Version 3.3.0

Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
CHANGELOG.md: Add entry for PR #309
2026-07-03 14:05:11 +02:00 · 2024-06-23 15:51:57 -04:00 · 2024-06-22 18:47:28 -04:00 · 2024-06-22 18:42:46 -04:00 · 2024-06-22 18:38:44 -04:00 · 2024-06-21 22:36:41 -04:00
29 changed files with 1143 additions and 574 deletions
@@ -19,6 +19,7 @@ jobs:
      # https://github.com/rust-lang/rust/issues/78210
      RUSTFLAGS: -C strip=symbols -C target-feature=+crt-static
      TARGETS: ${{ join(matrix.artifact.targets, ' ') || matrix.artifact.name }}
+      ANDROID_API: ${{ matrix.artifact.android_api }}
    strategy:
      fail-fast: false
      matrix:
@@ -33,6 +34,12 @@ jobs:
              - aarch64-apple-darwin
              - x86_64-apple-darwin
            combine: lipo
+          # ubuntu-latest is not 24.04 yet and 22.04's qemu-user-static segfaults.
+          - os: ubuntu-24.04
+            name: aarch64-linux-android31
+            targets:
+              - aarch64-linux-android
+            android_api: '31'
    steps:
      - name: Check out repository
        uses: actions/checkout@v4
@@ -40,6 +47,26 @@ jobs:
          # For git describe
          fetch-depth: 0

+      - name: Install qemu-user-static
+        if: ${{ contains(matrix.artifact.name, 'android') }}
+        shell: bash
+        run: |
+          sudo apt-get -y update
+          sudo apt-get -y install qemu-user-static
+
+      - name: Set Android temporary directory
+        if: ${{ contains(matrix.artifact.name, 'android') }}
+        shell: bash
+        run: |
+          echo "TMPDIR=/tmp" >> "${GITHUB_ENV}"
+
+      - name: Install cargo-android
+        shell: bash
+        run: |
+          cargo install \
+              --git https://github.com/chenxiaolong/cargo-android \
+              --tag v0.1.1
+
      - name: Get version
        id: get_version
        shell: bash
@@ -63,7 +90,8 @@ jobs:
        shell: bash
        run: |
          for target in ${TARGETS}; do
-              cargo clippy --release --workspace --features static \
+              cargo android \
+                  clippy --release --workspace --features static \
                  --target "${target}"
          done

@@ -71,7 +99,8 @@ jobs:
        shell: bash
        run: |
          for target in ${TARGETS}; do
-              cargo build --release --workspace --features static \
+              cargo android \
+                  build --release --workspace --features static \
                  --target "${target}"
          done

@@ -79,7 +108,8 @@ jobs:
        shell: bash
        run: |
          for target in ${TARGETS}; do
-              cargo test --release --workspace --features static \
+              cargo android \
+                  test --release --workspace --features static \
                  --target "${target}"
          done

@@ -87,7 +117,8 @@ jobs:
        shell: bash
        run: |
          for target in ${TARGETS}; do
-              cargo run --release -p e2e --features static \
+              cargo android \
+                  run --release -p e2e --features static \
                  --target "${target}" \
                  -- test -a -c e2e/e2e.toml
          done
@@ -7,6 +7,32 @@
    to update the actual links at the bottom of the file.
 -->

+### Version 3.3.0
+
+* Recompute CoW size estimate when replacing dynamic partitions ([Issue #306], [PR #307])
+  * Fixes out of space error when flashing a patched OTA that uses `--replace` to replace a dynamic partition (eg. `system`) with a larger or more incompressible image
+* Add `avbroot payload info` subcommand for inspecting `payload.bin` headers ([PR #309])
+
+### Version 3.2.3
+
+* Add prebuilt binary for Android (aarch64) ([PR #304])
+
+### Version 3.2.2
+
+* Add new `--recompute-size` option to `avbroot avb pack` to automatically recompute the image size for resizable images ([Discussion #294], [PR #296])
+* Add new `--output-info` option to `avbroot avb pack` to write a new `avb.toml` file containing computed values ([PR #297])
+* Add support for upcoming Magisk Canary 27003 ([Issue #301], [PR #268])
+
+### Version 3.2.1
+
+* Increase hash tree and FEC size limits to accommodate partition images up to 8 GiB ([Issue #291], [PR #293])
+
+### Version 3.2.0
+
+* Fix potential infinite loop when interrupting avbroot at the right moment to a bug in the bzip2-rs library ([Issue #285], [PR #287])
+* Update all dependencies and fix new clippy lints ([PR #288])
+* Add support for adding the custom AVB public key to the list of trusted keys for DSU (booting signed GSIs) ([Discussion #286], [PR #289])
+
 ### Version 3.1.3

 * Build universal binary for macOS ([Issue #278], [PR #279])
@@ -170,6 +196,8 @@ Behind-the-scenes changes:
 <!-- Do not manually edit the lines below. Use `cargo xtask update-changelog` to regenerate. -->
 [Discussion #195]: https://github.com/chenxiaolong/avbroot/discussions/195
 [Discussion #235]: https://github.com/chenxiaolong/avbroot/discussions/235
+[Discussion #286]: https://github.com/chenxiaolong/avbroot/discussions/286
+[Discussion #294]: https://github.com/chenxiaolong/avbroot/discussions/294
 [Issue #138]: https://github.com/chenxiaolong/avbroot/issues/138
 [Issue #144]: https://github.com/chenxiaolong/avbroot/issues/144
 [Issue #145]: https://github.com/chenxiaolong/avbroot/issues/145
@@ -186,6 +214,10 @@ Behind-the-scenes changes:
 [Issue #225]: https://github.com/chenxiaolong/avbroot/issues/225
 [Issue #265]: https://github.com/chenxiaolong/avbroot/issues/265
 [Issue #278]: https://github.com/chenxiaolong/avbroot/issues/278
+[Issue #285]: https://github.com/chenxiaolong/avbroot/issues/285
+[Issue #291]: https://github.com/chenxiaolong/avbroot/issues/291
+[Issue #301]: https://github.com/chenxiaolong/avbroot/issues/301
+[Issue #306]: https://github.com/chenxiaolong/avbroot/issues/306
 [PR #130]: https://github.com/chenxiaolong/avbroot/pull/130
 [PR #132]: https://github.com/chenxiaolong/avbroot/pull/132
 [PR #133]: https://github.com/chenxiaolong/avbroot/pull/133
@@ -264,6 +296,16 @@ Behind-the-scenes changes:
 [PR #256]: https://github.com/chenxiaolong/avbroot/pull/256
 [PR #257]: https://github.com/chenxiaolong/avbroot/pull/257
 [PR #261]: https://github.com/chenxiaolong/avbroot/pull/261
+[PR #268]: https://github.com/chenxiaolong/avbroot/pull/268
 [PR #276]: https://github.com/chenxiaolong/avbroot/pull/276
 [PR #277]: https://github.com/chenxiaolong/avbroot/pull/277
 [PR #279]: https://github.com/chenxiaolong/avbroot/pull/279
+[PR #287]: https://github.com/chenxiaolong/avbroot/pull/287
+[PR #288]: https://github.com/chenxiaolong/avbroot/pull/288
+[PR #289]: https://github.com/chenxiaolong/avbroot/pull/289
+[PR #293]: https://github.com/chenxiaolong/avbroot/pull/293
+[PR #296]: https://github.com/chenxiaolong/avbroot/pull/296
+[PR #297]: https://github.com/chenxiaolong/avbroot/pull/297
+[PR #304]: https://github.com/chenxiaolong/avbroot/pull/304
+[PR #307]: https://github.com/chenxiaolong/avbroot/pull/307
+[PR #309]: https://github.com/chenxiaolong/avbroot/pull/309
@@ -4,7 +4,7 @@ members = ["avbroot", "e2e", "fuzz", "xtask"]
 resolver = "2"

 [workspace.package]
-version = "3.1.3"
+version = "3.3.0"
 license = "GPL-3.0-only"
 edition = "2021"
 repository = "https://github.com/chenxiaolong/avbroot"
@@ -32,6 +32,10 @@ This subcommand packs a new AVB image from the `avb.toml` file and, for appended

 Note that if the image is an appended image and its hash or hash tree descriptor uses an insecure algorithm, like `sha1`, then it will automatically be promoted to `sha256`.

+By default, for appended vbmeta images, the output image size will match the size of the original image that was unpacked. This size is specified by the `image_size` field in `avb.toml`. If the image is resizable (eg. `system`), then passing in `--recompute-size` will cause the `image_size` field to be ignored and the smallest possible output file that fits the raw image and AVB metadata will be built. This avoids wasting space if `raw.img` shrunk or allows the packing to work at all if `raw.img` grew. **Do not use this option for non-resizable images** (eg. `boot`) or else the device won't be able to boot.
+
+When packing an image, several of the fields in `avb.toml` may potentially be recomputed. To write a TOML file containing the new values, use `--output-info <output TOML>`. It is safe to overwrite the existing `avb.toml` if desired.
+
 ### Repacking an AVB image

 ```bash
@@ -248,3 +252,13 @@ avbroot hash-tree verify -i <input data file> -H <input hash tree file>
 ```

 This will check if the input file has any corrupted blocks. Currently, the command cannot report which specific blocks are corrupted, only whether the file is valid.
+
+## `avbroot payload`
+
+### Showing payload header information
+
+```bash
+avbroot payload info -i <payload>
+```
+
+This subcommand shows all of the payload header fields (which will likely be extremely long).
@@ -15,9 +15,9 @@ Having a good understanding of how AVB and A/B OTAs work is recommended prior to
  * `payload.bin` exists
  * `META-INF/com/android/metadata` (Android 10-11) or `META-INF/com/android/metadata.pb` (Android 12+) exists

-* The device must support using a custom public key for the bootloader's root of trust. This is normally done via the `fastboot flash avb_custom_key` command. All Pixel devices with unlockable bootloaders since the Pixel 2 support this. Other devices may support it as well, but there's no easy way to check without just trying it.
+* The device must support using a custom public key for the bootloader's root of trust. This is normally done via the `fastboot flash avb_custom_key` command.

-  * NOTE: Some OnePlus devices have a broken implementation where a custom public key can be set, but the device won't boot despite having proper signatures. Downgrading the bootloader to the version shipped with Android 11 might potentially help. This problem has been reported across multiple OnePlus models ([#186](https://github.com/chenxiaolong/avbroot/issues/186), [#195](https://github.com/chenxiaolong/avbroot/discussions/195), [#212](https://github.com/chenxiaolong/avbroot/issues/212)).
+  A list of devices known to work can be found in the issue tracker at [#299](https://github.com/chenxiaolong/avbroot/issues/299).

 ## Patches

@@ -363,6 +363,12 @@ The only behavior this changes is where the partition is read from. When using `

 This has no impact on what patches are applied. For example, when using Magisk, the root patch is applied to the boot partition, no matter if the partition came from the original `payload.bin` or from `--replace`.

+### Booting signed GSIs
+
+Android's [Dynamic System Updates (DSU)](https://developer.android.com/topic/dsu) feature uses a different root of trust than the regular system. Instead of using the bootloader's `avb_custom_key`, it obtains the trusted keys from the `first_stage_ramdisk/avb/*.avbpubkey` files inside the `init_boot` or `vendor_boot` ramdisk. These files are encoded in the same binary format as `avb_pkmd.bin`.
+
+avbroot can add the custom AVB public key to this directory by passing in `--dsu` when patching an OTA. This allows booting [Generic System Images (GSI)](https://developer.android.com/topic/generic-system-image) signed by the custom AVB key.
+
 ### Clearing vbmeta flags

 Some Android builds may ship with a root `vbmeta` image with the flags set such that AVB is effectively disabled. When avbroot encounters these images, the patching process will fail with a message like:
@@ -434,6 +440,16 @@ Debug builds work too, but they will run significantly slower (in the sha256 com

 By default, the executable links to the system's bzip2 and liblzma libraries, which are the only external libraries avbroot depends on. To compile and statically link these two libraries, pass in `--features static`.

+### Android cross-compilation
+
+To cross-compile for Android, install [cargo-android](https://github.com/chenxiaolong/cargo-android) and use the `cargo android` wrapper. To make a release build for aarch64, run:
+
+```bash
+cargo android build --release --target aarch64-linux-android
+```
+
+It is possible to run the tests if the host is running Linux, qemu-user-static is installed, and the executable is built with `RUSTFLAGS=-C target-feature=+crt-static` and `--features static`.
+
 ## Verifying digital signatures

 First, save the public key to a file listing the keys to be trusted. This is the same key listed in [the author's profile](https://github.com/chenxiaolong/).
@@ -13,9 +13,9 @@ avbroot – это программа для модификации OTA-обра
  * наличие файла `payload.bin` (обычно находится в корне архива)
  * наличие файла `META-INF/com/android/metadata` (Android 10-11) или `META-INF/com/android/metadata.pb` (Android 12+)

-* Устройство должно поддерживать установку пользовательского публичного ключа для подтверждения статуса доверия загрузчика. Обычно это делается с помощью команды `fastboot flash avb_custom_key`. Все устройства Pixel с разблокируемым загрузчиком, начиная с Pixel 2, поддерживают эту функцию. Другие устройства тоже могут поддерживать её, но достоверно убедиться в этом можно только проверив лично.
+* Устройство должно поддерживать установку пользовательского публичного ключа для подтверждения статуса доверия загрузчика. Обычно это производится с помощью команды `fastboot flash avb_custom_key`.

-  * ПРИМЕЧАНИЕ: Некоторые девайсы от OnePlus имеют некорректную реализацию, где возможна установка кастомного публичного ключа, но устройство все равно не будет загружаться, несмотря на наличие корректной подписи. Понижение загрузчика до версии, поставляемой вместе с Android 11, потенциально может помочь. Уже сообщалось о наличии этой проблемы на нескольких устройствах OnePlus ([#186,](https://github.com/chenxiaolong/avbroot/issues/186) [#195,](https://github.com/chenxiaolong/avbroot/discussions/195) [#212](https://github.com/chenxiaolong/avbroot/issues/212)).
+  Список девайсов, на которых проверялась совместимость с указанным выше функционалом, находится здесь: [#299.](https://github.com/chenxiaolong/avbroot/issues/299)

 ## Патчи

@@ -10,7 +10,7 @@ publish = false

 [dependencies]
 anyhow = "1.0.75"
-base64 = "0.21.3"
+base64 = "0.22.1"
 bitflags = "2.4.1"
 bstr = "1.6.2"
 byteorder = "1.4.3"
@@ -24,7 +24,7 @@ ctrlc = "3.4.0"
 flate2 = "1.0.27"
 gf256 = { version = "0.3.0", features = ["rs"] }
 hex = { version = "0.4.3", features = ["serde"] }
-liblzma = "0.2.1"
+liblzma = "0.3.0"
 lz4_flex = "0.11.1"
 memchr = "2.6.0"
 num-bigint-dig = "0.8.4"
@@ -47,20 +47,18 @@ sha1 = "0.10.5"
 sha2 = "0.10.7"
 tempfile = "3.8.0"
 thiserror = "1.0.47"
-toml_edit = { version = "0.21.0", features = ["serde"] }
+toml_edit = { version = "0.22.9", features = ["serde"] }
 topological-sort = "0.2.2"
 tracing = "0.1.40"
 tracing-subscriber = "0.3.18"
 x509-cert = { version = "0.2.4", features = ["builder"] }

-# There's an upstream bug that causes an infinite loop in the write::BzDecoder
-# destructor if the decoder is fed invalid data. While this never happens during
-# normal operation, it is possible to run into this by running `ota extract`
-# against a `--stripped` OTA file.
-# https://github.com/alexcrichton/bzip2-rs/pull/99
+# There are multiple upstream bugs that cause infinite loops in the Drop
+# implementation of write::BzDecoder. Unfortunately, the project is no longer
+# maintained, so we have to maintain our own fork with the necessary fixes.
 [dependencies.bzip2]
-git = "https://github.com/jongiddy/bzip2-rs"
-rev = "2aefcb4d3634de1df226c73d93f758d65228bb8c"
+git = "https://github.com/chenxiaolong/bzip2-rs"
+rev = "6e0f9836ec87b19261461b6cc1772e14aff8e851"

 # https://github.com/zip-rs/zip/pull/383
 [dependencies.zip]
@@ -74,7 +72,7 @@ rustix = { version = "0.38.9", default-features = false, features = ["process"]

 [build-dependencies]
 prost-build = "0.12.1"
-protox = "0.5.0"
+protox = "0.6.0"

 [dev-dependencies]
 assert_matches = "1.5.0"
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023 Andrew Gunnerson
+ * SPDX-FileCopyrightText: 2023-2024 Andrew Gunnerson
 * SPDX-License-Identifier: GPL-3.0-only
 */

@@ -15,7 +15,7 @@ use clap::{Parser, Subcommand, ValueEnum};
 use tracing::{debug, Level};
 use tracing_subscriber::fmt::{format::Writer, time::FormatTime};

-use crate::cli::{avb, boot, completion, cpio, fec, hashtree, key, ota};
+use crate::cli::{avb, boot, completion, cpio, fec, hashtree, key, ota, payload};

 #[allow(clippy::large_enum_variant)]
 #[derive(Debug, Subcommand)]
@@ -28,6 +28,7 @@ pub enum Command {
    HashTree(hashtree::HashTreeCli),
    Key(key::KeyCli),
    Ota(ota::OtaCli),
+    Payload(payload::PayloadCli),
    /// (Deprecated: Use `avbroot ota patch` instead.)
    Patch(ota::PatchCli),
    /// (Deprecated: Use `avbroot ota extract` instead.)
@@ -163,6 +164,7 @@ pub fn main(logging_initialized: &AtomicBool, cancel_signal: &AtomicBool) -> Res
        Command::HashTree(c) => hashtree::hash_tree_main(&c, cancel_signal),
        Command::Key(c) => key::key_main(&c),
        Command::Ota(c) => ota::ota_main(&c, cancel_signal),
+        Command::Payload(c) => payload::payload_main(&c),
        // Deprecated aliases.
        Command::Patch(c) => ota::patch_subcommand(&c, cancel_signal),
        Command::Extract(c) => ota::extract_subcommand(&c, cancel_signal),
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023 Andrew Gunnerson
+ * SPDX-FileCopyrightText: 2023-2024 Andrew Gunnerson
 * SPDX-License-Identifier: GPL-3.0-only
 */

@@ -57,16 +57,22 @@ fn read_avb_image(path: &Path) -> Result<(AvbInfo, BufReader<File>)> {
    Ok((info, reader))
 }

-fn write_avb_image(file: PSeekFile, info: &mut AvbInfo) -> Result<()> {
+fn write_avb_image(file: PSeekFile, info: &mut AvbInfo, recompute_size: bool) -> Result<()> {
    let mut writer = BufWriter::new(file);

-    if let Some(f) = &mut info.footer {
-        avb::write_appended_image(&mut writer, &info.header, f, info.image_size)
-            .context("Failed to write appended AVB image")?;
+    info.image_size = if let Some(f) = &mut info.footer {
+        let image_size = if recompute_size {
+            None
+        } else {
+            Some(info.image_size)
+        };
+
+        avb::write_appended_image(&mut writer, &info.header, f, image_size)
+            .context("Failed to write appended AVB image")?
    } else {
        avb::write_root_image(&mut writer, &info.header, 4096)
-            .context("Failed to write root AVB image")?;
-    }
+            .context("Failed to write root AVB image")?
+    };

    writer.flush().context("Failed to flush writes")?;

@@ -94,15 +100,13 @@ fn write_info(path: &Path, info: &AvbInfo) -> Result<()> {

 /// Packing with insecure algorithms is intentionally not supported, so promote
 /// to a secure algorithm if needed.
-fn promote_insecure_hash_algorithm(algorithm: &str) -> &str {
+fn promote_insecure_hash_algorithm(algorithm: &mut String) {
    const INSECURE_ALGORITHMS: &[&str] = &["sha1"];
    const NEW_ALGORITHM: &str = "sha256";

-    if INSECURE_ALGORITHMS.contains(&algorithm) {
+    if INSECURE_ALGORITHMS.contains(&algorithm.as_str()) {
        warn!("Changing insecure hash algorithm {algorithm} to {NEW_ALGORITHM}");
-        NEW_ALGORITHM
-    } else {
-        algorithm
+        NEW_ALGORITHM.clone_into(algorithm);
    }
 }

@@ -193,13 +197,13 @@ fn write_raw_and_update(

    match info.header.appended_descriptor_mut()? {
        AppendedDescriptorMut::HashTree(d) => {
-            d.hash_algorithm = promote_insecure_hash_algorithm(&d.hash_algorithm).to_owned();
+            promote_insecure_hash_algorithm(&mut d.hash_algorithm);
            d.image_size = image_size;
            d.update(&raw_file, &raw_file, None, cancel_signal)
                .context("Failed to update hash tree descriptor")?;
        }
        AppendedDescriptorMut::Hash(d) => {
-            d.hash_algorithm = promote_insecure_hash_algorithm(&d.hash_algorithm).to_owned();
+            promote_insecure_hash_algorithm(&mut d.hash_algorithm);
            d.image_size = image_size;
            raw_file.rewind()?;
            d.update(&mut raw_file, cancel_signal)
@@ -627,12 +631,16 @@ fn pack_subcommand(cli: &PackCli, cancel_signal: &AtomicBool) -> Result<()> {

    sign_or_clear(&mut info, &orig_header, &cli.key)?;

-    write_avb_image(file, &mut info)?;
+    write_avb_image(file, &mut info, cli.recompute_size)?;

    // We display the info at the very end after both the header and footer are
    // updated so that incorrect/incomplete information isn't shown.
    display_info(&cli.display, &info);

+    if let Some(path) = &cli.output_info {
+        write_info(path, &info)?;
+    }
+
    Ok(())
 }

@@ -646,7 +654,7 @@ fn repack_subcommand(cli: &RepackCli, cancel_signal: &AtomicBool) -> Result<()>
        // Write new hash tree and FEC data instead of copying the original.
        // There could have been errors in the original FEC data itself.
        if let AppendedDescriptorMut::HashTree(d) = info.header.appended_descriptor_mut()? {
-            d.hash_algorithm = promote_insecure_hash_algorithm(&d.hash_algorithm).to_owned();
+            promote_insecure_hash_algorithm(&mut d.hash_algorithm);
            d.update(&file, &file, None, cancel_signal)?;
        }

@@ -661,7 +669,7 @@ fn repack_subcommand(cli: &RepackCli, cancel_signal: &AtomicBool) -> Result<()>

    sign_or_clear(&mut info, &orig_header, &cli.key)?;

-    write_avb_image(file, &mut info)?;
+    write_avb_image(file, &mut info, false)?;

    // We display the info at the very end after both the header and footer are
    // updated so that incorrect/incomplete information isn't shown.
@@ -829,12 +837,28 @@ struct PackCli {
    #[arg(long, value_name = "FILE", value_parser, default_value = "avb.toml")]
    input_info: PathBuf,

+    /// Path to output AVB info TOML.
+    ///
+    /// If specified, the AVB info containing all recomputed fields will be
+    /// written to this file. This can point to the same file as --input-info.
+    #[arg(long, value_name = "FILE", value_parser)]
+    output_info: Option<PathBuf>,
+
    /// Path to input raw image.
    ///
    /// Appended AVB images require a raw image.
    #[arg(long, value_name = "FILE", value_parser, default_value = "raw.img")]
    input_raw: PathBuf,

+    /// Recompute image size.
+    ///
+    /// By default, it is assumed that the image has a fixed size specified by
+    /// the image_size top-level field in the AVB info TOML. If flag is passed,
+    /// then that field is ignored and the smallest possible output image will
+    /// be created.
+    #[arg(long)]
+    recompute_size: bool,
+
    #[command(flatten)]
    key: KeyGroup,

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023 Andrew Gunnerson
+ * SPDX-FileCopyrightText: 2023-2024 Andrew Gunnerson
 * SPDX-License-Identifier: GPL-3.0-only
 */

@@ -12,3 +12,4 @@ pub mod fec;
 pub mod hashtree;
 pub mod key;
 pub mod ota;
+pub mod payload;
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2022-2023 Andrew Gunnerson
+ * SPDX-FileCopyrightText: 2022-2024 Andrew Gunnerson
 * SPDX-License-Identifier: GPL-3.0-only
 */

@@ -10,6 +10,7 @@ use std::{
    fmt::Display,
    fs::{self, File},
    io::{self, BufReader, BufWriter, Read, Seek, SeekFrom, Write},
+    mem,
    ops::Range,
    path::{Path, PathBuf},
    sync::{atomic::AtomicBool, Mutex},
@@ -31,14 +32,16 @@ use crate::{
    cli,
    crypto::{self, PassphraseSource},
    format::{
-        avb::Header,
-        avb::{self, Descriptor},
+        avb::{self, Descriptor, Header},
        ota::{self, SigningWriter, ZipEntry},
        padding,
        payload::{self, PayloadHeader, PayloadWriter},
    },
    patch::{
-        boot::{self, BootImagePatch, MagiskRootPatcher, OtaCertPatcher, PrepatchedImagePatcher},
+        boot::{
+            self, BootImagePatch, DsuPubKeyPatcher, MagiskRootPatcher, OtaCertPatcher,
+            PrepatchedImagePatcher,
+        },
        system,
    },
    protobuf::{
@@ -187,26 +190,17 @@ fn open_input_files(
 }

 /// Patch the boot images listed in `required_images`. Not every image is
-/// necessarily patched. An [`OtaCertPatcher`] is always applied to the boot
-/// image that contains the trusted OTA certificate list. If `root_patcher` is
-/// specified, then it is used to patch the boot image for root access. If the
-/// original image is signed, then it will be re-signed with `key_avb`.
+/// necessarily patched. Each patcher will determine which image it should
+/// target. If the original image is signed, then it will be re-signed with
+/// `key_avb`.
 fn patch_boot_images<'a, 'b: 'a>(
    required_images: &'b RequiredImages,
    input_files: &mut HashMap<String, InputFile>,
-    root_patcher: Option<Box<dyn BootImagePatch + Sync>>,
+    boot_patchers: Vec<Box<dyn BootImagePatch + Sync>>,
    key_avb: &RsaPrivateKey,
-    cert_ota: &Certificate,
    cancel_signal: &AtomicBool,
 ) -> Result<()> {
    let input_files = Mutex::new(input_files);
-    let mut boot_patchers = Vec::<Box<dyn BootImagePatch + Sync>>::new();
-    boot_patchers.push(Box::new(OtaCertPatcher::new(cert_ota.clone())));
-
-    if let Some(p) = root_patcher {
-        boot_patchers.push(p);
-    }
-
    let boot_partitions = required_images.iter_boot().collect::<Vec<_>>();

    info!(
@@ -479,7 +473,7 @@ fn update_security_descriptors(
        // vbmeta is signed; Use a chain descriptor.
        match parent_descriptor {
            Descriptor::ChainPartition(pd) => {
-                pd.public_key = child_header.public_key.clone();
+                child_header.public_key.clone_into(&mut pd.public_key);
            }
            _ => {
                bail!("{child_name} descriptor ({parent_type}) in {parent_name} must be a chain descriptor");
@@ -522,7 +516,7 @@ fn update_metadata_descriptors(parent_header: &mut Header, child_header: &Header
                });

                if let Some(pd) = parent_property {
-                    pd.value = cd.value.clone();
+                    cd.value.clone_into(&mut pd.value);
                } else {
                    parent_header
                        .descriptors
@@ -542,7 +536,7 @@ fn update_metadata_descriptors(parent_header: &mut Header, child_header: &Header
                });

                if let Some(pd) = parent_property {
-                    pd.cmdline = cd.cmdline.clone();
+                    cd.cmdline.clone_into(&mut pd.cmdline);
                } else {
                    parent_header
                        .descriptors
@@ -680,12 +674,40 @@ fn compress_image(

    info!("Compressing full image: {name}");

-    // Otherwise, compress the entire image.
-    let (partition_info, operations) =
-        payload::compress_image(&*file, &writer, name, block_size, cancel_signal)?;
+    // Otherwise, compress the entire image. If VABC is enabled, we need to
+    // update the CoW size estimate or else the CoW block device may run out of
+    // space during flashing.
+    let need_cow = partition.estimate_cow_size.is_some();
+    if need_cow {
+        info!("Needs updated CoW size estimate: {name}");
+
+        // Only CoW v2 + lz4 seems to exist in the wild currently, so that is
+        // all we support.
+        let Some(dpm) = &header.manifest.dynamic_partition_metadata else {
+            bail!("Dynamic partition metadata is missing");
+        };
+
+        if !dpm.vabc_enabled() {
+            bail!("Partition has CoW estimate, but VABC is disabled: {name}");
+        }
+
+        let cow_version = dpm.cow_version();
+        if dpm.cow_version() != 2 {
+            bail!("Unsupported CoW version: {cow_version}");
+        }
+
+        let compression = dpm.vabc_compression_param();
+        if compression != "lz4" {
+            bail!("Unsupported VABC compression: {compression}");
+        }
+    }
+
+    let (partition_info, operations, cow_estimate) =
+        payload::compress_image(&*file, &writer, name, block_size, need_cow, cancel_signal)?;

    partition.new_partition_info = Some(partition_info);
    partition.operations = operations;
+    partition.estimate_cow_size = cow_estimate;

    *file = writer;

@@ -698,7 +720,7 @@ fn patch_ota_payload(
    payload: &(dyn ReadSeekReopen + Sync),
    writer: impl Write,
    external_images: &HashMap<String, PathBuf>,
-    root_patcher: Option<Box<dyn BootImagePatch + Sync>>,
+    boot_patchers: Vec<Box<dyn BootImagePatch + Sync>>,
    clear_vbmeta_flags: bool,
    key_avb: &RsaPrivateKey,
    key_ota: &RsaPrivateKey,
@@ -750,9 +772,8 @@ fn patch_ota_payload(
    patch_boot_images(
        &required_images,
        &mut input_files,
-        root_patcher,
+        boot_patchers,
        key_avb,
-        cert_ota,
        cancel_signal,
    )?;

@@ -893,7 +914,7 @@ fn patch_ota_zip(
    zip_reader: &mut ZipArchive<impl Read + Seek>,
    mut zip_writer: &mut ZipWriter<impl Write>,
    external_images: &HashMap<String, PathBuf>,
-    mut root_patch: Option<Box<dyn BootImagePatch + Sync>>,
+    mut boot_patchers: Vec<Box<dyn BootImagePatch + Sync>>,
    clear_vbmeta_flags: bool,
    key_avb: &RsaPrivateKey,
    key_ota: &RsaPrivateKey,
@@ -1015,7 +1036,7 @@ fn patch_ota_zip(
                    &mut writer,
                    external_images,
                    // There's only one payload in the OTA.
-                    root_patch.take(),
+                    mem::take(&mut boot_patchers),
                    clear_vbmeta_flags,
                    key_avb,
                    key_ota,
@@ -1223,8 +1244,11 @@ pub fn patch_subcommand(cli: &PatchCli, cancel_signal: &AtomicBool) -> Result<()
        external_images.insert(name.to_owned(), path.to_owned());
    }

-    let root_patcher = if let Some(magisk) = &cli.root.magisk {
-        let patcher: Box<dyn BootImagePatch + Sync> = Box::new(
+    let mut boot_patchers = Vec::<Box<dyn BootImagePatch + Sync>>::new();
+    boot_patchers.push(Box::new(OtaCertPatcher::new(cert_ota.clone())));
+
+    if let Some(magisk) = &cli.root.magisk {
+        boot_patchers.push(Box::new(
            MagiskRootPatcher::new(
                magisk,
                cli.magisk_preinit_device.as_deref(),
@@ -1232,21 +1256,20 @@ pub fn patch_subcommand(cli: &PatchCli, cancel_signal: &AtomicBool) -> Result<()
                cli.ignore_magisk_warnings,
            )
            .context("Failed to create Magisk boot image patcher")?,
-        );
-
-        Some(patcher)
+        ));
    } else if let Some(prepatched) = &cli.root.prepatched {
-        let patcher: Box<dyn BootImagePatch + Sync> = Box::new(PrepatchedImagePatcher::new(
+        boot_patchers.push(Box::new(PrepatchedImagePatcher::new(
            prepatched,
            cli.ignore_prepatched_compat + 1,
-        ));
-
-        Some(patcher)
+        )));
    } else {
        assert!(cli.root.rootless);
-        None
    };

+    if cli.dsu {
+        boot_patchers.push(Box::new(DsuPubKeyPatcher::new(key_avb.to_public_key())));
+    }
+
    let raw_reader = File::open(&cli.input)
        .map(PSeekFile::new)
        .with_context(|| format!("Failed to open for reading: {:?}", cli.input))?;
@@ -1272,7 +1295,7 @@ pub fn patch_subcommand(cli: &PatchCli, cancel_signal: &AtomicBool) -> Result<()
        &mut zip_reader,
        &mut zip_writer,
        &external_images,
-        root_patcher,
+        boot_patchers,
        cli.clear_vbmeta_flags,
        &key_avb,
        &key_ota,
@@ -1841,6 +1864,10 @@ pub struct PatchCli {
    )]
    pub ignore_prepatched_compat: u8,

+    /// Add AVB public key to trusted keys for DSU.
+    #[arg(long, help_heading = HEADING_OTHER)]
+    pub dsu: bool,
+
    /// Forcibly clear vbmeta flags if they disable AVB.
    #[arg(long, help_heading = HEADING_OTHER)]
    pub clear_vbmeta_flags: bool,
@@ -0,0 +1,49 @@
+/*
+ * SPDX-FileCopyrightText: 2024 Andrew Gunnerson
+ * SPDX-License-Identifier: GPL-3.0-only
+ */
+
+use std::{fs::File, io::BufReader, path::PathBuf};
+
+use anyhow::{Context, Result};
+use clap::{Parser, Subcommand};
+
+use crate::{format::payload::PayloadHeader, stream::FromReader};
+
+fn info_subcommand(cli: &InfoCli) -> Result<()> {
+    let mut reader = File::open(&cli.input)
+        .map(BufReader::new)
+        .with_context(|| format!("Failed to open payload: {:?}", cli.input))?;
+    let header = PayloadHeader::from_reader(&mut reader)
+        .with_context(|| format!("Failed to read payload: {:?}", cli.input))?;
+
+    println!("{header:#?}");
+
+    Ok(())
+}
+
+pub fn payload_main(cli: &PayloadCli) -> Result<()> {
+    match &cli.command {
+        PayloadCommand::Info(c) => info_subcommand(c),
+    }
+}
+
+/// Display payload information.
+#[derive(Debug, Parser)]
+struct InfoCli {
+    /// Path to input payload file.
+    #[arg(short, long, value_name = "FILE", value_parser)]
+    input: PathBuf,
+}
+
+#[derive(Debug, Subcommand)]
+enum PayloadCommand {
+    Info(InfoCli),
+}
+
+/// Inspect OTA payloads.
+#[derive(Debug, Parser)]
+pub struct PayloadCli {
+    #[command(subcommand)]
+    command: PayloadCommand,
+}
@@ -1,10 +1,10 @@
 /*
- * SPDX-FileCopyrightText: 2023 Andrew Gunnerson
+ * SPDX-FileCopyrightText: 2023-2024 Andrew Gunnerson
 * SPDX-License-Identifier: GPL-3.0-only
 */

 use std::{
-    cmp, fmt,
+    fmt,
    io::{self, Cursor, Read, Seek, SeekFrom, Write},
    ops::Range,
    str,
@@ -29,8 +29,8 @@ use crate::{
        padding,
    },
    stream::{
-        self, CountingReader, FromReader, ReadDiscardExt, ReadSeekReopen, ReadStringExt, ToWriter,
-        WriteSeekReopen, WriteStringExt, WriteZerosExt,
+        self, CountingReader, CountingWriter, FromReader, ReadDiscardExt, ReadSeekReopen,
+        ReadStringExt, ToWriter, WriteSeekReopen, WriteStringExt, WriteZerosExt,
    },
    util,
 };
@@ -50,13 +50,30 @@ pub const FOOTER_MAGIC: [u8; 4] = *b"AVBf";
 /// for early fail. No individual field can actually be this size.
 pub const HEADER_MAX_SIZE: u64 = 64 * 1024;

-/// Maximum hash tree size. The current limit equals the hash tree size for a
-/// 4GiB image using SHA512 digests and a block size of 4096.
-pub const HASH_TREE_MAX_SIZE: u64 = 68_177_920;
+/// Maximum hash tree size. The current limit equals the hash tree size for an
+/// 8GiB image using SHA256 digests and a block size of 4096. This is equal to:
+///
+/// ```rust
+/// use avbroot::format::hashtree::HashTree;
+/// let size = HashTree::new(4096, &ring::digest::SHA256, b"")
+///     .compute_level_offsets(8 * 1024 * 1024 * 1024)
+///     .unwrap()
+///    .first()
+///    .map(|r| r.end)
+///    .unwrap_or(0);
+/// ```
+pub const HASH_TREE_MAX_SIZE: u64 = 67_637_248;

-/// Maximum FEC data size. The current limit equals the FEC data size for a 4GiB
-/// image using 2 parity bytes per codeword.
-pub const FEC_DATA_MAX_SIZE: u64 = 33_959_936;
+/// Maximum FEC data size. The current limit equals the FEC data size for an
+/// 8GiB image using 2 parity bytes per codeword. This is equal to:
+///
+/// ```rust
+/// use avbroot::format::fec::Fec;
+/// let size = Fec::new(8 * 1024 * 1024 * 1024, 4096, 2)
+///     .unwrap()
+///     .fec_size();
+/// ```
+pub const FEC_DATA_MAX_SIZE: u64 = 67_911_680;

 #[derive(Debug, Error)]
 pub enum Error {
@@ -107,8 +124,10 @@ pub enum Error {
    RsaSign(#[source] rsa::Error),
    #[error("Failed to RSA verify signature")]
    RsaVerify(#[source] rsa::Error),
-    #[error("{0} byte image size is too small to fit header or footer")]
-    ImageSizeTooSmall(u64),
+    #[error("{0} byte image size is too small to fit header")]
+    TooSmallForHeader(u64),
+    #[error("{0} byte image size is too small to fit footer")]
+    TooSmallForFooter(u64),
    #[error("Hash tree error")]
    HashTree(#[from] hashtree::Error),
    #[error("FEC error")]
@@ -1834,97 +1853,95 @@ pub fn load_image(mut reader: impl Read + Seek) -> Result<(Header, Option<Footer
    Ok((header, footer, image_size))
 }

-/// Write a vbmeta header to the specified writer. If a footer is specified, it
-/// will be used as the basis of the newly written footer, with the original
-/// image size, vbmeta header offset, and vbmeta header size fields updated
-/// appropriately.
-///
-/// The writer must not have an existing vbmeta header or footer.
-fn write_image_internal(
-    mut writer: impl Write + Seek,
-    header: &Header,
-    footer: Option<&mut Footer>,
-    image_size: Option<u64>,
-    block_size: u64,
-) -> Result<()> {
-    let eof_image_size = if footer.is_some() {
-        match header.appended_descriptor()? {
-            AppendedDescriptorRef::HashTree(d) => d
-                .image_size
-                .checked_add(d.tree_size)
-                .and_then(|s| s.checked_add(d.fec_size))
-                .ok_or_else(|| Error::FieldOutOfBounds("eof_image_size"))?,
-            AppendedDescriptorRef::Hash(d) => d.image_size,
-        }
-    } else {
-        0
-    };
-
-    writer.seek(SeekFrom::Start(eof_image_size))?;
-
-    // The header must be block-aligned.
-    let vbmeta_offset = if block_size > 0 {
-        let padding_size = padding::write_zeros(&mut writer, block_size)?;
-        eof_image_size
-            .checked_add(padding_size)
-            .ok_or_else(|| Error::FieldOutOfBounds("vbmeta_offset"))?
-    } else {
-        eof_image_size
-    };
-
-    header.to_writer(&mut writer)?;
-    let vbmeta_end = writer.stream_position()?;
-
-    if let Some(s) = image_size {
-        let footer_space = if footer.is_some() {
-            cmp::max(block_size, Footer::SIZE as u64)
-        } else {
-            0
-        };
-
-        if s < footer_space || vbmeta_end > s - footer_space {
-            return Err(Error::ImageSizeTooSmall(s));
-        }
-    }
-
-    if block_size > 0 {
-        padding::write_zeros(&mut writer, block_size)?;
-    }
-
-    if let Some(f) = footer {
-        let footer_offset = image_size.unwrap() - Footer::SIZE as u64;
-        writer.seek(SeekFrom::Start(footer_offset))?;
-
-        let original_image_size = match header.appended_descriptor()? {
-            AppendedDescriptorRef::HashTree(d) => d.image_size,
-            AppendedDescriptorRef::Hash(d) => d.image_size,
-        };
-
-        f.original_image_size = original_image_size;
-        f.vbmeta_offset = vbmeta_offset;
-        f.vbmeta_size = vbmeta_end - vbmeta_offset;
-
-        f.to_writer(&mut writer)?;
-    }
-
-    Ok(())
-}
-
 /// Write a vbmeta header to the specified writer. This is meant for writing
 /// vbmeta partition images, not appended vbmeta images. The writer must refer
-/// to an empty file.
-pub fn write_root_image(writer: impl Write + Seek, header: &Header, block_size: u64) -> Result<()> {
-    write_image_internal(writer, header, None, None, block_size)
+/// to an empty file. Returns the size of the new file.
+pub fn write_root_image(writer: impl Write, header: &Header, block_size: u64) -> Result<u64> {
+    let mut counting_writer = CountingWriter::new(writer);
+
+    header.to_writer(&mut counting_writer)?;
+    padding::write_zeros(&mut counting_writer, block_size)?;
+
+    Ok(counting_writer.stream_position()?)
 }

 /// Write a vbmeta header and footer to the specified writer. This is meant for
 /// appending vbmeta data to existing partition data, not writing vbmeta images.
+/// If `image_size` is specified, then the writer is guaranteed to not grow
+/// past that size and an error is returned if the header and footer won't fit.
+/// Otherwise, the writer will grow to the necessary size. Returns the size of
+/// the new file.
 pub fn write_appended_image(
-    writer: impl Write + Seek,
+    mut writer: impl Write + Seek,
    header: &Header,
    footer: &mut Footer,
-    image_size: u64,
-) -> Result<()> {
+    image_size: Option<u64>,
+) -> Result<u64> {
    // avbtool hardcodes a 4096 block size for appended non-sparse images.
-    write_image_internal(writer, header, Some(footer), Some(image_size), 4096)
+    const BLOCK_SIZE: u64 = 4096;
+
+    // Logical image size, excluding the AVB header and footer.
+    let logical_image_size = match header.appended_descriptor()? {
+        AppendedDescriptorRef::HashTree(d) => d
+            .image_size
+            .checked_add(d.tree_size)
+            .and_then(|s| s.checked_add(d.fec_size))
+            .ok_or_else(|| Error::FieldOutOfBounds("logical_image_size"))?,
+        AppendedDescriptorRef::Hash(d) => d.image_size,
+    };
+
+    writer.seek(SeekFrom::Start(logical_image_size))?;
+
+    // The header start offset must be block aligned.
+    let header_offset = {
+        let padding_size = padding::write_zeros(&mut writer, BLOCK_SIZE)?;
+        logical_image_size
+            .checked_add(padding_size)
+            .ok_or_else(|| Error::FieldOutOfBounds("header_offset"))?
+    };
+
+    // The header lives at the beginning of the empty space.
+    let mut header_buf = Cursor::new(Vec::new());
+    header.to_writer(&mut header_buf)?;
+    let header_size = header_buf.stream_position()?;
+    let header_padding = padding::write_zeros(&mut header_buf, BLOCK_SIZE)?;
+    let header_end_padded = header_offset
+        .checked_add(header_size)
+        .and_then(|s| s.checked_add(header_padding))
+        .ok_or_else(|| Error::FieldOutOfBounds("header_end_padded"))?;
+
+    if let Some(s) = image_size {
+        if header_end_padded > s {
+            return Err(Error::TooSmallForHeader(s));
+        }
+    }
+
+    writer.write_all(&header_buf.into_inner())?;
+
+    // The footer lives in its own separate block at the end of the empty space.
+    let footer_end = if let Some(s) = image_size {
+        if s - header_end_padded < BLOCK_SIZE {
+            return Err(Error::TooSmallForFooter(s));
+        }
+
+        s
+    } else {
+        header_end_padded
+            .checked_add(BLOCK_SIZE)
+            .ok_or_else(|| Error::FieldOutOfBounds("footer_end"))?
+    };
+
+    let footer_offset = footer_end - Footer::SIZE as u64;
+    writer.seek(SeekFrom::Start(footer_offset))?;
+
+    footer.original_image_size = match header.appended_descriptor()? {
+        AppendedDescriptorRef::HashTree(d) => d.image_size,
+        AppendedDescriptorRef::Hash(d) => d.image_size,
+    };
+    footer.vbmeta_offset = header_offset;
+    footer.vbmeta_size = header_size;
+
+    footer.to_writer(&mut writer)?;
+
+    Ok(footer_end)
 }
@@ -166,8 +166,8 @@ impl Fec {
            return Err(Error::UnsupportedParity(parity));
        }

-        let blocks = util::div_ceil(file_size, u64::from(block_size));
-        let rounds = util::div_ceil(blocks, u64::from(rs_k));
+        let blocks = file_size.div_ceil(u64::from(block_size));
+        let rounds = blocks.div_ceil(u64::from(rs_k));

        // Check upfront so we don't need to do checked multiplication later.
        rounds
@@ -196,7 +196,7 @@ impl Fec {

    /// Get the size of the FEC data needed to cover the entire file.
    #[inline]
-    fn fec_size(&self) -> usize {
+    pub fn fec_size(&self) -> usize {
        usize::from(self.parity()) * self.rounds as usize * self.block_size as usize
    }

@@ -225,7 +225,7 @@ impl Fec {
            let end_block = if range.end % block_size == 0 {
                range.end / block_size
            } else {
-                util::div_ceil(range.end, block_size)
+                range.end.div_ceil(block_size)
            };

            for block in start_block..end_block {
@@ -72,14 +72,14 @@ impl HashTree {
    /// tree data. The items are returned with the bottom level's offsets first
    /// in the list. Note that the bottom level is stored at the end of the hash
    /// tree data.
-    fn compute_level_offsets(&self, image_size: u64) -> Result<Vec<Range<usize>>> {
+    pub fn compute_level_offsets(&self, image_size: u64) -> Result<Vec<Range<usize>>> {
        let algorithm = self.salted_context.algorithm();
        let digest_size = algorithm.output_len().next_power_of_two();
        let mut ranges = vec![];
        let mut level_size = image_size;

        while level_size > u64::from(self.block_size) {
-            let blocks = util::div_ceil(level_size, u64::from(self.block_size));
+            let blocks = level_size.div_ceil(u64::from(self.block_size));
            level_size = blocks
                .checked_mul(digest_size as u64)
                .and_then(|s| padding::round(s, u64::from(self.block_size)))
@@ -124,7 +124,7 @@ impl HashTree {
            let end_block = if range.end % block_size == 0 {
                range.end / block_size
            } else {
-                util::div_ceil(range.end, block_size)
+                range.end.div_ceil(block_size)
            };

            result.push(start_block..end_block);
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2022-2023 Andrew Gunnerson
+ * SPDX-FileCopyrightText: 2022-2024 Andrew Gunnerson
 * SPDX-License-Identifier: GPL-3.0-only
 */

@@ -152,15 +152,15 @@ pub fn parse_legacy_metadata(data: &str) -> Result<OtaMetadata> {
            }
            "post-build-incremental" => {
                let p = metadata.postcondition.get_or_insert_with(Default::default);
-                p.build_incremental = value.to_owned();
+                value.clone_into(&mut p.build_incremental);
            }
            "post-sdk-level" => {
                let p = metadata.postcondition.get_or_insert_with(Default::default);
-                p.sdk_level = value.to_owned();
+                value.clone_into(&mut p.sdk_level);
            }
            "post-security-patch-level" => {
                let p = metadata.postcondition.get_or_insert_with(Default::default);
-                p.security_patch_level = value.to_owned();
+                value.clone_into(&mut p.security_patch_level);
            }
            "post-timestamp" => {
                let p = metadata.postcondition.get_or_insert_with(Default::default);
@@ -176,7 +176,7 @@ pub fn parse_legacy_metadata(data: &str) -> Result<OtaMetadata> {
            }
            "pre-build-incremental" => {
                let p = metadata.precondition.get_or_insert_with(Default::default);
-                p.build_incremental = value.to_owned();
+                value.clone_into(&mut p.build_incremental);
            }
            "spl-downgrade" => metadata.spl_downgrade = parse_yes()?,
            k if k.ends_with("-property-files") => {
@@ -890,6 +890,21 @@ fn compress_chunk(raw_data: &[u8], cancel_signal: &AtomicBool) -> Result<(Vec<u8
    Ok((data, digest_compressed))
 }

+fn compress_cow_size(mut raw_data: &[u8], block_size: u32) -> u64 {
+    let mut total = 0;
+
+    while !raw_data.is_empty() {
+        let n = raw_data.len().min(block_size as usize);
+        let compressed = lz4_flex::block::compress(&raw_data[..n]);
+
+        total += compressed.len().min(n) as u64;
+
+        raw_data = &raw_data[n..];
+    }
+
+    total
+}
+
 /// Compress the image and return the corresponding information to insert into
 /// the payload manifest's [`PartitionUpdate`] instance. The uncompressed data
 /// is split into 2 MiB chunks, which are read and compressed in parallel, and
@@ -897,13 +912,21 @@ fn compress_chunk(raw_data: &[u8], cancel_signal: &AtomicBool) -> Result<(Vec<u8
 /// a corresponding [`InstallOperation`] in the return value. The caller must
 /// update [`InstallOperation::data_offset`] in each operation manually because
 /// the initial values are relative to 0.
+///
+/// If `need_cow_estimate` is true, the VABC CoW v2 + lz4 size estimate will be
+/// computed. The caller must update [`PartitionUpdate::estimate_cow_size`] with
+/// this value or else update_engine may fail to flash the partition due to
+/// running out of space on the CoW block device. CoW v2 + other algorithms and
+/// also CoW v3 are currently unsupported because there currently are no known
+/// OTAs that use those configurations.
 pub fn compress_image(
    input: &(dyn ReadSeekReopen + Sync),
    output: &(dyn WriteSeekReopen + Sync),
    partition_name: &str,
    block_size: u32,
+    need_cow_estimate: bool,
    cancel_signal: &AtomicBool,
-) -> Result<(PartitionInfo, Vec<InstallOperation>)> {
+) -> Result<(PartitionInfo, Vec<InstallOperation>, Option<u64>)> {
    const CHUNK_SIZE: u64 = 2 * 1024 * 1024;
    const CHUNK_GROUP: u64 = 32;

@@ -918,9 +941,10 @@ pub fn compress_image(
        });
    }

-    let chunks_total = util::div_ceil(file_size, CHUNK_SIZE);
+    let chunks_total = file_size.div_ceil(CHUNK_SIZE);
    let mut bytes_compressed = 0;
    let mut context_uncompressed = Context::new(&ring::digest::SHA256);
+    let mut cow_estimate = 0;
    let mut operations = vec![];

    // Read the file one group at a time. This allows for some parallelization
@@ -957,8 +981,13 @@ pub fn compress_image(
        let mut compressed_data_group = uncompressed_data_group
            .into_par_iter()
            .map(
-                |(raw_offset, raw_data)| -> Result<(Vec<u8>, InstallOperation)> {
+                |(raw_offset, raw_data)| -> Result<(Vec<u8>, InstallOperation, u64)> {
                    let (data, digest_compressed) = compress_chunk(&raw_data, cancel_signal)?;
+                    let cow_size = if need_cow_estimate {
+                        compress_cow_size(&raw_data, block_size)
+                    } else {
+                        0
+                    };

                    let extent = Extent {
                        start_block: Some(raw_offset / u64::from(block_size)),
@@ -971,19 +1000,20 @@ pub fn compress_image(
                    operation.dst_extents.push(extent);
                    operation.data_sha256_hash = Some(digest_compressed.as_ref().to_vec());

-                    Ok((data, operation))
+                    Ok((data, operation, cow_size))
                },
            )
            .collect::<Result<Vec<_>>>()?;

-        for (data, operation) in &mut compressed_data_group {
+        for (data, operation, cow_size) in &mut compressed_data_group {
            operation.data_offset = Some(bytes_compressed);
            bytes_compressed += data.len() as u64;
+            cow_estimate += *cow_size;
        }

        let group_operations = compressed_data_group
            .into_par_iter()
-            .map(|(data, operation)| -> Result<InstallOperation> {
+            .map(|(data, operation, _)| -> Result<InstallOperation> {
                let mut writer = output.reopen_boxed()?;
                writer.seek(SeekFrom::Start(operation.data_offset.unwrap()))?;
                writer.write_all(&data)?;
@@ -1001,7 +1031,16 @@ pub fn compress_image(
        hash: Some(digest_uncompressed.as_ref().to_vec()),
    };

-    Ok((partition_info, operations))
+    let cow_estimate = if need_cow_estimate {
+        // Because lz4_flex compresses better than official lz4.
+        let fudge = cow_estimate / 100;
+
+        Some(cow_estimate + fudge)
+    } else {
+        None
+    };
+
+    Ok((partition_info, operations, cow_estimate))
 }

 fn extents_sorted(operations: &[InstallOperation]) -> bool {
@@ -1059,7 +1098,7 @@ pub fn compress_modified_image(
        return Err(Error::ExtentsNotInOrder);
    }

-    let groups_total = util::div_ceil(operations.len(), OPERATION_GROUP);
+    let groups_total = operations.len().div_ceil(OPERATION_GROUP);
    let mut bytes_compressed = 0;
    let mut context_uncompressed = Context::new(&ring::digest::SHA256);
    let mut modified_operations = vec![];
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2022-2023 Andrew Gunnerson
+ * SPDX-FileCopyrightText: 2022-2024 Andrew Gunnerson
 * SPDX-License-Identifier: GPL-3.0-only
 */

@@ -23,7 +23,7 @@ use liblzma::{
 use rayon::iter::{IntoParallelRefIterator, IntoParallelRefMutIterator, ParallelIterator};
 use regex::bytes::Regex;
 use ring::digest::Context;
-use rsa::RsaPrivateKey;
+use rsa::{RsaPrivateKey, RsaPublicKey};
 use thiserror::Error;
 use tracing::{debug, debug_span, trace, warn, Span};
 use x509_cert::Certificate;
@@ -70,7 +70,11 @@ pub enum Error {
    #[error("XZ stream error")]
    XzStream(#[from] liblzma::stream::Error),
    #[error("Zip error")]
-    Zip(#[from] ZipError),
+    Zip(#[source] ZipError),
+    #[error("Zip error for entry name: {0:?}")]
+    ZipEntryName(String, #[source] ZipError),
+    #[error("Zip error for entry index #{0}")]
+    ZipEntryIndex(usize, #[source] ZipError),
    #[error("I/O error")]
    Io(#[from] io::Error),
    #[error("File I/O error")]
@@ -157,6 +161,13 @@ impl MagiskRootPatcher {
    const VER_XZ_BACKUP: Range<u32> =
        26403..Self::VERS_SUPPORTED[Self::VERS_SUPPORTED.len() - 1].end;

+    const ZIP_LIBMAGISK: &'static str = "lib/arm64-v8a/libmagisk.so";
+    const ZIP_LIBMAGISK32: &'static str = "lib/armeabi-v7a/libmagisk32.so";
+    const ZIP_LIBMAGISK64: &'static str = "lib/arm64-v8a/libmagisk64.so";
+    const ZIP_MAGISKINIT: &'static str = "lib/arm64-v8a/libmagiskinit.so";
+    const ZIP_STUB: &'static str = "assets/stub.apk";
+    const ZIP_UTIL_FUNCTIONS: &'static str = "assets/util_functions.sh";
+
    pub fn new(
        path: &Path,
        preinit_device: Option<&str>,
@@ -208,8 +219,10 @@ impl MagiskRootPatcher {
    fn get_version(path: &Path) -> Result<u32> {
        let reader = File::open(path).map_err(|e| Error::File(path.to_owned(), e))?;
        let reader = BufReader::new(reader);
-        let mut zip = ZipArchive::new(reader)?;
-        let entry = zip.by_name("assets/util_functions.sh")?;
+        let mut zip = ZipArchive::new(reader).map_err(Error::Zip)?;
+        let entry = zip
+            .by_name(Self::ZIP_UTIL_FUNCTIONS)
+            .map_err(|e| Error::ZipEntryName(Self::ZIP_UTIL_FUNCTIONS.to_owned(), e))?;
        let mut entry = BufReader::new(entry);
        let mut line = String::new();

@@ -384,7 +397,7 @@ impl BootImagePatch for MagiskRootPatcher {
    fn patch(&self, boot_image: &mut BootImage, cancel_signal: &AtomicBool) -> Result<()> {
        let zip_reader =
            File::open(&self.apk_path).map_err(|e| Error::File(self.apk_path.clone(), e))?;
-        let mut zip = ZipArchive::new(BufReader::new(zip_reader))?;
+        let mut zip = ZipArchive::new(BufReader::new(zip_reader)).map_err(Error::Zip)?;

        // Load the first ramdisk. If it doesn't exist, we have to generate one
        // from scratch.
@@ -413,7 +426,9 @@ impl BootImagePatch for MagiskRootPatcher {

        // Add magiskinit.
        {
-            let mut zip_entry = zip.by_name("lib/arm64-v8a/libmagiskinit.so")?;
+            let mut zip_entry = zip
+                .by_name(Self::ZIP_MAGISKINIT)
+                .map_err(|e| Error::ZipEntryName(Self::ZIP_MAGISKINIT.to_owned(), e))?;
            let mut data = vec![];
            zip_entry.read_to_end(&mut data)?;

@@ -424,28 +439,33 @@ impl BootImagePatch for MagiskRootPatcher {
            ));
        }

-        // Add xz-compressed magisk32 and magisk64. We currently unconditionally
-        // include magisk32 because the boot image itself doesn't contain
-        // sufficient information to determine if a device is 64-bit only.
        let mut xz_files = HashMap::<&str, &[u8]>::new();
-        xz_files.insert(
-            "lib/armeabi-v7a/libmagisk32.so",
-            b"overlay.d/sbin/magisk32.xz",
-        );
-        xz_files.insert(
-            "lib/arm64-v8a/libmagisk64.so",
-            b"overlay.d/sbin/magisk64.xz",
-        );
+        if zip.file_names().any(|n| n == Self::ZIP_LIBMAGISK) {
+            // Newer Magisk versions only include a single binary for the target
+            // ABI in the ramdisk. fb5ee86615ed3df830e8538f8b39b1b133caea34.
+            debug!("Single libmagisk");
+            xz_files.insert(Self::ZIP_LIBMAGISK, b"overlay.d/sbin/magisk.xz");
+        } else {
+            // Older Magisk versions include the 64-bit binary and, optionally,
+            // the 32-bit binary if the device supports it. We unconditionally
+            // include the magisk32 because the boot image itself doesn't have
+            // sufficient information to determine if a device is 64-bit only.
+            debug!("Split libmagisk32/libmagisk64");
+            xz_files.insert(Self::ZIP_LIBMAGISK32, b"overlay.d/sbin/magisk32.xz");
+            xz_files.insert(Self::ZIP_LIBMAGISK64, b"overlay.d/sbin/magisk64.xz");
+        }

        // Add stub apk, which only exists after Magisk commit
        // ad0e6511e11ebec65aa9b5b916e1397342850319.
-        if zip.file_names().any(|n| n == "assets/stub.apk") {
+        if zip.file_names().any(|n| n == Self::ZIP_STUB) {
            debug!("Magisk stub found");
-            xz_files.insert("assets/stub.apk", b"overlay.d/sbin/stub.xz");
+            xz_files.insert(Self::ZIP_STUB, b"overlay.d/sbin/stub.xz");
        }

        for (source, target) in xz_files {
-            let reader = zip.by_name(source)?;
+            let reader = zip
+                .by_name(source)
+                .map_err(|e| Error::ZipEntryName(source.to_owned(), e))?;
            let buf = Self::xz_compress(reader, cancel_signal)?;

            entries.push(CpioEntry::new_file(target, 0o644, CpioEntryData::Data(buf)));
@@ -564,10 +584,12 @@ impl OtaCertPatcher {
                continue;
            };

-            let mut zip = ZipArchive::new(Cursor::new(&data))?;
+            let mut zip = ZipArchive::new(Cursor::new(&data)).map_err(Error::Zip)?;

            for index in 0..zip.len() {
-                let zip_entry = zip.by_index(index)?;
+                let zip_entry = zip
+                    .by_index(index)
+                    .map_err(|e| Error::ZipEntryIndex(index, e))?;
                if !zip_entry.name().ends_with(".x509.pem") {
                    debug!("Skipping invalid entry path: {}", zip_entry.name());
                    continue;
@@ -667,6 +689,137 @@ impl BootImagePatch for OtaCertPatcher {
    }
 }

+/// Add the AVB public key to DSU's list of trusted keys for verifying GSIs.
+pub struct DsuPubKeyPatcher {
+    key: RsaPublicKey,
+}
+
+impl DsuPubKeyPatcher {
+    const FIRST_STAGE_PATH: &'static [u8] = b"first_stage_ramdisk";
+    const DSU_KEYS_PATH: &'static [u8] = b"first_stage_ramdisk/avb";
+    const AVBROOT_KEY_PATH: &'static [u8] = b"first_stage_ramdisk/avb/avbroot.avbpubkey";
+
+    pub fn new(key: RsaPublicKey) -> Self {
+        Self { key }
+    }
+
+    fn patch_ramdisk(&self, ramdisk: &mut Vec<u8>, cancel_signal: &AtomicBool) -> Result<bool> {
+        let (mut entries, ramdisk_format) = load_ramdisk(ramdisk, cancel_signal)?;
+        if !entries.iter_mut().any(|e| e.path == Self::FIRST_STAGE_PATH) {
+            return Ok(false);
+        }
+
+        if !entries.iter().any(|e| e.path == Self::DSU_KEYS_PATH) {
+            entries.push(CpioEntry::new_directory(Self::DSU_KEYS_PATH, 0o755));
+        }
+
+        let data = CpioEntryData::Data(avb::encode_public_key(&self.key)?);
+
+        if let Some(e) = entries
+            .iter_mut()
+            .find(|e| e.path == Self::AVBROOT_KEY_PATH)
+        {
+            e.data = data;
+        } else {
+            entries.push(CpioEntry::new_file(Self::AVBROOT_KEY_PATH, 0o644, data));
+        };
+
+        *ramdisk = save_ramdisk(&entries, ramdisk_format, cancel_signal)?;
+
+        Ok(true)
+    }
+}
+
+impl BootImagePatch for DsuPubKeyPatcher {
+    fn patcher_name(&self) -> &'static str {
+        "DsuPubKeyPatcher"
+    }
+
+    fn find_targets<'a>(
+        &self,
+        boot_images: &HashMap<&'a str, BootImageInfo>,
+        cancel_signal: &AtomicBool,
+    ) -> Result<Vec<&'a str>> {
+        let mut dsu_keys_targets = vec![];
+        let mut first_stage_targets = vec![];
+
+        'outer: for (name, info) in boot_images {
+            let ramdisks = match &info.boot_image {
+                BootImage::V0Through2(b) => slice::from_ref(&b.ramdisk),
+                BootImage::V3Through4(b) => slice::from_ref(&b.ramdisk),
+                BootImage::VendorV3Through4(b) => &b.ramdisks,
+            };
+
+            for ramdisk in ramdisks {
+                if ramdisk.is_empty() {
+                    continue;
+                }
+
+                let (entries, _) = load_ramdisk(ramdisk, cancel_signal)?;
+                let mut found = false;
+
+                for entry in entries {
+                    if entry.path == Self::DSU_KEYS_PATH {
+                        dsu_keys_targets.push(*name);
+                        found = true;
+                    } else if entry.path == Self::FIRST_STAGE_PATH {
+                        first_stage_targets.push(*name);
+                        found = true;
+                    }
+                }
+
+                if found {
+                    continue 'outer;
+                }
+            }
+        }
+
+        if !dsu_keys_targets.is_empty() {
+            // Most builds trust as least one DSU key. For these builds, add the
+            // user's key to the same directory.
+            if dsu_keys_targets.len() > 1 {
+                return Err(Error::Validation(format!(
+                    "DSU keys found in more than one boot image: {dsu_keys_targets:?}",
+                )));
+            }
+
+            Ok(dsu_keys_targets)
+        } else {
+            // For builds that don't trust any DSU keys, pick the first boot
+            // image that contains a first stage ramdisk directory.
+            if !first_stage_targets.is_empty() {
+                first_stage_targets.sort();
+                first_stage_targets.resize(1, "");
+            }
+
+            Ok(first_stage_targets)
+        }
+    }
+
+    fn patch(&self, boot_image: &mut BootImage, cancel_signal: &AtomicBool) -> Result<()> {
+        let ramdisks = match boot_image {
+            BootImage::V0Through2(b) => slice::from_mut(&mut b.ramdisk),
+            BootImage::V3Through4(b) => slice::from_mut(&mut b.ramdisk),
+            BootImage::VendorV3Through4(b) => &mut b.ramdisks,
+        };
+
+        for ramdisk in ramdisks {
+            if ramdisk.is_empty() {
+                continue;
+            }
+
+            if self.patch_ramdisk(ramdisk, cancel_signal)? {
+                return Ok(());
+            }
+        }
+
+        Err(Error::Validation(format!(
+            "No ramdisk contains {:?}",
+            Self::FIRST_STAGE_PATH.as_bstr(),
+        )))
+    }
+}
+
 /// Replace the boot image with a prepatched boot image if it is compatible.
 ///
 /// An image is compatible if all the non-size-related header fields are
@@ -1044,7 +1197,7 @@ pub fn patch_boot_images<'a>(
            let (mut writer, context) = hashing_writer.finish();

            descriptor.image_size = writer.stream_position()?;
-            descriptor.hash_algorithm = "sha256".to_owned();
+            "sha256".clone_into(&mut descriptor.hash_algorithm);
            descriptor.root_digest = context.finish().as_ref().to_vec();

            if !info.header.public_key.is_empty() {
@@ -1053,7 +1206,12 @@ pub fn patch_boot_images<'a>(
                info.header.sign(key)?;
            }

-            avb::write_appended_image(writer, &info.header, &mut info.footer, info.image_size)?;
+            avb::write_appended_image(
+                writer,
+                &info.header,
+                &mut info.footer,
+                Some(info.image_size),
+            )?;

            Ok(())
        })
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023 Andrew Gunnerson
+ * SPDX-FileCopyrightText: 2023-2024 Andrew Gunnerson
 * SPDX-License-Identifier: GPL-3.0-only
 */

@@ -129,7 +129,7 @@ pub fn patch_system_image(
        return Err(Error::NoHashTreeDescriptor);
    };

-    let num_chunks = util::div_ceil(footer.original_image_size, CHUNK_SIZE);
+    let num_chunks = footer.original_image_size.div_ceil(CHUNK_SIZE);
    trace!("Parallel heuristics search for otacerts.zip with {num_chunks} chunks");

    let modified_ranges = (0..num_chunks)
@@ -207,7 +207,7 @@ pub fn patch_system_image(
    }

    let writer = output.reopen_boxed()?;
-    avb::write_appended_image(writer, &header, &mut footer, image_size)?;
+    avb::write_appended_image(writer, &header, &mut footer, Some(image_size))?;

    let AppendedDescriptorMut::HashTree(descriptor) = header.appended_descriptor_mut()? else {
        return Err(Error::NoHashTreeDescriptor);
@@ -49,16 +49,6 @@ pub fn parent_path(path: &Path) -> &Path {
    Path::new(".")
 }

-/// Since Rust's built-in .div_ceil() is still nightly-only.
-pub fn div_ceil<T: PrimInt>(dividend: T, divisor: T) -> T {
-    dividend / divisor
-        + if dividend % divisor != T::zero() {
-            T::one()
-        } else {
-            T::zero()
-        }
-}
-
 /// Sort and merge overlapping intervals.
 pub fn merge_overlapping<T>(sections: &[Range<T>]) -> Vec<Range<T>>
 where
@@ -228,7 +228,7 @@ fn round_trip_appended_hash_image() {
    assert_eq!(header.verify().unwrap().unwrap(), key.to_public_key());

    // Write vbmeta structures.
-    avb::write_appended_image(&mut writer, &header, &mut footer, image_size).unwrap();
+    avb::write_appended_image(&mut writer, &header, &mut footer, Some(image_size)).unwrap();
    let data = writer.into_inner();

    // Verify checksum of the output.
@@ -254,8 +254,8 @@ fn round_trip_appended_hash_image() {
 }

 #[test]
-fn round_trip_appended_hash_tree_image() {
-    let image_size = 28672;
+fn round_trip_appended_hash_tree_image_fixed_size() {
+    let image_size = 32768;
    let raw_data: [u8; 8192] = repeat_array(b"foobar");
    let mut header = Header {
        required_libavb_version_major: 1,
@@ -334,7 +334,114 @@ fn round_trip_appended_hash_tree_image() {
    assert_eq!(header.verify().unwrap().unwrap(), key.to_public_key());

    // Write vbmeta structures.
-    avb::write_appended_image(&mut writer, &header, &mut footer, image_size).unwrap();
+    avb::write_appended_image(&mut writer, &header, &mut footer, Some(image_size)).unwrap();
+    let mut data = Vec::new();
+    writer.rewind().unwrap();
+    writer.read_to_end(&mut data).unwrap();
+
+    // Verify checksum of the output.
+    assert_eq!(
+        ring::digest::digest(&ring::digest::SHA512, &data).as_ref(),
+        [
+            0xb5, 0x56, 0x65, 0x81, 0x5a, 0x16, 0x65, 0xa9, 0xa6, 0xc6, 0x9e, 0x41, 0x89, 0x9f,
+            0xe9, 0xbc, 0xea, 0x59, 0x4d, 0x14, 0x8a, 0x9e, 0x2b, 0x13, 0xa0, 0x3a, 0x8e, 0xd4,
+            0x59, 0xcd, 0x74, 0xe7, 0x99, 0xbd, 0xa3, 0x58, 0x4b, 0x84, 0xf2, 0x04, 0xe2, 0x12,
+            0x48, 0xfe, 0x4f, 0x67, 0x1f, 0x2a, 0xaa, 0x22, 0x51, 0x19, 0x83, 0x95, 0xa8, 0x03,
+            0xf5, 0x87, 0x12, 0x05, 0x8e, 0x14, 0xd9, 0xbd
+        ],
+    );
+
+    // Parse the generated image.
+    let mut reader = Cursor::new(&data);
+    let (new_header, new_footer, new_image_size) = avb::load_image(&mut reader).unwrap();
+    let new_footer = new_footer.unwrap();
+
+    assert_eq!(new_header, header);
+    assert_eq!(new_footer, footer);
+    assert_eq!(new_image_size, image_size);
+}
+
+#[test]
+fn round_trip_appended_hash_tree_image_minimum_size() {
+    let raw_data: [u8; 8192] = repeat_array(b"foobar");
+    let mut header = Header {
+        required_libavb_version_major: 1,
+        required_libavb_version_minor: 0,
+        algorithm_type: AlgorithmType::Sha256Rsa4096,
+        hash: vec![],       // autogenerated
+        signature: vec![],  // autogenerated
+        public_key: vec![], // autogenerated
+        public_key_metadata: vec![
+            0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d,
+            0x0e, 0x0f,
+        ],
+        descriptors: vec![
+            Descriptor::Property(PropertyDescriptor {
+                key: "foobar".to_owned(),
+                value: b"Invalid UTF-8: \xFF".to_vec(),
+            }),
+            Descriptor::HashTree(HashTreeDescriptor {
+                dm_verity_version: 1,
+                image_size: raw_data.len() as u64,
+                tree_offset: 0, // autogenerated
+                tree_size: 0,   // autogenerated
+                data_block_size: 4096,
+                hash_block_size: 4096,
+                fec_num_roots: 2,
+                fec_offset: 0, // autogenerated
+                fec_size: 0,   // autogenerated
+                hash_algorithm: "sha256".to_owned(),
+                partition_name: "vbmeta_appended_hash_tree".to_owned(),
+                salt: [0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef].repeat(4),
+                root_digest: vec![], // autogenerated
+                flags: 0,
+                reserved: repeat_array(&[0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef]),
+            }),
+        ],
+        rollback_index: 1677974400,
+        flags: 0,
+        rollback_index_location: 0,
+        release_string: repeat_str("MaxLength", 48),
+        reserved: repeat_array(&[0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef]),
+    };
+    let mut footer = Footer {
+        version_major: 1,
+        version_minor: 0,
+        original_image_size: 0, // autogenerated
+        vbmeta_offset: 0,       // autogenerated
+        vbmeta_size: 0,         // autogenerated
+        reserved: repeat_array(&[0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef]),
+    };
+
+    let mut writer = SharedCursor::default();
+    let cancel_signal = AtomicBool::new(false);
+
+    // Write the raw partition data.
+    writer.write_all(&raw_data).unwrap();
+
+    // Generate and write the hash tree and FEC data.
+    match header.appended_descriptor_mut().unwrap() {
+        AppendedDescriptorMut::HashTree(d) => {
+            d.update(&writer, &writer, None, &cancel_signal).unwrap();
+        }
+        AppendedDescriptorMut::Hash(_) => panic!("Expected hash tree descriptor"),
+    }
+
+    // Verify the hash tree and FEC data.
+    match header.appended_descriptor_mut().unwrap() {
+        AppendedDescriptorMut::HashTree(d) => {
+            d.verify(&writer, &cancel_signal).unwrap();
+        }
+        AppendedDescriptorMut::Hash(_) => panic!("Expected hash tree descriptor"),
+    }
+
+    // Sign the header.
+    let key = get_test_key();
+    header.sign(&key).unwrap();
+    assert_eq!(header.verify().unwrap().unwrap(), key.to_public_key());
+
+    // Write vbmeta structures.
+    avb::write_appended_image(&mut writer, &header, &mut footer, None).unwrap();
    let mut data = Vec::new();
    writer.rewind().unwrap();
    writer.read_to_end(&mut data).unwrap();
@@ -358,5 +465,5 @@ fn round_trip_appended_hash_tree_image() {

    assert_eq!(new_header, header);
    assert_eq!(new_footer, footer);
-    assert_eq!(new_image_size, image_size);
+    assert_eq!(new_image_size, 28672);
 }
@@ -1,8 +1,6 @@
 [advisories]
-vulnerability = "deny"
-unmaintained = "deny"
+version = 2
 yanked = "deny"
-notice = "deny"
 ignore = [
    # https://rustsec.org/advisories/RUSTSEC-2023-0071
    #
@@ -29,19 +27,18 @@ ignore = [
 ]

 [licenses]
+version = 2
 include-dev = true
-unlicensed = "deny"
 allow = [
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-3-Clause",
+    "GPL-3.0",
    "ISC",
    "MIT",
    "OpenSSL",
    "Unicode-DFS-2016",
 ]
-copyleft = "allow"
-default = "deny"

 [[licenses.clarify]]
 name = "ring"
@@ -73,6 +70,6 @@ bypass = [
 unknown-registry = "deny"
 unknown-git = "deny"
 allow-git = [
+    "https://github.com/chenxiaolong/bzip2-rs",
    "https://github.com/chenxiaolong/zip",
-    "https://github.com/jongiddy/bzip2-rs",
 ]
@@ -18,7 +18,7 @@ ring = "0.17.0"
 rsa = "0.9.6"
 serde = { version = "1.0.188", features = ["derive"] }
 tempfile = "3.8.0"
-toml_edit = { version = "0.21.0", features = ["serde"] }
+toml_edit = { version = "0.22.9", features = ["serde"] }
 topological-sort = "0.2.2"
 tracing = "0.1.40"
 tracing-subscriber = "0.3.18"
@@ -22,7 +22,7 @@ data.kernel = true
 avb.signed = true
 data.type = "boot"
 data.version = "v4"
-data.ramdisks = ["init"]
+data.ramdisks = [["init", "first_stage"]]

 [profile.pixel_v4_gki.partitions.system]
 avb.signed = false
@@ -43,11 +43,11 @@ data.deps = ["system"]
 avb.signed = false
 data.type = "boot"
 data.version = "vendor_v4"
-data.ramdisks = ["otacerts"]
+data.ramdisks = [["otacerts", "first_stage", "dsu_key_dir"]]

 [profile.pixel_v4_gki.hashes]
-original = "f9477a35e3b60a495e49431c61e3897f11775f453a6a9897ead568357c963618"
-patched = "d3436650b4e0c60688dafb1472fa5fe95e67d19a8fad2da4850ffaa739d44574"
+original = "6b140c378d21eae2fa4fc581bce13a689b21bd32f5fba865698d1fd322f2f8c6"
+patched = "f00e9745f90754be28ce8355501d876759cd8336451e4c3633908fbb4217b422"

 # Google Pixel 6a
 # What's unique: boot (boot v4, no ramdisk) + vendor_boot (vendor v4, 2 ramdisks)
@@ -77,11 +77,11 @@ data.deps = ["system"]
 avb.signed = false
 data.type = "boot"
 data.version = "vendor_v4"
-data.ramdisks = ["init_and_otacerts", "dlkm"]
+data.ramdisks = [["init", "otacerts", "first_stage", "dsu_key_dir"], ["dlkm"]]

 [profile.pixel_v4_non_gki.hashes]
-original = "021b4510bc244f5f686fbff89eb2058ec9c96a2949c2fe8caa7750a78d593225"
-patched = "0f90ae4c26a54a735d48e13e98bea73b6d1c026b0e95fa5b4b26179a1d6bdc86"
+original = "31963e6f81986c6686111f50e36b89e4d85ee5c02bc8e5ecd560528bc98d6fe7"
+patched = "43959409034dbb9aa0a605d7c5c0e7885012bbcd63510ec87d8e97015b37a746"

 # Google Pixel 4a 5G
 # What's unique: boot (boot v3) + vendor_boot (vendor v3)
@@ -91,7 +91,7 @@ avb.signed = true
 data.type = "boot"
 data.version = "v3"
 data.kernel = true
-data.ramdisks = ["init"]
+data.ramdisks = [["init"]]

 [profile.pixel_v3.partitions.system]
 avb.signed = false
@@ -112,11 +112,11 @@ data.deps = ["system"]
 avb.signed = false
 data.type = "boot"
 data.version = "vendor_v3"
-data.ramdisks = ["otacerts"]
+data.ramdisks = [["otacerts", "first_stage", "dsu_key_dir"]]

 [profile.pixel_v3.hashes]
-original = "12221a69ff32e137d5f19b61f576fc6b33f0973c4a81da7722c640554ff4bc4e"
-patched = "0a92969bbd7cb30071a0799eb20028546d1cec3e6ec1ca4d7e1fe7776f1399fc"
+original = "e684aacb54464098c1b8e3f499efe35dff10ea792e89d71a83404620d0108b3e"
+patched = "08e03ec327bf5bd841b91ad8d53028c3439a1722b423aaaac6cc0ceee4ef66b1"

 # Google Pixel 4a
 # What's unique: boot (boot v2)
@@ -126,7 +126,7 @@ avb.signed = false
 data.type = "boot"
 data.version = "v2"
 data.kernel = true
-data.ramdisks = ["init_and_otacerts"]
+data.ramdisks = [["init", "otacerts", "first_stage", "dsu_key_dir"]]

 [profile.pixel_v2.partitions.system]
 avb.signed = false
@@ -144,5 +144,5 @@ data.type = "vbmeta"
 data.deps = ["system"]

 [profile.pixel_v2.hashes]
-original = "8b38d2d999b5b6e240e894f669e9e2643b3764c108d53bb7b02447da725e7c18"
-patched = "85b411947145e89cdc7f71b7109a12586f4dbddce3021f0f96172fc465c189d6"
+original = "ee9568797d9195985f14753b89949d8ebb08c8863a32eceeeec6e8d94661b1cf"
+patched = "5e265094d4164cedde8f483911c58860f6008b314dc8e5ed3b44deb53fbb2f96"
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023 Andrew Gunnerson
+ * SPDX-FileCopyrightText: 2023-2024 Andrew Gunnerson
 * SPDX-License-Identifier: GPL-3.0-only
 */

@@ -7,7 +7,7 @@ use std::{collections::BTreeMap, fs, path::Path};

 use anyhow::{Context, Result};
 use serde::{Deserialize, Serialize};
-use toml_edit::Document;
+use toml_edit::DocumentMut;

 #[derive(Serialize, Deserialize)]
 pub struct Sha256Hash(
@@ -41,7 +41,8 @@ pub struct Avb {
 pub enum RamdiskContent {
    Init,
    Otacerts,
-    InitAndOtacerts,
+    FirstStage,
+    DsuKeyDir,
    Dlkm,
 }

@@ -62,7 +63,7 @@ pub struct BootData {
    #[serde(default)]
    pub kernel: bool,
    #[serde(default)]
-    pub ramdisks: Vec<RamdiskContent>,
+    pub ramdisks: Vec<Vec<RamdiskContent>>,
 }

 #[derive(Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
@@ -120,12 +121,12 @@ pub struct Config {
    pub profile: BTreeMap<String, Profile>,
 }

-pub fn load_config(path: &Path) -> Result<(Config, Document)> {
+pub fn load_config(path: &Path) -> Result<(Config, DocumentMut)> {
    let contents =
        fs::read_to_string(path).with_context(|| format!("Failed to read config: {path:?}"))?;
    let config: Config = toml_edit::de::from_str(&contents)
        .with_context(|| format!("Failed to parse config: {path:?}"))?;
-    let document: Document = contents.parse().unwrap();
+    let document: DocumentMut = contents.parse().unwrap();

    Ok((config, document))
 }
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023 Andrew Gunnerson
+ * SPDX-FileCopyrightText: 2023-2024 Andrew Gunnerson
 * SPDX-FileCopyrightText: 2023 Pascal Roeleven
 * SPDX-License-Identifier: GPL-3.0-only
 */
@@ -196,7 +196,7 @@ fn append_avb(
        // Give enough free space for changes from patching.
        .max(1024 * 1024);

-    avb::write_appended_image(file, &header, &mut footer, full_image_size)?;
+    avb::write_appended_image(file, &header, &mut footer, Some(full_image_size))?;

    Ok(())
 }
@@ -227,6 +227,14 @@ fn ramdisk_add_otacerts(entries: &mut Vec<CpioEntry>, cert_ota: &Certificate) ->
    Ok(())
 }

+fn ramdisk_add_first_stage(entries: &mut Vec<CpioEntry>) {
+    entries.push(CpioEntry::new_directory(b"first_stage_ramdisk", 0o755));
+}
+
+fn ramdisk_add_dsu_key_dir(entries: &mut Vec<CpioEntry>) {
+    entries.push(CpioEntry::new_directory(b"first_stage_ramdisk/avb", 0o755));
+}
+
 fn ramdisk_add_dlkm(entries: &mut Vec<CpioEntry>) {
    for path in [b"lib".as_slice(), b"lib/modules".as_slice()] {
        entries.push(CpioEntry::new_directory(path, 0o755));
@@ -245,25 +253,29 @@ fn ramdisk_add_dlkm(entries: &mut Vec<CpioEntry>) {
 }

 fn create_ramdisk(
-    content: RamdiskContent,
+    content_list: &[RamdiskContent],
    cert_ota: &Certificate,
    cancel_signal: &AtomicBool,
 ) -> Result<Vec<u8>> {
    let mut entries = vec![];

-    match content {
-        RamdiskContent::Init => {
-            ramdisk_add_init(&mut entries);
-        }
-        RamdiskContent::Otacerts => {
-            ramdisk_add_otacerts(&mut entries, cert_ota)?;
-        }
-        RamdiskContent::InitAndOtacerts => {
-            ramdisk_add_init(&mut entries);
-            ramdisk_add_otacerts(&mut entries, cert_ota)?;
-        }
-        RamdiskContent::Dlkm => {
-            ramdisk_add_dlkm(&mut entries);
+    for content in content_list {
+        match content {
+            RamdiskContent::Init => {
+                ramdisk_add_init(&mut entries);
+            }
+            RamdiskContent::Otacerts => {
+                ramdisk_add_otacerts(&mut entries, cert_ota)?;
+            }
+            RamdiskContent::FirstStage => {
+                ramdisk_add_first_stage(&mut entries);
+            }
+            RamdiskContent::DsuKeyDir => {
+                ramdisk_add_dsu_key_dir(&mut entries);
+            }
+            RamdiskContent::Dlkm => {
+                ramdisk_add_dlkm(&mut entries);
+            }
        }
    }

@@ -298,7 +310,7 @@ fn create_boot_image(
    let ramdisks = boot_data
        .ramdisks
        .iter()
-        .map(|c| create_ramdisk(*c, cert_ota, cancel_signal))
+        .map(|c| create_ramdisk(c, cert_ota, cancel_signal))
        .collect::<Result<Vec<_>>>()?;

    let boot_image = match boot_data.version {
@@ -361,17 +373,20 @@ fn create_boot_image(
                    ramdisk_metas: boot_data
                        .ramdisks
                        .iter()
-                        .map(|c| match c {
-                            RamdiskContent::Dlkm => RamdiskMeta {
-                                ramdisk_type: bootimage::VENDOR_RAMDISK_TYPE_DLKM,
-                                ramdisk_name: "dlkm".to_owned(),
-                                board_id: Default::default(),
-                            },
-                            _ => RamdiskMeta {
-                                ramdisk_type: bootimage::VENDOR_RAMDISK_TYPE_PLATFORM,
-                                ramdisk_name: String::new(),
-                                board_id: Default::default(),
-                            },
+                        .map(|c_list| {
+                            if c_list.iter().any(|c| *c == RamdiskContent::Dlkm) {
+                                RamdiskMeta {
+                                    ramdisk_type: bootimage::VENDOR_RAMDISK_TYPE_DLKM,
+                                    ramdisk_name: "dlkm".to_owned(),
+                                    board_id: Default::default(),
+                                }
+                            } else {
+                                RamdiskMeta {
+                                    ramdisk_type: bootimage::VENDOR_RAMDISK_TYPE_PLATFORM,
+                                    ramdisk_name: String::new(),
+                                    board_id: Default::default(),
+                                }
+                            }
                        })
                        .collect(),
                    bootconfig: String::new(),
@@ -578,8 +593,14 @@ fn create_payload(
            .map(PSeekFile::new)
            .with_context(|| format!("Failed to create temp file for: {name}"))?;

-        let (partition_info, operations) =
-            payload::compress_image(file, &writer, name, 4096, cancel_signal)?;
+        let (partition_info, operations, cow_estimate) = payload::compress_image(
+            file,
+            &writer,
+            name,
+            4096,
+            dynamic_partitions_names.contains(name),
+            cancel_signal,
+        )?;

        compressed.insert(name, writer);

@@ -602,7 +623,7 @@ fn create_payload(
            fec_roots: None,
            version: None,
            merge_operations: vec![],
-            estimate_cow_size: None,
+            estimate_cow_size: cow_estimate,
        });
    }

@@ -623,7 +644,7 @@ fn create_payload(
                }],
                snapshot_enabled: Some(true),
                vabc_enabled: Some(true),
-                vabc_compression_param: Some("gz".to_owned()),
+                vabc_compression_param: Some("lz4".to_owned()),
                cow_version: Some(2),
                vabc_feature_set: None,
            }),
@@ -945,6 +966,7 @@ impl KeySet {
 fn patch_image(
    input_file: &Path,
    output_file: &Path,
+    system_image_file: &Path,
    extra_args: &[&OsStr],
    keys: &KeySet,
    cancel_signal: &AtomicBool,
@@ -958,6 +980,9 @@ fn patch_image(
        input_file.as_os_str(),
        OsStr::new("--output"),
        output_file.as_os_str(),
+        OsStr::new("--replace"),
+        OsStr::new("system"),
+        system_image_file.as_os_str(),
        OsStr::new("--key-avb"),
        keys.avb_key_file.path().as_os_str(),
        OsStr::new("--pass-avb-file"),
@@ -968,6 +993,7 @@ fn patch_image(
        keys.ota_pass_file.path().as_os_str(),
        OsStr::new("--cert-ota"),
        keys.ota_cert_file.path().as_os_str(),
+        OsStr::new("--dsu"),
    ];
    args.extend_from_slice(extra_args);

@@ -1103,9 +1129,15 @@ fn test_subcommand(cli: &TestCli, cancel_signal: &AtomicBool) -> Result<()> {
            .with_context(|| format!("[{name}] Failed to verify original OTA hash"))?;

        // Patch once using Magisk.
+        extract_image(&out_original, &profile_dir, cancel_signal)
+            .with_context(|| format!("[{name}] Failed to extract OTA"))?;
+
+        let system_image = profile_dir.join("system.img");
+
        patch_image(
            &out_original,
            &out_magisk,
+            &system_image,
            &args_magisk,
            &test_keys,
            cancel_signal,
@@ -1133,6 +1165,7 @@ fn test_subcommand(cli: &TestCli, cancel_signal: &AtomicBool) -> Result<()> {
        patch_image(
            &out_original,
            &out_prepatched,
+            &system_image,
            &args_prepatched,
            &test_keys,
            cancel_signal,
@@ -12,4 +12,4 @@ publish = false
 anyhow = "1.0.75"
 clap = { version = "4.4.1", features = ["derive"] }
 regex = { version = "1.9.4", default-features = false, features = ["perf", "std"] }
-toml_edit = "0.21.0"
+toml_edit = "0.22.9"
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023 Andrew Gunnerson
+ * SPDX-FileCopyrightText: 2023-2024 Andrew Gunnerson
 * SPDX-License-Identifier: GPL-3.0-only
 */

@@ -11,7 +11,7 @@ use std::{

 use anyhow::{bail, Result};
 use clap::Parser;
-use toml_edit::{value, Document};
+use toml_edit::{value, DocumentMut};

 use crate::WORKSPACE_DIR;

@@ -19,7 +19,7 @@ fn update_cargo_version(version: &str) -> Result<()> {
    let path = Path::new(WORKSPACE_DIR).join("Cargo.toml");
    let data = fs::read_to_string(&path)?;

-    let mut document: Document = data.parse()?;
+    let mut document: DocumentMut = data.parse()?;
    document["workspace"]["package"]["version"] = value(version);

    fs::write(path, document.to_string())?;
Author	SHA1	Message	Date
Andrew Gunnerson	f6c6a9509a	Version 3.3.0 Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-06-23 15:51:57 -04:00
Andrew Gunnerson	5a00995366	CHANGELOG.md: Add entry for PR #309 Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-06-22 18:47:28 -04:00
Andrew Gunnerson	edf537aad6	Add payload subcommand for dumping payload.bin header Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-06-22 18:42:46 -04:00
Andrew Gunnerson	f006f20209	CHANGELOG.md: Add entry for PR #307 Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-06-22 18:38:44 -04:00
Andrew Gunnerson	f36c1ca451	payload: Fudge CoW size estimate by 1% lz4_flex appears to compress system images better than the original lz4 implementation used in libsnapshot_cow, so the estimates are too low. Fixes: #306 Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-06-21 22:36:41 -04:00
Andrew Gunnerson	29b72961a3	Update CoW size estimate when replacing entire dynamic partitions Otherwise, if the partition size increases or the data becomes more incompressible, update_engine might fail to flash the partition due to the CoW block device running out of space. Since all known VABC-enabled OTAs in the wild currently use CoW v2 with lz4 compression, this is the only configuration we support. CoW v3 also exists in AOSP's libsnapshot_cow, but is much more complicated to implement and is not yet used, even in the Android 15 beta OTAs. Fixes: #306 Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-06-21 21:51:49 -04:00
Andrew Gunnerson	e105efb6d3	Version 3.2.3 Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-06-14 18:26:14 -04:00
Andrew Gunnerson	2a7df104ed	CHANGELOG.md: Add entry for PR #304 Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-06-14 18:17:06 -04:00
Andrew Gunnerson	8e52a9cf8c	Add support for cross-compiling to Android The precompiled binaries are compiled for aarch64 API 31, which should work for every device that avbroot supports. Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-06-14 17:49:15 -04:00
Andrew Gunnerson	f9343aa542	Version 3.2.2 Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-06-03 19:50:01 -04:00
Andrew Gunnerson	0391d4e2c3	CHANGELOG.md: Add entry for PR #268 Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-06-03 18:50:10 -04:00
Andrew Gunnerson	c18800dc44	patch/boot: Add entry name/index to zip error messages `specified file not found in archive` is a useless error message when there's no additional context. Issue: #301 Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-06-03 18:50:02 -04:00
Andrew Gunnerson	2db90f83c2	Add support for upcoming Magisk Canary 27003 Magisk no longer puts both magisk64 and magisk32 in the ramdisk. Instead, it just puts a single binary for the target ABI. Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-06-03 18:50:01 -04:00
Andrew Gunnerson	34915e256f	Merge pull request #300 from bugreportion/master README.ru.md: update translation	2024-06-01 10:04:50 -04:00
Ivan Katrovsky	61392eb9d6	README.ru.md: update translation Signed-off-by: Ivan Katrovsky <notbugreporter@proton.me>	2024-06-01 15:11:29 +03:00
Andrew Gunnerson	029cb4264e	README.md: Move supported device list to issue tracker This makes it a bit easier to keep updated and gather user comments. Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-05-31 18:36:39 -04:00
Andrew Gunnerson	98a7fc811d	Merge pull request #298 from bugreportion/master README.ru.md: update translation	2024-05-31 18:25:32 -04:00
Ivan Katrovsky	f4f4ec8e0d	README.ru.md: update translation Signed-off-by: Ivan Katrovsky <notbugreporter@proton.me>	2024-06-01 01:12:47 +03:00
Andrew Gunnerson	99b316f55e	CHANGELOG.md: Add entry for PR #297 Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-05-30 00:08:58 -04:00
Andrew Gunnerson	50ee90b61a	cli/avb: Allow writing new TOML file when packing an image Previously, there was no way to easily see the values of the recomputed fields without unpacking the newly built image. This commit adds a new `--output-info` option to the `avb pack` subcommand to write/overwrite a new `avb.toml` file. Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-05-30 00:04:05 -04:00
Andrew Gunnerson	2e8bd9f9d4	CHANGELOG.md: Add entry for PR #296 Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-05-29 23:52:42 -04:00
Andrew Gunnerson	3fa96714c4	avb: Add support for building minimally sized image Previously, for resizable images, the user had to guess an appropriate size for the final image that could fit all the AVB metadata. This commit adds a new `--recompute-size` option to the `avb pack` subcommand to generate a minimally sized image. Fixes: #294 Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-05-29 23:42:43 -04:00
Andrew Gunnerson	7a2530a199	README.md: Strongly discourage using any device besides Google Pixels OnePlus seems to be getting worse and worse with some devices not being recoverable. Issue: #290 Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-05-29 21:20:24 -04:00
Andrew Gunnerson	f84df86ef5	Version 3.2.1 Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-05-24 18:27:38 -04:00
Andrew Gunnerson	0c064981dd	CHANGELOG.md: Add entry for PR #293 Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-05-24 18:26:43 -04:00
Andrew Gunnerson	5645183ecc	Merge pull request #293 from chenxiaolong/bump-fec-limits avb: Bump hashtree and FEC size limits to accommodate 8 GiB images	2024-05-24 18:25:36 -04:00
Andrew Gunnerson	bc7358a8d9	avb: Bump hashtree and FEC size limits to accommodate 8 GiB images Fixes: #291 Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-05-24 18:20:28 -04:00
Andrew Gunnerson	d47c14ab12	Switch to Rust 1.73.0's builtin div_ceil function Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-05-24 17:57:45 -04:00
Andrew Gunnerson	f479fe1a08	Version 3.2.0 Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-05-18 21:19:04 -04:00
Andrew Gunnerson	df7b76bc59	CHANGELOG.md: Add entry for PR #289 Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-05-18 21:13:27 -04:00
Andrew Gunnerson	e342b93902	cli/ota: Build list of boot patchers directly in patch_subcommand() This way, all of the patchers are constructed in the same place and we don't have to pass their parameters through multiple functions. Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-05-18 21:11:11 -04:00
Andrew Gunnerson	d7439e15ae	Add support for adding AVB public key to DSU trusted keys This allows the user to boot GSIs signed by the same key. The option is disabled by default because some Android builds disable DSU support by removing all keys to reduce the attack surface. We don't want to reenable DSU support on these builds unless the user asks for it. Closes: #286 Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-05-18 21:07:16 -04:00
Andrew Gunnerson	0f16f30dfb	CHANGELOG.md: Add entry for PR #288 Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-05-18 17:47:26 -04:00
Andrew Gunnerson	178c025eca	Fix clippy 1.78.0 lints Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-05-18 17:44:01 -04:00
Andrew Gunnerson	d6ac94c430	Update all dependencies Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-05-18 17:25:26 -04:00
Andrew Gunnerson	2de260a66c	CHANGELOG.md: Add entry for PR #287 Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-05-18 17:06:49 -04:00
Andrew Gunnerson	e9ba770a15	Switch to my fork of the bzip2-rs library This includes a fix for yet another infinite-loop-on-drop bug in the bzip2::write::BzDecoder implementation. This could be easily triggered when interrupting an avbroot command while it is extracting a bzip2 compressed payload.bin chunk. Fixes: #285 Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>	2024-05-18 16:46:58 -04:00