listing the keys to be trusted. This is the same key listed in [the author's profile](https://github.com/chenxiaolong/).
 
 ```bash
 echo 'avbroot ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDOe6/tBnO7xZhAWXRj3ApUYgn+XZ0wnQiXM8B7tPgv4' > avbroot_trusted_keys

avbroot/src/boot.rs

@@ -117,7 +117,7 @@ impl MagiskRootPatcher {
     //   RULESDEVICE config option, which stored the writable block device as an
     //   rdev major/minor pair, which was not consistent across reboots and was
     //   replaced by PREINITDEVICE
-    const VERS_SUPPORTED: &[Range<u32>] = &[25102..25207, 25211..26400];
+    const VERS_SUPPORTED: &[Range<u32>] = &[25102..25207, 25211..26500];
     const VER_PREINIT_DEVICE: Range<u32> =
         25211..Self::VERS_SUPPORTED[Self::VERS_SUPPORTED.len() - 1].end;
     const VER_RANDOM_SEED: Range<u32> = 25211..26103;

avbroot/src/cli/avb.rs

@@ -28,7 +28,7 @@ use crate::{
     crypto::{self, PassphraseSource},
     format::avb::{
         self, AlgorithmType, AppendedDescriptorMut, AppendedDescriptorRef, Descriptor, Footer,
-        Header,
+        HashTreeDescriptor, Header, KernelCmdlineDescriptor,
     },
     stream::{self, PSeekFile, Reopen},
     util,
@@ -92,6 +92,20 @@ fn write_info(path: &Path, info: &AvbInfo) -> Result<()> {
     Ok(())
 }
 
+/// Packing with insecure algorithms is intentionally not supported, so promote
+/// to a secure algorithm if needed.
+fn promote_insecure_hash_algorithm(algorithm: &str) -> &str {
+    const INSECURE_ALGORITHMS: &[&str] = &["sha1"];
+    const NEW_ALGORITHM: &str = "sha256";
+
+    if INSECURE_ALGORITHMS.contains(&algorithm) {
+        warning!("Changing insecure hash algorithm {algorithm} to {NEW_ALGORITHM}");
+        NEW_ALGORITHM
+    } else {
+        algorithm
+    }
+}
+
 /// Copy `size` bytes from `reader` into a new file `path` that's opened as
 /// both readable and writable.
 fn write_raw(
@@ -179,11 +193,13 @@ fn write_raw_and_update(
 
     match info.header.appended_descriptor_mut()? {
         AppendedDescriptorMut::HashTree(d) => {
+            d.hash_algorithm = promote_insecure_hash_algorithm(&d.hash_algorithm).to_owned();
             d.image_size = image_size;
             d.update(&raw_file, &raw_file, cancel_signal)
                 .context("Failed to update hash tree descriptor")?;
         }
         AppendedDescriptorMut::Hash(d) => {
+            d.hash_algorithm = promote_insecure_hash_algorithm(&d.hash_algorithm).to_owned();
             d.image_size = image_size;
             raw_file.rewind()?;
             d.update(&mut raw_file, cancel_signal)
@@ -194,6 +210,121 @@ fn write_raw_and_update(
     Ok(raw_file)
 }
 
+/// Compute the kernel command line arguments to allow the kernel to set up the
+/// dm-verity block device without dm-init or userspace helpers. This is handled
+/// by init/do_mounts_dm.c in older Pixel devices (and ChromiumOS).
+fn compute_dm_verity_cmdline(descriptor: &HashTreeDescriptor) -> String {
+    use std::fmt::Write;
+
+    let mut result = String::new();
+
+    // Number of device mapper devices.
+    result.push_str("dm=\"1");
+    // Block device name.
+    result.push_str(" vroot");
+    // Block device UUID.
+    result.push_str(" none");
+    // Block device write mode.
+    result.push_str(" ro");
+    // Number of device mapper targets.
+    result.push_str(" 1,");
+    // Starting sector.
+    result.push('0');
+    // Sector count.
+    write!(&mut result, " {}", descriptor.image_size / 512).unwrap();
+    // dm-verity version.
+    write!(&mut result, " verity {}", descriptor.dm_verity_version).unwrap();
+    // Data block device (replaced by bootloader at runtime).
+    result.push_str(" PARTUUID=$(ANDROID_SYSTEM_PARTUUID)");
+    // Hash block device (replaced by bootloader at runtime).
+    result.push_str(" PARTUUID=$(ANDROID_SYSTEM_PARTUUID)");
+    // Data block size.
+    write!(&mut result, " {}", descriptor.data_block_size).unwrap();
+    // Hash block size.
+    write!(&mut result, " {}", descriptor.hash_block_size).unwrap();
+    // Number of data blocks.
+    write!(
+        &mut result,
+        " {}",
+        descriptor.image_size / u64::from(descriptor.data_block_size),
+    )
+    .unwrap();
+    // Hash starting block (in units of the hash block size).
+    write!(
+        &mut result,
+        " {}",
+        descriptor.image_size / u64::from(descriptor.hash_block_size),
+    )
+    .unwrap();
+    // Hash algorithm.
+    write!(&mut result, " {}", descriptor.hash_algorithm).unwrap();
+    // Root digest.
+    write!(&mut result, " {}", &hex::encode(&descriptor.root_digest)).unwrap();
+    // Salt.
+    write!(&mut result, " {}", &hex::encode(&descriptor.salt)).unwrap();
+
+    // Number of optional arguments.
+    let num_optional_args = if descriptor.fec_num_roots != 0 { 10 } else { 2 }
+        + u8::from(descriptor.flags & HashTreeDescriptor::FLAG_CHECK_AT_MOST_ONCE != 0);
+    write!(&mut result, " {num_optional_args}").unwrap();
+
+    if descriptor.flags & HashTreeDescriptor::FLAG_CHECK_AT_MOST_ONCE != 0 {
+        // [n + 1] Only check blocks once instead of on each access.
+        result.push_str(" check_at_most_once");
+    }
+
+    // [0] Corruption handling mode (replaced by bootloader at runtime).
+    result.push_str(" $(ANDROID_VERITY_MODE)");
+    // [1] Force return zeros and skip validation for blocks expected to contain
+    // only zeros.
+    result.push_str(" ignore_zero_blocks");
+
+    if descriptor.fec_num_roots != 0 {
+        // [2-3] Enable FEC (replaced by bootloader at runtime).
+        result.push_str(" use_fec_from_device PARTUUID=$(ANDROID_SYSTEM_PARTUUID)");
+        // [4-5] Number of parity bytes per FEC codeword.
+        write!(&mut result, " fec_roots {}", descriptor.fec_num_roots).unwrap();
+
+        let fec_block_offset = descriptor.fec_offset / u64::from(descriptor.data_block_size);
+
+        // [6-7] Number of data blocks covered by FEC.
+        write!(&mut result, " fec_blocks {fec_block_offset}").unwrap();
+        // [8-9] Starting block (in data block size units) of FEC.
+        write!(&mut result, " fec_start {fec_block_offset}").unwrap();
+    }
+
+    // Root filesystem block device.
+    result.push_str("\" root=/dev/dm-0");
+
+    result
+}
+
+/// Update the dm-verity kernel command line descriptor to match the hash tree
+/// descriptor. This is a no-op if there's no matching existing kernel command
+/// line descriptor to update. Returns whether the descriptor was updated.
+fn update_dm_verity_cmdline(info: &mut AvbInfo) -> Result<bool> {
+    assert!(info.footer.is_some(), "Not an appended image");
+
+    let new_cmdline = match info.header.appended_descriptor()? {
+        AppendedDescriptorRef::HashTree(d) => compute_dm_verity_cmdline(d),
+        AppendedDescriptorRef::Hash(_) => return Ok(false),
+    };
+
+    for d in &mut info.header.descriptors {
+        if let Descriptor::KernelCmdline(d) = d {
+            if d.flags & KernelCmdlineDescriptor::FLAG_USE_ONLY_IF_HASHTREE_NOT_DISABLED != 0
+                && d.cmdline.starts_with("dm=")
+                && d.cmdline != new_cmdline
+            {
+                d.cmdline = new_cmdline;
+                return Ok(true);
+            }
+        }
+    }
+
+    Ok(false)
+}
+
 /// Sign or clear header signatures based on whether the original header was
 /// signed. If the original header was signed and is unchanged, then the
 /// original signature is used as-is. If the force option is specified, then
@@ -481,7 +612,11 @@ fn pack_subcommand(cli: &PackCli, cancel_signal: &AtomicBool) -> Result<()> {
                 format!("Failed to open raw image for reading: {:?}", cli.input_raw)
             })?;
 
-        write_raw_and_update(&cli.output, &mut reader, &mut info, cancel_signal)?
+        let file = write_raw_and_update(&cli.output, &mut reader, &mut info, cancel_signal)?;
+
+        update_dm_verity_cmdline(&mut info)?;
+
+        file
     } else {
         File::create(&cli.output)
             .map(PSeekFile::new)
@@ -507,11 +642,14 @@ fn repack_subcommand(cli: &RepackCli, cancel_signal: &AtomicBool) -> Result<()>
         let file = write_raw_and_verify(&cli.output, &mut reader, &info, false, cancel_signal)?;
 
         // Write new hash tree and FEC data instead of copying the original.
-        // THere could have been errors in the original FEC data itself.
+        // There could have been errors in the original FEC data itself.
         if let AppendedDescriptorMut::HashTree(d) = info.header.appended_descriptor_mut()? {
+            d.hash_algorithm = promote_insecure_hash_algorithm(&d.hash_algorithm).to_owned();
             d.update(&file, &file, cancel_signal)?;
         }
 
+        update_dm_verity_cmdline(&mut info)?;
+
         file
     } else {
         File::create(&cli.output)

avbroot/src/cli/ota.rs

@@ -400,6 +400,128 @@ fn get_vbmeta_patch_order(
     Ok(order)
 }
 
+/// Copy the hash or hashtree descriptor from the child image header into the
+/// parent image header if the child is unsigned or update the parent's chain
+/// descriptor if the child is signed. The existing descriptor in the parent
+/// must have the same type as the child.
+fn update_security_descriptors(
+    parent_header: &mut Header,
+    child_header: &Header,
+    parent_name: &str,
+    child_name: &str,
+) -> Result<()> {
+    // This can't fail since the descriptor must have existed for the dependency
+    // to exist.
+    let parent_descriptor = parent_header
+        .descriptors
+        .iter_mut()
+        .find(|d| d.partition_name() == Some(child_name))
+        .unwrap();
+    let parent_type = parent_descriptor.type_name();
+
+    if child_header.public_key.is_empty() {
+        // vbmeta is unsigned. Copy the child's existing descriptor.
+        let Some(child_descriptor) = child_header
+            .descriptors
+            .iter()
+            .find(|d| d.partition_name() == Some(child_name))
+        else {
+            bail!("{child_name} has no descriptor for itself");
+        };
+        let child_type = child_descriptor.type_name();
+
+        match (parent_descriptor, child_descriptor) {
+            (Descriptor::Hash(pd), Descriptor::Hash(cd)) => {
+                *pd = cd.clone();
+            }
+            (Descriptor::HashTree(pd), Descriptor::HashTree(cd)) => {
+                *pd = cd.clone();
+            }
+            _ => {
+                bail!("{child_name} descriptor ({child_type}) does not match entry in {parent_name} ({parent_type})");
+            }
+        }
+    } else {
+        // vbmeta is signed; Use a chain descriptor.
+        match parent_descriptor {
+            Descriptor::ChainPartition(pd) => {
+                pd.public_key = child_header.public_key.clone();
+            }
+            _ => {
+                bail!("{child_name} descriptor ({parent_type}) in {parent_name} must be a chain descriptor");
+            }
+        }
+    }
+
+    Ok(())
+}
+
+/// Get the text before the first equal sign in the kernel command line if it is
+/// not empty.
+fn cmdline_prefix(cmdline: &str) -> Option<&str> {
+    let Some((prefix, _)) = cmdline.split_once('=') else {
+        return None;
+    };
+    if prefix.is_empty() {
+        return None;
+    }
+
+    Some(prefix)
+}
+
+/// Merge property descriptors and kernel command line descriptors from the
+/// child into the parent. The property descriptors are matched based on the
+/// entire property key. The kernel command line descriptors are matched based
+/// on the non-empty text left of the first equal sign (if it exists).
+///
+/// This is a no-op if the child is signed because it is expected to be chain
+/// loaded by the parent.
+fn update_metadata_descriptors(parent_header: &mut Header, child_header: &Header) {
+    if !child_header.public_key.is_empty() {
+        return;
+    }
+
+    for child_descriptor in &child_header.descriptors {
+        match child_descriptor {
+            Descriptor::Property(cd) => {
+                let parent_property = parent_header.descriptors.iter_mut().find_map(|d| match d {
+                    Descriptor::Property(p) if p.key == cd.key => Some(p),
+                    _ => None,
+                });
+
+                if let Some(pd) = parent_property {
+                    pd.value = cd.value.clone();
+                } else {
+                    parent_header
+                        .descriptors
+                        .push(Descriptor::Property(cd.clone()));
+                }
+            }
+            Descriptor::KernelCmdline(cd) => {
+                let Some(prefix) = cmdline_prefix(&cd.cmdline) else {
+                    continue;
+                };
+
+                let parent_property = parent_header.descriptors.iter_mut().find_map(|d| match d {
+                    Descriptor::KernelCmdline(p) if cmdline_prefix(&p.cmdline) == Some(prefix) => {
+                        Some(p)
+                    }
+                    _ => None,
+                });
+
+                if let Some(pd) = parent_property {
+                    pd.cmdline = cd.cmdline.clone();
+                } else {
+                    parent_header
+                        .descriptors
+                        .push(Descriptor::KernelCmdline(cd.clone()));
+                }
+            }
+            _ => {}
+        }
+    }
+}
+
 /// Update vbmeta headers.
 ///
 /// * If [`Header::flags`] is non-zero, then an error is returned because the
@@ -438,50 +560,12 @@ fn update_vbmeta_headers(
         }
 
         for dep in deps.iter() {
-            // This can't fail since the descriptor must have existed for the
-            // dependency to exist.
-            let parent_descriptor = parent_header
-                .descriptors
-                .iter_mut()
-                .find(|d| d.partition_name() == Some(dep))
-                .unwrap();
-
             let reader = images.get_mut(dep).unwrap();
             let (header, _, _) = avb::load_image(reader)
                 .with_context(|| format!("Failed to load vbmeta footer from image: {dep}"))?;
 
-            if header.public_key.is_empty() {
-                // vbmeta is unsigned. Use the existing descriptor.
-                let Some(descriptor) = header
-                    .descriptors
-                    .iter()
-                    .find(|d| d.partition_name() == Some(dep))
-                else {
-                    bail!("{name} has no descriptor for itself");
-                };
-
-                match (parent_descriptor, descriptor) {
-                    (Descriptor::Hash(pd), Descriptor::Hash(d)) => {
-                        *pd = d.clone();
-                    }
-                    (Descriptor::HashTree(pd), Descriptor::HashTree(d)) => {
-                        *pd = d.clone();
-                    }
-                    _ => {
-                        bail!("{name}'s descriptor for {dep} must match {dep}'s self descriptor");
-                    }
-                }
-            } else {
-                // vbmeta is signed; Use a chain descriptor.
-                match parent_descriptor {
-                    Descriptor::ChainPartition(d) => {
-                        d.public_key = header.public_key;
-                    }
-                    _ => {
-                        bail!("{name}'s descriptor for {dep} must be a chain descriptor");
-                    }
-                }
-            }
+            update_security_descriptors(parent_header, &header, name, dep)?;
+            update_metadata_descriptors(parent_header, &header);
         }
 
         // Only sign and rewrite the image if we need to. Some vbmeta images may

avbroot/src/format/avb.rs

@@ -379,6 +379,9 @@ impl fmt::Debug for HashTreeDescriptor {
 }
 
 impl HashTreeDescriptor {
+    pub const FLAG_DO_NOT_USE_AB: u32 = 1 << 0;
+    pub const FLAG_CHECK_AT_MOST_ONCE: u32 = 1 << 1;
+
     /// Calculate the hash tree digests for a single level of the tree. If the
     /// reader's position is block-aligned and `image_size` is a multiple of the
     /// block size, then this function can also be used to calculate the digests
@@ -1053,6 +1056,11 @@ pub struct KernelCmdlineDescriptor {
     pub cmdline: String,
 }
 
+impl KernelCmdlineDescriptor {
+    pub const FLAG_USE_ONLY_IF_HASHTREE_NOT_DISABLED: u32 = 1 << 0;
+    pub const FLAG_USE_ONLY_IF_HASHTREE_DISABLED: u32 = 1 << 1;
+}
+
 impl DescriptorTag for KernelCmdlineDescriptor {
     const TAG: u64 = 3;
 }
@@ -1193,6 +1201,17 @@ pub enum Descriptor {
 }
 
 impl Descriptor {
+    pub fn type_name(&self) -> &'static str {
+        match self {
+            Self::Property(_) => "Property",
+            Self::HashTree(_) => "HashTree",
+            Self::Hash(_) => "Hash",
+            Self::KernelCmdline(_) => "KernelCmdline",
+            Self::ChainPartition(_) => "ChainPartition",
+            Self::Unknown { .. } => "Unknown",
+        }
+    }
+
     pub fn partition_name(&self) -> Option<&str> {
         match self {
             Self::HashTree(d) => Some(&d.partition_name),

avbroot/src/format/compression.rs

@@ -10,14 +10,22 @@ use flate2::{read::GzDecoder, write::GzEncoder, Compression};
 use lz4_flex::frame::FrameDecoder;
 use serde::{Deserialize, Serialize};
 use thiserror::Error;
+use xz2::{
+    read::XzDecoder,
+    stream::{Check, Stream},
+    write::XzEncoder,
+};
 
 static GZIP_MAGIC: &[u8; 2] = b"\x1f\x8b";
 static LZ4_LEGACY_MAGIC: &[u8; 4] = b"\x02\x21\x4c\x18";
+static XZ_MAGIC: &[u8; 6] = b"\xfd\x37\x7a\x58\x5a\x00";
 
 #[derive(Debug, Error)]
 pub enum Error {
     #[error("Unknown compression format")]
     UnknownFormat,
+    #[error("XZ stream error")]
+    XzStream(#[from] xz2::stream::Error),
     #[error("I/O error")]
     Io(#[from] io::Error),
 }
@@ -102,25 +110,29 @@ pub enum CompressedFormat {
     None,
     Gzip,
     Lz4Legacy,
+    Xz,
 }
 
 pub enum CompressedReader<R: Read> {
     None(R),
     Gzip(GzDecoder<R>),
     Lz4(FrameDecoder<R>),
+    Xz(XzDecoder<R>),
 }
 
 impl<R: Read + Seek> CompressedReader<R> {
     pub fn new(mut reader: R, raw_if_unknown: bool) -> Result<Self> {
-        let mut magic = [0u8; 4];
+        let mut magic = [0u8; 6];
         reader.read_exact(&mut magic)?;
 
         reader.rewind()?;
 
         if &magic[0..2] == GZIP_MAGIC {
             Ok(Self::Gzip(GzDecoder::new(reader)))
-        } else if &magic == LZ4_LEGACY_MAGIC {
+        } else if &magic[0..4] == LZ4_LEGACY_MAGIC {
             Ok(Self::Lz4(FrameDecoder::new(reader)))
+        } else if &magic == XZ_MAGIC {
+            Ok(Self::Xz(XzDecoder::new(reader)))
         } else if raw_if_unknown {
             Ok(Self::None(reader))
         } else {
@@ -133,6 +145,7 @@ impl<R: Read + Seek> CompressedReader<R> {
             Self::None(_) => CompressedFormat::None,
             Self::Gzip(_) => CompressedFormat::Gzip,
             Self::Lz4(_) => CompressedFormat::Lz4Legacy,
+            Self::Xz(_) => CompressedFormat::Xz,
         }
     }
 
@@ -141,6 +154,7 @@ impl<R: Read + Seek> CompressedReader<R> {
             Self::None(r) => r,
             Self::Gzip(r) => r.into_inner(),
             Self::Lz4(r) => r.into_inner(),
+            Self::Xz(r) => r.into_inner(),
         }
     }
 }
@@ -151,6 +165,7 @@ impl<R: Read> Read for CompressedReader<R> {
             Self::None(r) => r.read(buf),
             Self::Gzip(r) => r.read(buf),
             Self::Lz4(r) => r.read(buf),
+            Self::Xz(r) => r.read(buf),
         }
     }
 }
@@ -159,6 +174,7 @@ pub enum CompressedWriter<W: Write> {
     None(W),
     Gzip(GzEncoder<W>),
     Lz4Legacy(Lz4LegacyEncoder<W>),
+    Xz(XzEncoder<W>),
 }
 
 impl<W: Write> CompressedWriter<W> {
@@ -169,6 +185,11 @@ impl<W: Write> CompressedWriter<W> {
                 Ok(Self::Gzip(GzEncoder::new(writer, Compression::default())))
             }
             CompressedFormat::Lz4Legacy => Ok(Self::Lz4Legacy(Lz4LegacyEncoder::new(writer)?)),
+            CompressedFormat::Xz => {
+                // Some kernels are compiled without support for the default CRC64.
+                let stream = Stream::new_easy_encoder(6, Check::Crc32)?;
+                Ok(Self::Xz(XzEncoder::new_stream(writer, stream)))
+            }
         }
     }
 
@@ -177,6 +198,7 @@ impl<W: Write> CompressedWriter<W> {
             Self::None(_) => CompressedFormat::None,
             Self::Gzip(_) => CompressedFormat::Gzip,
             Self::Lz4Legacy(_) => CompressedFormat::Lz4Legacy,
+            Self::Xz(_) => CompressedFormat::Xz,
         }
     }
 
@@ -185,6 +207,7 @@ impl<W: Write> CompressedWriter<W> {
             Self::None(w) => Ok(w),
             Self::Gzip(w) => w.finish(),
             Self::Lz4Legacy(w) => w.finish(),
+            Self::Xz(w) => w.finish(),
         }
     }
 }
@@ -195,6 +218,7 @@ impl<W: Write> Write for CompressedWriter<W> {
             Self::None(w) => w.write(buf),
             Self::Gzip(w) => w.write(buf),
             Self::Lz4Legacy(w) => w.write(buf),
+            Self::Xz(w) => w.write(buf),
         }
     }
 
@@ -203,6 +227,7 @@ impl<W: Write> Write for CompressedWriter<W> {
             Self::None(w) => w.flush(),
             Self::Gzip(w) => w.flush(),
             Self::Lz4Legacy(w) => w.flush(),
+            Self::Xz(w) => w.flush(),
         }
     }
 }

modules/clearotacerts/module.prop

@@ -1,6 +1,6 @@
 id=com.chiller3.avbroot.clearotacerts
 name=clearotacerts
-version=v2.3.0
-versionCode=131840
+version=v2.3.3
+versionCode=131843
 author=chenxiaolong
 description=Block A/B OTAs by clearing verification certificates

modules/oemunlockonboot/module.prop

@@ -1,6 +1,6 @@
 id=com.chiller3.avbroot.oemunlockonboot
 name=oemunlockonboot
-version=v2.3.0
-versionCode=131840
+version=v2.3.3
+versionCode=131843
 author=chenxiaolong
 description=Enable OEM unlocking on every boot