Version 3.19.0

Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>

.github/workflows/ci.yml

@@ -83,7 +83,7 @@ jobs:
           done
 
       - name: Cache Rust dependencies
-        uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
+        uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
         with:
           key: ${{ matrix.artifact.name }}
 

.github/workflows/deny.yml

@@ -13,4 +13,4 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Run cargo-deny
-        uses: EmbarkStudios/cargo-deny-action@34899fc7ba81ca6268d5947a7a16b4649013fea1 # v2.0.11
+        uses: EmbarkStudios/cargo-deny-action@30f817c6f72275c6d54dc744fbca09ebc958599f # v2.0.12

.github/workflows/release.yml

@@ -27,7 +27,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Create release
-        uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631 # v2.2.2
+        uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2
         with:
           tag_name: v${{ steps.get_version.outputs.version }}
           name: Version ${{ steps.get_version.outputs.version }}

CHANGELOG.md

@@ -7,6 +7,46 @@
     to update the actual links at the bottom of the file.
 -->
 
+### Version 3.19.0
+
+* Allow verifying hashes of unsigned images with `avbroot avb verify` ([PR #477])
+* Warn when verifying image containing insecure flags field with `avbroot avb verify` ([PR #478])
+* Force re-signing of signed images in `avbroot avb pack` when fields were changed externally ([PR #479])
+
+### Version 3.18.1
+
+* Fix output file corruption in `avbroot sparse unpack` when unpacking a sparse file with holes larger than 2^32 ([Issue #472], [PR #476])
+
+### Version 3.18.0
+
+* Make OTA metadata property file field validation more lenient ([Issue #469], [PR #470])
+  * Fixes `avbroot ota verify` for stock OTAs that include extra zip file entries in the metadata
+* Remove automatic promotion of insecure SHA-1 AVB hash algorithm to SHA-256 ([Issue #366], [Issue #469], [PR #473])
+  * There are insecure devices that don't support SHA-256 and won't boot with it.
+  * The original feature was a bandaid for OnePlus devices to make them a tiny bit more secure. They used SHA-256 for every partition except `system`. However, OnePlus no longer supports custom AVB keys anyway, so this feature is going away.
+* Add support for Magisk 30200 ([PR #474])
+* Update dependencies ([PR #475])
+
+### Version 3.17.2
+
+* Add support for Magisk 30100 ([PR #468])
+
+### Version 3.17.1
+
+* Update end-to-end tests to place streaming and seekable OTAs in separate directories for easier troubleshooting ([PR #463])
+* Update dependencies ([PR #464])
+* Add support for Magisk 30000 ([PR #467])
+
+### Version 3.17.0
+
+* Fix reserved space error when patching OTA zips larger than ~10 GB ([Issue #451], [PR #452])
+* Update dependencies ([PR #453])
+
+### Version 3.16.1
+
+* Add support for Magisk 29000 ([PR #448])
+* Update dependencies ([PR #449])
+
 ### Version 3.16.0
 
 * Add support for CoW version 3 for virtual A/B ([Issue #441], [PR #442], [PR #445])
@@ -349,6 +389,9 @@ Behind-the-scenes changes:
 [Issue #393]: https://github.com/chenxiaolong/avbroot/issues/393
 [Issue #433]: https://github.com/chenxiaolong/avbroot/issues/433
 [Issue #441]: https://github.com/chenxiaolong/avbroot/issues/441
+[Issue #451]: https://github.com/chenxiaolong/avbroot/issues/451
+[Issue #469]: https://github.com/chenxiaolong/avbroot/issues/469
+[Issue #472]: https://github.com/chenxiaolong/avbroot/issues/472
 [PR #130]: https://github.com/chenxiaolong/avbroot/pull/130
 [PR #132]: https://github.com/chenxiaolong/avbroot/pull/132
 [PR #133]: https://github.com/chenxiaolong/avbroot/pull/133
@@ -508,3 +551,19 @@ Behind-the-scenes changes:
 [PR #444]: https://github.com/chenxiaolong/avbroot/pull/444
 [PR #445]: https://github.com/chenxiaolong/avbroot/pull/445
 [PR #446]: https://github.com/chenxiaolong/avbroot/pull/446
+[PR #448]: https://github.com/chenxiaolong/avbroot/pull/448
+[PR #449]: https://github.com/chenxiaolong/avbroot/pull/449
+[PR #452]: https://github.com/chenxiaolong/avbroot/pull/452
+[PR #453]: https://github.com/chenxiaolong/avbroot/pull/453
+[PR #463]: https://github.com/chenxiaolong/avbroot/pull/463
+[PR #464]: https://github.com/chenxiaolong/avbroot/pull/464
+[PR #467]: https://github.com/chenxiaolong/avbroot/pull/467
+[PR #468]: https://github.com/chenxiaolong/avbroot/pull/468
+[PR #470]: https://github.com/chenxiaolong/avbroot/pull/470
+[PR #473]: https://github.com/chenxiaolong/avbroot/pull/473
+[PR #474]: https://github.com/chenxiaolong/avbroot/pull/474
+[PR #475]: https://github.com/chenxiaolong/avbroot/pull/475
+[PR #476]: https://github.com/chenxiaolong/avbroot/pull/476
+[PR #477]: https://github.com/chenxiaolong/avbroot/pull/477
+[PR #478]: https://github.com/chenxiaolong/avbroot/pull/478
+[PR #479]: https://github.com/chenxiaolong/avbroot/pull/479

Cargo.toml

@@ -4,7 +4,7 @@ members = ["avbroot", "e2e", "fuzz", "xtask"]
 resolver = "2"
 
 [workspace.package]
-version = "3.16.0"
+version = "3.19.0"
 license = "GPL-3.0-only"
 edition = "2024"
 repository = "https://github.com/chenxiaolong/avbroot"

README.extra.md

@@ -30,8 +30,6 @@ This subcommand packs a new AVB image from the `avb.toml` file and, for appended
 * To force an image to be signed, use `--key <path> --force`.
 * To force an image to be unsigned, use `--force` without specifying `--key`.
 
-Note that if the image is an appended image and its hash or hash tree descriptor uses an insecure algorithm, like `sha1`, then it will automatically be promoted to `sha256`.
-
 By default, for appended vbmeta images, the output image size will match the size of the original image that was unpacked. This size is specified by the `image_size` field in `avb.toml`. If the image is resizable (eg. `system`), then passing in `--recompute-size` will cause the `image_size` field to be ignored and the smallest possible output file that fits the raw image and AVB metadata will be built. This avoids wasting space if `raw.img` shrunk or allows the packing to work at all if `raw.img` grew. **Do not use this option for non-resizable images** (eg. `boot`) or else the device won't be able to boot.
 
 When packing an image, several of the fields in `avb.toml` may potentially be recomputed. To write a TOML file containing the new values, use `--output-info <output TOML>`. It is safe to overwrite the existing `avb.toml` if desired.

README.md

@@ -51,6 +51,8 @@ avbroot applies the following patches to the partition images:
 
 3. Follow the steps to [generate signing keys](#generating-keys).
 
+    Skip this step if you're updating Android, Magisk, or KernelSU after you've performed an [initial setup](#initial-setup). [Updates](#updates) do not require signing keys since you have already generated them in the initial setup.
+
 4. Patch the OTA zip. The base command is:
 
     ```bash
@@ -223,21 +225,25 @@ If you lose your AVB or OTA signing key, you will no longer be able to sign new
 
     **WARNING**: If you are flashing CalyxOS, the setup wizard will [automatically turn off the `OEM unlocking` switch](https://github.com/CalyxOS/platform_packages_apps_SetupWizard/blob/7d2df25cedcbff83ddb608e628f9d97b38259c26/src/org/lineageos/setupwizard/SetupWizardApp.java#L135-L140). Make sure to manually reenable it again from Android's developer settings. Consider using the [`OEMUnlockOnBoot` module](https://github.com/chenxiaolong/OEMUnlockOnBoot) to automatically ensure OEM unlocking is enabled on every boot.
 
-10. That's it! To install future OS, Magisk, or KernelSU updates, see the [next section](#updates).
+10. That's it! To update the OS, Magisk, or KernelSU see the [next section](#updates).
 
 ## Updates
 
-Updates to Android, Magisk, and KernelSU are all done the same way by patching (or repatching) the OTA.
+Updates to Android, Magisk, and KernelSU are all done the same way: by patching (or repatching) the OTA.
 
-1. If Magisk or KernelSU is being updated, first install their new `.apk`. If you happen to open the app, make sure it **does not** flash the boot image. Cancel the boot image update prompts if needed.
+1. Generate a new patched OTA by following the steps in the [usage section](#usage).
 
-2. Follow the step in the [usage section](#usage) to patch the new OTA.
+2. If Magisk or KernelSU is being updated, first install their new `.apk`. If you happen to open the app, make sure it **does not** flash the boot image. Cancel the boot image update prompts if needed.
 
 3. Reboot to recovery mode. If the screen is stuck at a `No command` message, press the volume up button once while holding down the power button.
 
 4. Sideload the patched OTA with `adb sideload`.
 
-5. That's it!
+5. Restart your phone. Note: the phone will likely take a long time to startup after an OS update (a few minutes in some cases).
+
+**Warning**: Due to how virtual A/B works, there is a snapshot merge operation that Android runs invisibly in the background after installing an OTA and rebooting. During the snapshot merge process, it's not possible to sideload another OTA from recovery mode. Avoid doing anything that could result in a boot loop (eg. installing modules) until this process is complete because there is no way to recover, aside from unlocking the bootloader (and wiping) again.
+
+The status can be found by running `adb logcat -v color -s update_engine`. Alternatively, if [Custota](https://github.com/chenxiaolong/Custota) is installed (even if it's not configured to point to a custom OTA server), it will show a notification until the snapshot merge operation completes.
 
 ## Reverting to stock firmware
 

avbroot/Cargo.toml

@@ -13,7 +13,7 @@ anyhow = "1.0.75"
 base64 = "0.22.1"
 bitflags = { version = "2.4.1", features = ["serde"] }
 bstr = "1.6.2"
-bzip2 = { version = "0.5.1", default-features = false, features = ["libbz2-rs-sys"] }
+bzip2 = "0.6.0"
 cap-std = "3.0.0"
 cap-tempfile = "3.0.0"
 clap = { version = "4.4.1", features = ["derive"] }
@@ -34,9 +34,9 @@ memchr = "2.6.0"
 num-bigint-dig = "0.8.4"
 num-traits = "0.2.16"
 passterm = "2.0.3"
-phf = { version = "0.11.2", features = ["macros"] }
+phf = { version = "0.12.1", features = ["macros"] }
 pkcs8 = { version = "0.10.2", features = ["encryption", "pem"] }
-prost = "0.13.1"
+prost = "0.14.1"
 # We can't upgrade to 0.9.0 until rsa updates its rand_core dependency.
 rand = "0.8.5"
 rayon = "1.7.0"
@@ -52,7 +52,7 @@ sha1 = "0.10.5"
 sha2 = "0.10.7"
 tempfile = "3.8.0"
 thiserror = "2.0.3"
-toml_edit = { version = "0.22.9", features = ["serde"] }
+toml_edit = { version = "0.23.3", features = ["serde"] }
 topological-sort = "0.2.2"
 tracing = "0.1.40"
 tracing-subscriber = "0.3.18"
@@ -60,10 +60,12 @@ x509-cert = { version = "0.2.4", features = ["builder"] }
 zerocopy = { version = "0.8.10", features = ["std"] }
 zerocopy-derive = "0.8.5"
 
-# https://github.com/zip-rs/zip/pull/383
+# https://github.com/zip-rs/zip2/pull/367
+# https://github.com/zip-rs/zip2/pull/368
+# For getting the data offset when writing new zip entries.
 [dependencies.zip]
-git = "https://github.com/chenxiaolong/zip"
-rev = "989101f9384b9e94e36e6e9e0f51908fdf98bde6"
+git = "https://github.com/chenxiaolong/zip2"
+rev = "59685f4dadbfee8cb3ea74c8fbb402b60d8137e8"
 default-features = false
 features = ["deflate"]
 
@@ -73,8 +75,8 @@ rustix = { version = "1.0.3", default-features = false, features = ["process"] }
 
 [build-dependencies]
 constcat = "0.6.0"
-prost-build = "0.13.1"
-protox = "0.8.0"
+prost-build = "0.14.1"
+protox = "0.9.0"
 
 [dev-dependencies]
 assert_matches = "1.5.0"

avbroot/src/cli/args.rs

@@ -10,7 +10,7 @@ use std::{
 
 use anyhow::Result;
 use clap::{Parser, Subcommand, ValueEnum};
-use tracing::{debug, Level};
+use tracing::{Level, debug};
 use tracing_subscriber::fmt::{format::Writer, time::FormatTime};
 
 use crate::cli::{avb, boot, completion, cpio, fec, hashtree, key, lp, ota, payload, sparse};

avbroot/src/cli/avb.rs

@@ -10,7 +10,7 @@ use std::{
     sync::atomic::AtomicBool,
 };
 
-use anyhow::{anyhow, bail, Context, Result};
+use anyhow::{Context, Result, anyhow, bail};
 use cap_std::{
     ambient_authority,
     fs::{Dir, OpenOptions},
@@ -19,7 +19,7 @@ use clap::{Args, Parser, Subcommand};
 use rayon::prelude::{IntoParallelRefIterator, ParallelIterator};
 use rsa::RsaPublicKey;
 use serde::{Deserialize, Serialize};
-use tracing::{debug_span, info, warn, Span};
+use tracing::{Span, debug_span, info, warn};
 
 use crate::{
     crypto::{self, PassphraseSource, RsaSigningKey},
@@ -27,7 +27,7 @@ use crate::{
         self, AlgorithmType, AppendedDescriptorMut, AppendedDescriptorRef, Descriptor, Footer,
         HashTreeDescriptor, Header, KernelCmdlineDescriptor,
     },
-    stream::{self, check_cancel, PSeekFile, ReadFixedSizeExt, Reopen, ToWriter},
+    stream::{self, PSeekFile, ReadFixedSizeExt, Reopen, ToWriter, check_cancel},
     util,
 };
 
@@ -95,18 +95,6 @@ fn write_info(path: &Path, info: &AvbInfo) -> Result<()> {
     Ok(())
 }
 
-/// Packing with insecure algorithms is intentionally not supported, so promote
-/// to a secure algorithm if needed.
-fn promote_insecure_hash_algorithm(algorithm: &mut String) {
-    const INSECURE_ALGORITHMS: &[&str] = &["sha1"];
-    const NEW_ALGORITHM: &str = "sha256";
-
-    if INSECURE_ALGORITHMS.contains(&algorithm.as_str()) {
-        warn!("Changing insecure hash algorithm {algorithm} to {NEW_ALGORITHM}");
-        NEW_ALGORITHM.clone_into(algorithm);
-    }
-}
-
 /// Copy `size` bytes from `reader` into a new file `path` that's opened as
 /// both readable and writable.
 fn write_raw(
@@ -194,13 +182,11 @@ fn write_raw_and_update(
 
     match info.header.appended_descriptor_mut()? {
         AppendedDescriptorMut::HashTree(d) => {
-            promote_insecure_hash_algorithm(&mut d.hash_algorithm);
             d.image_size = image_size;
             d.update(&raw_file, &raw_file, None, cancel_signal)
                 .context("Failed to update hash tree descriptor")?;
         }
         AppendedDescriptorMut::Hash(d) => {
-            promote_insecure_hash_algorithm(&mut d.hash_algorithm);
             d.image_size = image_size;
             raw_file.rewind()?;
             d.update(&mut raw_file, cancel_signal)
@@ -345,7 +331,7 @@ fn sign_or_clear(info: &mut AvbInfo, orig_header: &Header, key_group: &KeyGroup)
         } else {
             SignAction::Clear
         }
-    } else if originally_signed && &info.header != orig_header {
+    } else if originally_signed && (&info.header != orig_header || info.header.verify().is_err()) {
         SignAction::Sign
     } else {
         // If the original image was signed, we can preserve the existing
@@ -477,6 +463,10 @@ pub fn verify_headers(
         info!("{name} has an unsigned vbmeta header");
     }
 
+    if header.flags != 0 {
+        warn!("{name} has insecure flags: {:#x}", header.flags);
+    }
+
     for descriptor in &header.descriptors {
         let Some(target_name) = descriptor.partition_name() else {
             continue;
@@ -745,7 +735,6 @@ fn repack_subcommand(cli: &RepackCli, cancel_signal: &AtomicBool) -> Result<()>
         // Write new hash tree and FEC data instead of copying the original.
         // There could have been errors in the original FEC data itself.
         if let AppendedDescriptorMut::HashTree(d) = info.header.appended_descriptor_mut()? {
-            promote_insecure_hash_algorithm(&mut d.hash_algorithm);
             d.update(&file, &file, None, cancel_signal)?;
         }
 

avbroot/src/cli/boot.rs

@@ -7,7 +7,7 @@ use std::{
     path::{Path, PathBuf},
 };
 
-use anyhow::{bail, Context, Result};
+use anyhow::{Context, Result, bail};
 use clap::{Parser, Subcommand};
 
 use crate::{

avbroot/src/cli/cpio.rs

@@ -9,7 +9,7 @@ use std::{
     sync::atomic::AtomicBool,
 };
 
-use anyhow::{anyhow, Context, Result};
+use anyhow::{Context, Result, anyhow};
 use bstr::ByteSlice;
 use cap_std::{ambient_authority, fs::Dir};
 use clap::{Parser, Subcommand};

avbroot/src/cli/lp.rs

@@ -9,7 +9,7 @@ use std::{
     sync::atomic::AtomicBool,
 };
 
-use anyhow::{bail, Context, Result};
+use anyhow::{Context, Result, bail};
 use cap_std::{ambient_authority, fs::Dir};
 use clap::{CommandFactory, Parser, Subcommand};
 use rayon::iter::{

avbroot/src/cli/ota.rs

@@ -5,26 +5,25 @@ use std::{
     borrow::Cow,
     collections::{BTreeSet, HashMap, HashSet},
     ffi::{OsStr, OsString},
-    fmt::Display,
     fs::{self, File},
     io::{self, BufReader, BufWriter, Read, Seek, SeekFrom, Write},
     ops::Range,
     path::{Path, PathBuf},
     str::FromStr,
-    sync::{atomic::AtomicBool, Mutex},
+    sync::{Mutex, atomic::AtomicBool},
 };
 
-use anyhow::{anyhow, bail, Context, Result};
+use anyhow::{Context, Result, anyhow, bail};
 use bitflags::bitflags;
 use cap_std::{ambient_authority, fs::Dir};
 use cap_tempfile::TempDir;
-use clap::{value_parser, ArgAction, Args, Parser, Subcommand};
+use clap::{ArgAction, Args, Parser, Subcommand, value_parser};
 use rayon::{iter::IntoParallelRefIterator, prelude::ParallelIterator};
 use tempfile::NamedTempFile;
 use topological_sort::TopologicalSort;
 use tracing::{debug_span, error, info, warn};
 use x509_cert::Certificate;
-use zip::{write::FileOptions, CompressionMethod, ZipArchive, ZipWriter};
+use zip::{CompressionMethod, DateTime, ZipArchive, write::SimpleFileOptions};
 
 use crate::{
     cli,
@@ -34,6 +33,7 @@ use crate::{
         ota::{self, SigningWriter, ZipEntry, ZipMode},
         padding,
         payload::{self, CowVersion, PayloadHeader, PayloadWriter, VabcAlgo, VabcParams},
+        zip::ZipWriterWrapper,
     },
     patch::{
         boot::{
@@ -52,28 +52,6 @@ use crate::{
     util,
 };
 
-fn joined(into_iter: impl IntoIterator<Item = impl Display>) -> String {
-    use std::fmt::Write;
-
-    let mut result = String::new();
-
-    for (i, item) in into_iter.into_iter().enumerate() {
-        if i > 0 {
-            result.push_str(", ");
-        }
-
-        write!(result, "{item}").expect("Failed to allocate");
-    }
-
-    result
-}
-
-fn sorted<T: Ord>(iter: impl Iterator<Item = T>) -> Vec<T> {
-    let mut items = iter.collect::<Vec<_>>();
-    items.sort();
-    items
-}
-
 bitflags! {
     #[repr(transparent)]
     #[derive(Clone, Copy, Debug, PartialEq, Eq)]
@@ -225,7 +203,7 @@ fn patch_boot_images(
 
     info!(
         "Candidate boot images: {}",
-        joined(sorted(boot_partitions.iter())),
+        util::join(util::sort(boot_partitions.iter()), ", "),
     );
 
     boot::patch_boot_images(
@@ -248,7 +226,7 @@ fn patch_boot_images(
     .with_context(|| {
         format!(
             "Failed to patch boot images: {}",
-            joined(sorted(boot_partitions.iter())),
+            util::join(util::sort(boot_partitions.iter()), ", "),
         )
     })?;
 
@@ -368,7 +346,7 @@ fn ensure_partitions_protected(
     if !missing.is_empty() {
         bail!(
             "Found critical partitions that are not protected by AVB: {}",
-            joined(missing),
+            util::join(missing, ", "),
         );
     }
 
@@ -411,7 +389,10 @@ fn get_vbmeta_patch_order(
     }
 
     if !missing.is_empty() {
-        warn!("Partitions aren't protected by AVB: {}", joined(missing));
+        warn!(
+            "Partitions aren't protected by AVB: {}",
+            util::join(missing, ", "),
+        );
     }
 
     // Ensure that there's only a single root of trust. Otherwise, there could
@@ -427,7 +408,10 @@ fn get_vbmeta_patch_order(
 
     // For zero roots, let TopologicalSort report the cycle.
     if roots.len() > 1 {
-        bail!("Found multiple root vbmeta images: {}", joined(roots));
+        bail!(
+            "Found multiple root vbmeta images: {}",
+            util::join(roots, ", "),
+        );
     }
 
     // Compute the patching order. This only includes vbmeta images. All vbmeta
@@ -495,7 +479,9 @@ fn update_security_descriptors(
                 *pd = cd.clone();
             }
             _ => {
-                bail!("{child_name} descriptor ({child_type}) does not match entry in {parent_name} ({parent_type})");
+                bail!(
+                    "{child_name} descriptor ({child_type}) does not match entry in {parent_name} ({parent_type})"
+                );
             }
         }
     } else {
@@ -505,7 +491,9 @@ fn update_security_descriptors(
                 child_header.public_key.clone_into(&mut pd.public_key);
             }
             _ => {
-                bail!("{child_name} descriptor ({parent_type}) in {parent_name} must be a chain descriptor");
+                bail!(
+                    "{child_name} descriptor ({parent_type}) in {parent_name} must be a chain descriptor"
+                );
             }
         }
     }
@@ -667,7 +655,7 @@ fn update_vbmeta_headers(
 ) -> Result<()> {
     info!(
         "Patching vbmeta images: {}",
-        joined(order.iter().map(|(n, _)| n)),
+        util::join(order.iter().map(|(n, _)| n), ", "),
     );
 
     for (name, deps) in order {
@@ -1111,7 +1099,7 @@ fn patch_ota_payload(
 fn patch_ota_zip(
     raw_reader: &PSeekFile,
     zip_reader: &mut ZipArchive<impl Read + Seek>,
-    mut zip_writer: &mut ZipWriter<impl Write>,
+    mut zip_writer: &mut ZipWriterWrapper<impl Write>,
     external_images: &HashMap<String, PathBuf>,
     boot_patchers: &[Box<dyn BootImagePatch + Sync>],
     skip_system_ota_cert: bool,
@@ -1137,7 +1125,7 @@ fn patch_ota_zip(
     }
 
     if !missing.is_empty() {
-        bail!("Missing entries in OTA zip: {}", joined(missing));
+        bail!("Missing entries in OTA zip: {}", util::join(missing, ", "));
     } else if !paths.contains(ota::PATH_METADATA) && !paths.contains(ota::PATH_METADATA_PB) {
         bail!(
             "Neither legacy nor protobuf OTA metadata files exist: {:?}, {:?}",
@@ -1165,7 +1153,8 @@ fn patch_ota_zip(
         // threshold. This should be sufficient since the output file is likely
         // to be larger.
         let use_zip64 = reader.size() >= 0xffffffff;
-        let options = FileOptions::default()
+        let options = SimpleFileOptions::default()
+            .last_modified_time(DateTime::default())
             .compression_method(CompressionMethod::Stored)
             .large_file(use_zip64);
 
@@ -1202,12 +1191,9 @@ fn patch_ota_zip(
         }
 
         // All remaining entries are written immediately.
-        zip_writer
-            .start_file_with_extra_data(path, options)
-            .with_context(|| format!("Failed to begin new zip entry: {path}"))?;
         let offset = zip_writer
-            .end_extra_data()
-            .with_context(|| format!("Failed to end new zip entry: {path}"))?;
+            .start_file(path, options)
+            .with_context(|| format!("Failed to begin new zip entry: {path}"))?;
         let mut writer = CountingWriter::new(&mut zip_writer);
 
         match path.as_str() {
@@ -1271,7 +1257,7 @@ fn patch_ota_zip(
         let size = writer.stream_position()?;
 
         entries.push(ZipEntry {
-            name: path.clone(),
+            path: path.clone(),
             offset,
             size,
         });
@@ -1320,7 +1306,7 @@ pub fn extract_payload(
         }
     }
 
-    info!("Extracting from the payload: {}", joined(images));
+    info!("Extracting from the payload: {}", util::join(images, ", "));
 
     // Pre-open all output files.
     let output_files = images
@@ -1540,11 +1526,11 @@ pub fn patch_subcommand(cli: &PatchCli, cancel_signal: &AtomicBool) -> Result<()
     let mut zip_writer = match cli.zip_mode {
         ZipMode::Streaming => {
             let signing_writer = SigningWriter::new_streaming(temp_writer);
-            ZipWriter::new_streaming(signing_writer)
+            ZipWriterWrapper::new_streaming(signing_writer)
         }
         ZipMode::Seekable => {
             let signing_writer = SigningWriter::new_seekable(temp_writer);
-            ZipWriter::new(signing_writer)
+            ZipWriterWrapper::new_seekable(signing_writer)
         }
     };
 
@@ -1673,7 +1659,7 @@ pub fn extract_subcommand(cli: &ExtractCli, cancel_signal: &AtomicBool) -> Resul
             .collect::<Vec<_>>();
 
         if !missing_images.is_empty() {
-            bail!("Invalid partitions: {}", joined(missing_images));
+            bail!("Invalid partitions: {}", util::join(missing_images, ", "));
         }
 
         unique_images.extend(cli.extract.partition.iter().cloned());
@@ -1933,7 +1919,7 @@ pub fn verify_subcommand(cli: &VerifyCli, cancel_signal: &AtomicBool) -> Result<
         .with_context(|| format!("Failed to parse property files: {}", ota::PF_NAME))?;
     let pf_payload = pfs
         .iter()
-        .find(|pf| pf.name == ota::PATH_PAYLOAD)
+        .find(|pf| pf.name() == ota::PATH_PAYLOAD)
         .ok_or_else(|| anyhow!("Missing property files entry: {}", ota::PATH_PAYLOAD))?;
 
     let section_reader = SectionReader::new(&mut reader, pf_payload.offset, pf_payload.size)

avbroot/src/cli/payload.rs

@@ -10,7 +10,7 @@ use std::{
     sync::atomic::AtomicBool,
 };
 
-use anyhow::{anyhow, bail, Context, Result};
+use anyhow::{Context, Result, anyhow, bail};
 use cap_std::{ambient_authority, fs::Dir};
 use clap::{Args, Parser, Subcommand};
 use tracing::info;

avbroot/src/cli/sparse.rs

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: 2024 Andrew Gunnerson
+// SPDX-FileCopyrightText: 2024-2025 Andrew Gunnerson
 // SPDX-License-Identifier: GPL-3.0-only
 
 use std::{
@@ -10,10 +10,10 @@ use std::{
     sync::atomic::AtomicBool,
 };
 
-use anyhow::{anyhow, bail, Context, Result};
+use anyhow::{Context, Result, anyhow, bail};
 use clap::{Parser, Subcommand};
 use crc32fast::Hasher;
-use zerocopy::{little_endian, IntoBytes};
+use zerocopy::{IntoBytes, little_endian};
 
 use crate::{
     format::{
@@ -317,11 +317,11 @@ fn unpack_subcommand(
                 })?;
             }
             ChunkData::Hole => {
-                // This cannot overflow.
-                let to_skip = chunk.bounds.len() * metadata.header.block_size;
+                // Unlike ChunkData::Data, this can overflow a u32.
+                let to_skip = i64::from(chunk.bounds.len()) * i64::from(metadata.header.block_size);
 
                 writer
-                    .seek(SeekFrom::Current(to_skip.into()))
+                    .seek(SeekFrom::Current(to_skip))
                     .with_context(|| format!("Failed to seek file: {:?}", cli.output))?;
             }
             ChunkData::Crc32(_) => {}

avbroot/src/crypto.rs

@@ -21,25 +21,25 @@ use cms::{
 };
 use passterm::PromptError;
 use pkcs8::{
-    pkcs5::{pbes2, scrypt},
     DecodePrivateKey, DecodePublicKey, EncodePrivateKey, EncodePublicKey, EncryptedPrivateKeyInfo,
     LineEnding, PrivateKeyInfo,
+    pkcs5::{pbes2, scrypt},
 };
 use rand::RngCore;
 use rsa::{
-    pkcs1v15::SigningKey, traits::PublicKeyParts, Pkcs1v15Sign, RsaPrivateKey, RsaPublicKey,
+    Pkcs1v15Sign, RsaPrivateKey, RsaPublicKey, pkcs1v15::SigningKey, traits::PublicKeyParts,
 };
 use serde::{Deserialize, Serialize};
 use sha1::Sha1;
 use sha2::{Digest, Sha256, Sha512};
 use thiserror::Error;
 use x509_cert::{
+    Certificate,
     builder::{Builder, CertificateBuilder, Profile},
-    der::{pem::PemLabel, referenced::OwnedToRef, Any, Decode, DecodePem, EncodePem},
+    der::{Any, Decode, DecodePem, EncodePem, pem::PemLabel, referenced::OwnedToRef},
     serial_number::SerialNumber,
     spki::{AlgorithmIdentifierOwned, SubjectPublicKeyInfoOwned},
     time::Validity,
-    Certificate,
 };
 
 use crate::util::DebugString;

avbroot/src/escape.rs

@@ -4,7 +4,7 @@
 use std::{fmt, marker::PhantomData};
 
 use bstr::{ByteSlice, ByteVec};
-use serde::{de::Visitor, Deserializer, Serializer};
+use serde::{Deserializer, Serializer, de::Visitor};
 use thiserror::Error;
 
 #[derive(Clone, Debug, Error)]

avbroot/src/format/avb.rs

@@ -14,10 +14,10 @@ use bstr::ByteSlice;
 use num_bigint_dig::{ModInverse, ToBigInt};
 use num_traits::{Pow, ToPrimitive};
 use ring::digest::{Algorithm, Context};
-use rsa::{traits::PublicKeyParts, BigUint, RsaPublicKey};
+use rsa::{BigUint, RsaPublicKey, traits::PublicKeyParts};
 use serde::{Deserialize, Serialize};
 use thiserror::Error;
-use zerocopy::{big_endian, FromBytes, IntoBytes};
+use zerocopy::{FromBytes, IntoBytes, big_endian};
 use zerocopy_derive::{FromBytes, Immutable, IntoBytes, KnownLayout, Unaligned};
 
 use crate::{
@@ -163,9 +163,9 @@ pub enum Error {
 
 type Result<T> = std::result::Result<T, Error>;
 
-pub(crate) fn digest_algorithm(name: &str, for_verify: bool) -> Result<&'static Algorithm> {
+pub(crate) fn digest_algorithm(name: &str) -> Result<&'static Algorithm> {
     match name {
-        "sha1" if for_verify => Ok(&ring::digest::SHA1_FOR_LEGACY_USE_ONLY),
+        "sha1" => Ok(&ring::digest::SHA1_FOR_LEGACY_USE_ONLY),
         "sha256" => Ok(&ring::digest::SHA256),
         "sha512" => Ok(&ring::digest::SHA512),
         a => Err(Error::UnsupportedHashAlgorithm(a.to_owned())),
@@ -534,7 +534,7 @@ impl HashTreeDescriptor {
         ranges: Option<&[Range<u64>]>,
         cancel_signal: &AtomicBool,
     ) -> Result<()> {
-        let algorithm = digest_algorithm(&self.hash_algorithm, false)?;
+        let algorithm = digest_algorithm(&self.hash_algorithm)?;
         let hash_tree = HashTree::new(self.data_block_size, algorithm, &self.salt);
         let (root_digest, hash_tree_data) = match ranges {
             Some(r) => {
@@ -642,7 +642,7 @@ impl HashTreeDescriptor {
     ) -> Result<()> {
         self.check_offsets()?;
 
-        let algorithm = digest_algorithm(&self.hash_algorithm, true)?;
+        let algorithm = digest_algorithm(&self.hash_algorithm)?;
 
         util::check_bounds(self.tree_size, ..=HASH_TREE_MAX_SIZE)
             .map_err(|e| Error::IntOutOfBounds("HashTree::tree_size", e))?;
@@ -903,10 +903,9 @@ impl HashDescriptor {
     fn calculate(
         &self,
         reader: impl Read,
-        for_verify: bool,
         cancel_signal: &AtomicBool,
     ) -> Result<ring::digest::Digest> {
-        let algorithm = digest_algorithm(&self.hash_algorithm, for_verify)?;
+        let algorithm = digest_algorithm(&self.hash_algorithm)?;
         let mut context = Context::new(algorithm);
         context.update(&self.salt);
 
@@ -924,14 +923,14 @@ impl HashDescriptor {
 
     /// Update the root hash from the input reader's contents.
     pub fn update(&mut self, reader: impl Read, cancel_signal: &AtomicBool) -> Result<()> {
-        let digest = self.calculate(reader, false, cancel_signal)?;
+        let digest = self.calculate(reader, cancel_signal)?;
         self.root_digest = digest.as_ref().to_vec();
         Ok(())
     }
 
     /// Verify the root hash against the input reader.
     pub fn verify(&self, reader: impl Read, cancel_signal: &AtomicBool) -> Result<()> {
-        let digest = self.calculate(reader, true, cancel_signal)?;
+        let digest = self.calculate(reader, cancel_signal)?;
 
         if self.root_digest != digest.as_ref() {
             return Err(Error::InvalidRootDigest {
@@ -1759,16 +1758,20 @@ impl Header {
     /// and return the public key. If the header is not signed, then `None` is
     /// returned.
     pub fn verify(&self) -> Result<Option<RsaPublicKey>> {
-        // Reconstruct the public key.
-        let public_key = decode_public_key(&self.public_key)?;
-
         if self.public_key.len() != self.algorithm_type.public_key_len() {
             return Err(Error::IncorrectKeySize(
-                public_key.size(),
+                self.public_key.len(),
                 self.algorithm_type,
             ));
         }
 
+        if self.algorithm_type == AlgorithmType::None {
+            return Ok(None);
+        }
+
+        // Reconstruct the public key.
+        let public_key = decode_public_key(&self.public_key)?;
+
         let mut without_auth_writer = Cursor::new(Vec::new());
         self.to_writer_internal(&mut without_auth_writer, true)?;
         let without_auth = without_auth_writer.into_inner();

avbroot/src/format/bootimage.rs

@@ -13,7 +13,7 @@ use num_traits::ToPrimitive;
 use ring::digest::Context;
 use serde::{Deserialize, Serialize};
 use thiserror::Error;
-use zerocopy::{little_endian, FromBytes, IntoBytes};
+use zerocopy::{FromBytes, IntoBytes, little_endian};
 use zerocopy_derive::{FromBytes, Immutable, IntoBytes, KnownLayout, Unaligned};
 
 use crate::{
@@ -669,11 +669,7 @@ impl fmt::Display for BootImageV3Through4 {
 
 impl BootImageExt for BootImageV3Through4 {
     fn header_version(&self) -> u32 {
-        if self.v4_extra.is_some() {
-            4
-        } else {
-            3
-        }
+        if self.v4_extra.is_some() { 4 } else { 3 }
     }
 
     fn header_size(&self) -> u32 {
@@ -1094,11 +1090,7 @@ impl fmt::Display for VendorBootImageV3Through4 {
 
 impl BootImageExt for VendorBootImageV3Through4 {
     fn header_version(&self) -> u32 {
-        if self.v4_extra.is_some() {
-            4
-        } else {
-            3
-        }
+        if self.v4_extra.is_some() { 4 } else { 3 }
     }
 
     fn header_size(&self) -> u32 {

avbroot/src/format/compression.rs

@@ -3,7 +3,7 @@
 
 use std::io::{self, Read, Seek, Write};
 
-use flate2::{read::GzDecoder, write::GzEncoder, Compression};
+use flate2::{Compression, read::GzDecoder, write::GzEncoder};
 use liblzma::{
     read::XzDecoder,
     stream::{Check, Stream},

avbroot/src/format/cpio.rs

@@ -771,11 +771,7 @@ pub fn sort(entries: &mut [CpioEntry]) {
 /// 300000.
 pub fn assign_inodes(entries: &mut [CpioEntry], missing_only: bool) -> Result<()> {
     fn next_non_zero(i: u32) -> u32 {
-        if i == u32::MAX {
-            1
-        } else {
-            i.wrapping_add(1)
-        }
+        if i == u32::MAX { 1 } else { i.wrapping_add(1) }
     }
 
     // (dev maj, dev min) -> (inode set, last assigned inode)

avbroot/src/format/fec.rs

@@ -16,7 +16,7 @@ use rayon::{
     slice::{ParallelSlice, ParallelSliceMut},
 };
 use thiserror::Error;
-use zerocopy::{little_endian, FromBytes, IntoBytes};
+use zerocopy::{FromBytes, IntoBytes, little_endian};
 use zerocopy_derive::{FromBytes, Immutable, IntoBytes, KnownLayout, Unaligned};
 
 use crate::{
@@ -827,7 +827,7 @@ impl<W: Write> ToWriter<W> for FecImage {
 mod tests {
     use std::{
         io::{Cursor, Seek},
-        sync::{atomic::AtomicBool, Arc},
+        sync::{Arc, atomic::AtomicBool},
     };
 
     use assert_matches::assert_matches;

avbroot/src/format/hashtree.rs

@@ -16,7 +16,7 @@ use rayon::{
 };
 use ring::digest::{Algorithm, Context};
 use thiserror::Error;
-use zerocopy::{little_endian, FromBytes, IntoBytes};
+use zerocopy::{FromBytes, IntoBytes, little_endian};
 use zerocopy_derive::{FromBytes, Immutable, IntoBytes, KnownLayout, Unaligned};
 
 use crate::{
@@ -493,7 +493,7 @@ impl HashTreeImage {
     const VERSION: u16 = 1;
 
     fn digest_algorithm(name: &str) -> Result<&'static Algorithm> {
-        avb::digest_algorithm(name, false)
+        avb::digest_algorithm(name)
             .map_err(|_| Error::UnsupportedHashAlgorithm(name.to_owned().into_bytes()))
     }
 

avbroot/src/format/lp.rs

@@ -13,7 +13,7 @@ use bitflags::bitflags;
 use bstr::ByteSlice;
 use serde::{Deserialize, Serialize};
 use thiserror::Error;
-use zerocopy::{byteorder::little_endian, FromBytes, FromZeros, Immutable, IntoBytes};
+use zerocopy::{FromBytes, FromZeros, Immutable, IntoBytes, byteorder::little_endian};
 use zerocopy_derive::{FromBytes, Immutable, IntoBytes, KnownLayout, Unaligned};
 
 use crate::{
@@ -21,7 +21,7 @@ use crate::{
     stream::{
         CountingReader, FromReader, ReadDiscardExt, ReadFixedSizeExt, ToWriter, WriteZerosExt,
     },
-    util::{self, is_zero, DebugString},
+    util::{self, DebugString, is_zero},
 };
 
 /// Magic value for [`RawGeometry::magic`].
@@ -812,7 +812,7 @@ impl RawExtent {
                 return Err(Error::ExtentInvalidType {
                     index,
                     extent_type: n,
-                })
+                });
             }
         }
 

avbroot/src/format/mod.rs

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: 2023 Andrew Gunnerson
+// SPDX-FileCopyrightText: 2023-2025 Andrew Gunnerson
 // SPDX-License-Identifier: GPL-3.0-only
 
 pub mod avb;
@@ -13,3 +13,4 @@ pub mod padding;
 pub mod payload;
 pub mod sparse;
 pub mod verityrs;
+pub mod zip;

avbroot/src/format/ota.rs

@@ -2,29 +2,35 @@
 // SPDX-License-Identifier: GPL-3.0-only
 
 use std::{
+    cmp::Ordering,
     collections::BTreeMap,
-    fmt,
+    fmt::{self, Write as _},
     io::{self, Cursor, Read, Seek, SeekFrom, Write},
     iter,
     path::Path,
+    str::FromStr,
     sync::atomic::AtomicBool,
 };
 
 use clap::ValueEnum;
 use cms::signed_data::SignedData;
-use const_oid::{db::rfc5912, ObjectIdentifier};
+use const_oid::{ObjectIdentifier, db::rfc5912};
 use memchr::memmem;
 use prost::Message;
 use ring::digest::{Algorithm, Context};
 use thiserror::Error;
-use x509_cert::{der::Encode, Certificate};
-use zip::{result::ZipError, write::FileOptions, CompressionMethod, ZipArchive, ZipWriter};
+use x509_cert::{Certificate, der::Encode};
+use zip::{CompressionMethod, DateTime, ZipArchive, result::ZipError, write::SimpleFileOptions};
 
 use crate::{
     crypto::{self, RsaPublicKeyExt, RsaSigningKey, SignatureAlgorithm},
-    format::payload::{self, PayloadHeader},
-    protobuf::build::tools::releasetools::{ota_metadata::OtaType, OtaMetadata},
+    format::{
+        payload::{self, PayloadHeader},
+        zip::ZipWriterWrapper,
+    },
+    protobuf::build::tools::releasetools::{OtaMetadata, ota_metadata::OtaType},
     stream::{self, FromReader, HashingReader, HashingWriter, ReadFixedSizeExt},
+    util,
 };
 
 pub const PATH_METADATA: &str = "META-INF/com/android/metadata";
@@ -70,8 +76,12 @@ pub enum Error {
     InvalidLegacyMetadataLine(String),
     #[error("Unsupported legacy metadata field: {key:?} = {value:?}")]
     UnsupportedLegacyMetadataField { key: String, value: String },
-    #[error("Expected entry offsets {expected:?}, but have {actual:?}")]
-    MismatchedPropertyFiles { expected: String, actual: String },
+    #[error("Mismatched {key:?} entry offsets: zip only: {zip_only:?}, prop only: {prop_only:?}")]
+    MismatchedPropertyFiles {
+        key: String,
+        zip_only: String,
+        prop_only: String,
+    },
     #[error("Property files {value:?} exceed {reserved} byte reserved space")]
     InsufficientReservedSpace { value: String, reserved: usize },
     #[error("Invalid property file entry: {0:?}")]
@@ -280,16 +290,48 @@ fn serialize_metadata(metadata: &OtaMetadata) -> (String, Vec<u8>) {
 
 #[derive(Clone, Debug)]
 pub struct ZipEntry {
-    pub name: String,
+    pub path: String,
     pub offset: u64,
     pub size: u64,
 }
 
-/// Parse OTA property files string.
-pub fn parse_property_files(data: &str) -> Result<Vec<ZipEntry>> {
-    let mut result = vec![];
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct PropEntry {
+    name: String,
+    pub offset: u64,
+    pub size: u64,
+}
 
-    for entry in data.trim_end().split(',') {
+impl PropEntry {
+    pub fn new(path: &str, offset: u64, size: u64) -> Self {
+        Self {
+            name: property_file_name(path).to_owned(),
+            offset,
+            size,
+        }
+    }
+
+    pub fn name(&self) -> &str {
+        &self.name
+    }
+}
+
+impl From<&ZipEntry> for PropEntry {
+    fn from(entry: &ZipEntry) -> Self {
+        Self::new(&entry.path, entry.offset, entry.size)
+    }
+}
+
+impl fmt::Display for PropEntry {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{}:{}:{}", self.name, self.offset, self.size)
+    }
+}
+
+impl FromStr for PropEntry {
+    type Err = Error;
+
+    fn from_str(entry: &str) -> Result<Self> {
         let mut pieces = entry.split(':');
 
         let name = pieces
@@ -309,38 +351,63 @@ pub fn parse_property_files(data: &str) -> Result<Vec<ZipEntry>> {
             return Err(Error::InvalidPropertyFileEntry(entry.to_owned()));
         }
 
-        result.push(ZipEntry { name, offset, size });
+        Ok(Self { name, offset, size })
+    }
+}
+
+/// Parse OTA property files string.
+pub fn parse_property_files(data: &str) -> Result<Vec<PropEntry>> {
+    let mut result = vec![];
+
+    for entry in data.trim_end().split(',') {
+        result.push(entry.parse()?);
     }
 
     Ok(result)
 }
 
+/// Get the filename for use in property files entries.
+fn property_file_name(path: &str) -> &str {
+    path.rsplit_once('/').map_or(path, |p| p.1)
+}
+
 /// Compute the property files entries listing the offsets and sizes to every
 /// zip entry.
 fn compute_property_files(
     pf_name: &str,
-    entries: &[ZipEntry],
+    entries: &[PropEntry],
     max_length: Option<usize>,
     want_pb: bool,
 ) -> Result<String> {
-    let compute = |path: &'static str| -> Result<String> {
+    // AOSP's ota_utils.py reserves 15 bytes for the `<offset>:<size>`
+    // placeholder. Since the size of `metadata.pb` is almost always 4 digits,
+    // this prevents the offset from exceeding 10 digits. In the wild, there are
+    // OTA files larger than 10 GB. With ota_utils.py, this limit is never
+    // reached because it puts the OTA metadata files at the beginning of the
+    // zip. However, avbroot needs to put them at the end due to streaming
+    // writes, so we reserve an additional byte to allow offsets <100 GB.
+    const RESERVATION_SIZE: usize = 16;
+
+    let mut buf = String::new();
+
+    let mut append = |path: &'static str| -> Result<()> {
+        let name = property_file_name(path);
         let entry = entries
             .iter()
-            .find(|e| e.name == path)
+            .find(|e| e.name == name)
             .ok_or(Error::MissingZipEntry(path))?;
-        let name = path.rsplit_once('/').map_or(path, |p| p.1);
 
-        Ok(format!("{name}:{}:{}", entry.offset, entry.size))
+        let _ = write!(&mut buf, "{entry},");
+
+        Ok(())
     };
 
-    let mut tokens = vec![];
-
     if pf_name == PF_NAME {
-        tokens.push(compute(NAME_PAYLOAD_METADATA)?);
+        append(NAME_PAYLOAD_METADATA)?;
     }
 
     for path in [PATH_PAYLOAD, PATH_PROPERTIES] {
-        tokens.push(compute(path)?);
+        append(path)?;
     }
 
     for path in [
@@ -349,44 +416,51 @@ fn compute_property_files(
         "care_map.txt",
         "compatibility.zip",
     ] {
-        if let Ok(token) = compute(path) {
-            tokens.push(token);
-        }
+        // These are optional.
+        let _ = append(path);
     }
 
     if max_length.is_none() {
-        tokens.push(format!("metadata:{}", " ".repeat(15)));
+        buf.push_str(property_file_name(PATH_METADATA));
+        buf.push(':');
+        buf.extend(iter::repeat_n(' ', RESERVATION_SIZE));
+        buf.push(',');
+
         if want_pb {
-            tokens.push(format!("metadata.pb:{}", " ".repeat(15)));
+            buf.push_str(property_file_name(PATH_METADATA_PB));
+            buf.push(':');
+            buf.extend(iter::repeat_n(' ', RESERVATION_SIZE));
+            buf.push(',');
         }
     } else {
-        tokens.push(compute(PATH_METADATA)?);
+        append(PATH_METADATA)?;
         if want_pb {
-            tokens.push(compute(PATH_METADATA_PB)?);
+            append(PATH_METADATA_PB)?;
         }
     }
 
-    let mut joined = tokens.join(",");
+    // Strip final trailing comma.
+    buf.pop();
 
     if let Some(l) = max_length {
-        if joined.len() > l {
+        if buf.len() > l {
             return Err(Error::InsufficientReservedSpace {
-                value: joined,
+                value: buf,
                 reserved: l,
             });
         }
 
-        let remain = l - joined.len();
-        joined.extend(iter::repeat_n(' ', remain));
+        let remain = l - buf.len();
+        buf.extend(iter::repeat_n(' ', remain));
     }
 
-    Ok(joined)
+    Ok(buf)
 }
 
 // Add fake payload_metadata.bin entry, covering the header + header signature
 // regions of the payload.
 fn add_payload_metadata_entry(
-    entries: &mut Vec<ZipEntry>,
+    entries: &mut Vec<PropEntry>,
     payload_metadata_size: u64,
 ) -> Result<()> {
     let payload_offset = entries
@@ -394,11 +468,11 @@ fn add_payload_metadata_entry(
         .find(|e| e.name == PATH_PAYLOAD)
         .ok_or(Error::MissingZipEntry(PATH_PAYLOAD))?
         .offset;
-    entries.push(ZipEntry {
-        name: NAME_PAYLOAD_METADATA.to_owned(),
-        offset: payload_offset,
-        size: payload_metadata_size,
-    });
+    entries.push(PropEntry::new(
+        NAME_PAYLOAD_METADATA,
+        payload_offset,
+        payload_metadata_size,
+    ));
 
     Ok(())
 }
@@ -426,17 +500,19 @@ impl fmt::Display for ZipMode {
 /// directory would start.
 pub fn add_metadata(
     zip_entries: &[ZipEntry],
-    zip_writer: &mut ZipWriter<impl Write>,
+    zip_writer: &mut ZipWriterWrapper<impl Write>,
     next_offset: u64,
     metadata: &OtaMetadata,
     payload_metadata_size: u64,
     zip_mode: ZipMode,
 ) -> Result<OtaMetadata> {
     let mut metadata = metadata.clone();
-    let options = FileOptions::default().compression_method(CompressionMethod::Stored);
+    let options = SimpleFileOptions::default()
+        .last_modified_time(DateTime::default())
+        .compression_method(CompressionMethod::Stored);
 
-    let mut zip_entries = zip_entries.to_owned();
-    add_payload_metadata_entry(&mut zip_entries, payload_metadata_size)?;
+    let mut prop_entries = zip_entries.iter().map(PropEntry::from).collect();
+    add_payload_metadata_entry(&mut prop_entries, payload_metadata_size)?;
 
     // Compute initial property files with reserved space as placeholders to
     // store the self-referential metadata entries later.
@@ -444,7 +520,7 @@ pub fn add_metadata(
     for pf in [PF_NAME, PF_STREAMING_NAME] {
         metadata.property_files.insert(
             pf.to_owned(),
-            compute_property_files(pf, &zip_entries, None, true)?,
+            compute_property_files(pf, &prop_entries, None, true)?,
         );
     }
 
@@ -453,68 +529,56 @@ pub fn add_metadata(
         let (legacy_raw, modern_raw) = serialize_metadata(&metadata);
         let raw_writer = Cursor::new(Vec::new());
         let mut writer = match zip_mode {
-            ZipMode::Streaming => ZipWriter::new_streaming(raw_writer),
-            ZipMode::Seekable => ZipWriter::new(raw_writer),
+            ZipMode::Streaming => ZipWriterWrapper::new_streaming(raw_writer),
+            ZipMode::Seekable => ZipWriterWrapper::new_seekable(raw_writer),
         };
 
-        writer
-            .start_file_with_extra_data(PATH_METADATA, options)
-            .map_err(|e| Error::ZipEntryStart(PATH_METADATA, e))?;
         let legacy_offset = writer
-            .end_extra_data()
+            .start_file(PATH_METADATA, options)
             .map_err(|e| Error::ZipEntryStart(PATH_METADATA, e))?;
         writer
             .write_all(legacy_raw.as_bytes())
             .map_err(|e| Error::ZipEntryWrite(PATH_METADATA, e))?;
 
-        writer
-            .start_file_with_extra_data(PATH_METADATA_PB, options)
-            .map_err(|e| Error::ZipEntryStart(PATH_METADATA_PB, e))?;
         let modern_offset = writer
-            .end_extra_data()
+            .start_file(PATH_METADATA_PB, options)
             .map_err(|e| Error::ZipEntryStart(PATH_METADATA_PB, e))?;
         writer
             .write_all(&modern_raw)
             .map_err(|e| Error::ZipEntryWrite(PATH_METADATA_PB, e))?;
 
-        zip_entries.push(ZipEntry {
-            name: PATH_METADATA.to_owned(),
-            offset: next_offset + legacy_offset,
-            size: legacy_raw.len() as u64,
-        });
-        zip_entries.push(ZipEntry {
-            name: PATH_METADATA_PB.to_owned(),
-            offset: next_offset + modern_offset,
-            size: modern_raw.len() as u64,
-        });
+        prop_entries.push(PropEntry::new(
+            PATH_METADATA,
+            next_offset + legacy_offset,
+            legacy_raw.len() as u64,
+        ));
+        prop_entries.push(PropEntry::new(
+            PATH_METADATA_PB,
+            next_offset + modern_offset,
+            modern_raw.len() as u64,
+        ));
 
         (next_offset + legacy_offset, next_offset + modern_offset)
     };
 
     // Compute the final property files using the offsets of the fake entries.
     for (key, value) in &mut metadata.property_files {
-        *value = compute_property_files(key, &zip_entries, Some(value.len()), true)?;
+        *value = compute_property_files(key, &prop_entries, Some(value.len()), true)?;
     }
 
     // Add the final metadata files to the real zip.
     {
         let (legacy_raw, modern_raw) = serialize_metadata(&metadata);
 
-        zip_writer
-            .start_file_with_extra_data(PATH_METADATA, options)
-            .map_err(|e| Error::ZipEntryStart(PATH_METADATA, e))?;
         let legacy_offset = zip_writer
-            .end_extra_data()
+            .start_file(PATH_METADATA, options)
             .map_err(|e| Error::ZipEntryStart(PATH_METADATA, e))?;
         zip_writer
             .write_all(legacy_raw.as_bytes())
             .map_err(|e| Error::ZipEntryWrite(PATH_METADATA, e))?;
 
-        zip_writer
-            .start_file_with_extra_data(PATH_METADATA_PB, options)
-            .map_err(|e| Error::ZipEntryStart(PATH_METADATA_PB, e))?;
         let modern_offset = zip_writer
-            .end_extra_data()
+            .start_file(PATH_METADATA_PB, options)
             .map_err(|e| Error::ZipEntryStart(PATH_METADATA_PB, e))?;
         zip_writer
             .write_all(&modern_raw)
@@ -540,24 +604,73 @@ pub fn verify_metadata(
         let entry = zip_reader
             .by_index(i)
             .map_err(|e| Error::ZipIndexOpen(i, e))?;
-        zip_entries.push(ZipEntry {
-            name: entry.name().to_owned(),
-            offset: entry.data_start(),
-            size: entry.size(),
-        });
+
+        if entry.compression() != CompressionMethod::Stored {
+            continue;
+        }
+
+        zip_entries.push(PropEntry::new(
+            entry.name(),
+            entry.data_start(),
+            entry.size(),
+        ));
     }
 
     add_payload_metadata_entry(&mut zip_entries, payload_metadata_size)?;
 
-    let metadata_pb = zip_entries.iter().find(|e| e.name == PATH_METADATA_PB);
+    zip_entries.sort_by(|a, b| a.name.cmp(&b.name));
 
     for (key, value) in &metadata.property_files {
-        let new_value =
-            compute_property_files(key, &zip_entries, Some(value.len()), metadata_pb.is_some())?;
-        if *value != new_value {
+        let mut prop_entries = parse_property_files(value)?;
+        prop_entries.sort_by(|a, b| a.name.cmp(&b.name));
+
+        // Check that this is a subset of the actual entries.
+        let mut zip_iter = zip_entries.iter().peekable();
+        let mut prop_iter = prop_entries.iter().peekable();
+        let mut zip_only = vec![];
+        let mut prop_only = vec![];
+
+        loop {
+            match (zip_iter.peek(), prop_iter.peek()) {
+                (Some(&zip), Some(&prop)) => match zip.name.cmp(&prop.name) {
+                    Ordering::Less => {
+                        // Exists in zip, but not in property files.
+                        zip_iter.next();
+                    }
+                    Ordering::Equal => {
+                        // If the zip had multiple files with the same filename,
+                        // but in different directories, this will fail.
+                        if zip != prop {
+                            zip_only.push(zip);
+                            prop_only.push(prop);
+                        }
+                        zip_iter.next();
+                        prop_iter.next();
+                    }
+                    Ordering::Greater => {
+                        // Exists in property files, but not in zip.
+                        prop_only.push(prop);
+                        prop_iter.next();
+                    }
+                },
+                (Some(_), None) => {
+                    // Exists in zip, but not in property files.
+                    zip_iter.next();
+                }
+                (None, Some(prop)) => {
+                    // Exists in property files, but not in zip.
+                    prop_only.push(prop);
+                    prop_iter.next();
+                }
+                (None, None) => break,
+            }
+        }
+
+        if !zip_only.is_empty() || !prop_only.is_empty() {
             return Err(Error::MismatchedPropertyFiles {
-                expected: value.clone(),
-                actual: new_value,
+                key: key.clone(),
+                zip_only: util::join(zip_only.into_iter().map(|e| e.to_string()), ","),
+                prop_only: util::join(prop_only.into_iter().map(|e| e.to_string()), ","),
             });
         }
     }

avbroot/src/format/payload.rs

@@ -11,10 +11,10 @@ use std::{
     sync::atomic::AtomicBool,
 };
 
-use base64::engine::general_purpose::STANDARD;
 use base64::Engine;
+use base64::engine::general_purpose::STANDARD;
 use bzip2::write::BzDecoder;
-use flate2::{write::GzEncoder, Compression};
+use flate2::{Compression, write::GzEncoder};
 use liblzma::{
     stream::{Check, Stream},
     write::XzDecoder,
@@ -30,14 +30,14 @@ use ring::digest::{Context, Digest};
 use serde::{Deserialize, Serialize};
 use thiserror::Error;
 use x509_cert::Certificate;
-use zerocopy::{big_endian, FromBytes, IntoBytes};
+use zerocopy::{FromBytes, IntoBytes, big_endian};
 use zerocopy_derive::{FromBytes, Immutable, IntoBytes, KnownLayout, Unaligned};
 
 use crate::{
     crypto::{self, RsaPublicKeyExt, RsaSigningKey, SignatureAlgorithm},
     protobuf::chromeos_update_engine::{
-        install_operation::Type, signatures::Signature, DeltaArchiveManifest, Extent,
-        InstallOperation, PartitionInfo, PartitionUpdate, Signatures,
+        DeltaArchiveManifest, Extent, InstallOperation, PartitionInfo, PartitionUpdate, Signatures,
+        install_operation::Type, signatures::Signature,
     },
     stream::{
         self, CountingReader, FromReader, HashingWriter, ReadDiscardExt, ReadFixedSizeExt,
@@ -121,7 +121,9 @@ pub enum Error {
     DataWrite(&'static str, #[source] io::Error),
     #[error("Expected {expected} bytes, but only wrote {actual} bytes")]
     UnwrittenData { actual: u64, expected: u64 },
-    #[error("I/O error when applying {op_type:?} operation for {num_blocks} blocks starting at {start_block}")]
+    #[error(
+        "I/O error when applying {op_type:?} operation for {num_blocks} blocks starting at {start_block}"
+    )]
     OperationApply {
         op_type: Type,
         start_block: u64,

avbroot/src/format/sparse.rs

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: 2024 Andrew Gunnerson
+// SPDX-FileCopyrightText: 2024-2025 Andrew Gunnerson
 // SPDX-License-Identifier: GPL-3.0-only
 
 use std::{
@@ -11,7 +11,7 @@ use std::{
 use crc32fast::Hasher;
 use dlv_list::{Index, VecList};
 use thiserror::Error;
-use zerocopy::{byteorder::little_endian, FromBytes, IntoBytes};
+use zerocopy::{FromBytes, IntoBytes, byteorder::little_endian};
 use zerocopy_derive::{FromBytes, Immutable, IntoBytes, KnownLayout, Unaligned};
 
 use crate::stream::ReadDiscardExt;
@@ -225,7 +225,7 @@ impl RawChunk {
                 return Err(Error::InvalidChunkType {
                     index,
                     chunk_type: t,
-                })
+                });
             }
         };
 
@@ -374,6 +374,9 @@ impl fmt::Debug for ChunkData {
 /// metadata they contain.
 #[derive(Clone, Copy, PartialEq, Eq)]
 pub struct Chunk {
+    /// When [`Self::data`] is [`ChunkData::Data`], this is guaranteed to not
+    /// exceed the bounds of [`u32`] when multiplied by [`Header::block_size`].
+    /// For other types of data, a 64-bit signed or unsigned integer is needed.
     pub bounds: ChunkBounds,
     pub data: ChunkData,
 }

avbroot/src/format/zip.rs

@@ -0,0 +1,103 @@
+// SPDX-FileCopyrightText: 2025 Andrew Gunnerson
+// SPDX-License-Identifier: GPL-3.0-only
+
+use std::io::{self, Seek, SeekFrom, Write};
+
+use zip::{
+    ZipWriter,
+    result::ZipResult,
+    write::{FileOptionExtension, FileOptions, StreamWriter},
+};
+
+/// A wrapper around a seekable writer. `W` must implement [`Seek`], but only
+/// during the creation of a new instance. The resulting type can be stored in a
+/// parent container where the generic type does not implement [`Seek`].
+pub struct SeekWriter<W: Write> {
+    inner: W,
+    seek_fn: fn(&mut W, SeekFrom) -> io::Result<u64>,
+}
+
+impl<W: Write> SeekWriter<W> {
+    pub fn into_inner(self) -> W {
+        self.inner
+    }
+}
+
+impl<W: Write + Seek> SeekWriter<W> {
+    pub fn new(inner: W) -> Self {
+        Self {
+            inner,
+            seek_fn: W::seek,
+        }
+    }
+}
+
+impl<W: Write> Write for SeekWriter<W> {
+    fn write(&mut self, buf: &[u8]) -> io::Result<usize> {
+        self.inner.write(buf)
+    }
+
+    fn flush(&mut self) -> io::Result<()> {
+        self.inner.flush()
+    }
+}
+
+impl<W: Write> Seek for SeekWriter<W> {
+    fn seek(&mut self, pos: SeekFrom) -> io::Result<u64> {
+        (self.seek_fn)(&mut self.inner, pos)
+    }
+}
+
+/// This is an ugly hack to have a single type represent both seekable and
+/// streaming [`ZipWriter`]s. `W` only needs to implement [`Seek`] when creating
+/// a seekable instance via [`Self::new_seekable`].
+pub enum ZipWriterWrapper<W: Write> {
+    Streaming(ZipWriter<StreamWriter<W>>),
+    Seekable(ZipWriter<SeekWriter<W>>),
+}
+
+impl<W: Write + Seek> ZipWriterWrapper<W> {
+    pub fn new_seekable(inner: W) -> Self {
+        Self::Seekable(ZipWriter::new(SeekWriter::new(inner)))
+    }
+}
+
+impl<W: Write> ZipWriterWrapper<W> {
+    pub fn new_streaming(inner: W) -> Self {
+        Self::Streaming(ZipWriter::new_stream(inner))
+    }
+
+    pub fn start_file(
+        &mut self,
+        name: impl ToString,
+        options: FileOptions<impl FileOptionExtension>,
+    ) -> ZipResult<u64> {
+        match self {
+            Self::Streaming(z) => z.start_file(name, options),
+            Self::Seekable(z) => z.start_file(name, options),
+        }
+    }
+
+    pub fn finish(self) -> ZipResult<W> {
+        match self {
+            Self::Streaming(z) => Ok(z.finish()?.into_inner()),
+            Self::Seekable(z) => Ok(z.finish()?.into_inner()),
+        }
+    }
+}
+
+impl<W: Write> Write for ZipWriterWrapper<W> {
+    fn write(&mut self, buf: &[u8]) -> io::Result<usize> {
+        match self {
+            Self::Streaming(z) => z.write(buf),
+            Self::Seekable(z) => z.write(buf),
+        }
+    }
+
+    fn flush(&mut self) -> io::Result<()> {
+        match self {
+            Self::Streaming(z) => z.flush(),
+            Self::Seekable(z) => z.flush(),
+        }
+    }
+}

avbroot/src/main.rs

@@ -4,8 +4,8 @@
 use std::{
     process::ExitCode,
     sync::{
-        atomic::{AtomicBool, Ordering},
         Arc,
+        atomic::{AtomicBool, Ordering},
     },
 };
 

avbroot/src/octal.rs

@@ -10,7 +10,7 @@ use std::{
 };
 
 use num_traits::{Num, PrimInt};
-use serde::{de::Visitor, Deserializer, Serializer};
+use serde::{Deserializer, Serializer, de::Visitor};
 
 pub fn serialize<S, T>(data: &T, serializer: S) -> Result<S::Ok, S::Error>
 where

avbroot/src/patch/boot.rs

@@ -24,9 +24,9 @@ use regex::bytes::Regex;
 use ring::digest::Context;
 use rsa::RsaPublicKey;
 use thiserror::Error;
-use tracing::{debug, debug_span, trace, warn, Span};
+use tracing::{Span, debug, debug_span, trace, warn};
 use x509_cert::Certificate;
-use zip::{result::ZipError, ZipArchive};
+use zip::{ZipArchive, result::ZipError};
 
 use crate::{
     crypto::{self, RsaSigningKey},
@@ -194,7 +194,7 @@ impl MagiskRootPatcher {
     //   replaced by PREINITDEVICE
     // - Versions newer than the latest supported version are assumed to support
     //   the same features as the latest version
-    const VERS_SUPPORTED: &'static [Range<u32>] = &[25102..25207, 25211..28200];
+    const VERS_SUPPORTED: &'static [Range<u32>] = &[25102..25207, 25211..30300];
     const VER_PREINIT_DEVICE: RangeFrom<u32> = 25211..;
     const VER_RANDOM_SEED: Range<u32> = 25211..26103;
     const VER_PATCH_VBMETA: Range<u32> = Self::VERS_SUPPORTED[0].start..26202;

avbroot/src/patch/otacert.rs

@@ -6,8 +6,8 @@ use std::{borrow::Cow, cmp::Ordering, io::Cursor, path::Path};
 use bitflags::bitflags;
 use thiserror::Error;
 use tracing::trace;
-use x509_cert::{der::asn1::BitString, Certificate};
-use zip::{result::ZipError, write::FileOptions, CompressionMethod, ZipWriter};
+use x509_cert::{Certificate, der::asn1::BitString};
+use zip::{CompressionMethod, DateTime, ZipWriter, result::ZipError, write::SimpleFileOptions};
 
 use crate::{crypto, format::ota};
 
@@ -79,7 +79,9 @@ pub fn create_zip(cert: &Certificate, flags: OtaCertBuildFlags) -> Result<Vec<u8
         CompressionMethod::Stored
     };
 
-    let options = FileOptions::default().compression_method(compression_method);
+    let options = SimpleFileOptions::default()
+        .last_modified_time(DateTime::default())
+        .compression_method(compression_method);
     let name = "ota.x509.pem";
     writer.start_file(name, options).map_err(Error::ZipWrite)?;
 

avbroot/src/patch/system.rs

@@ -10,7 +10,7 @@ use std::{
 use memchr::memmem;
 use rayon::iter::{IntoParallelIterator, ParallelIterator};
 use thiserror::Error;
-use tracing::{debug, debug_span, trace, Span};
+use tracing::{Span, debug, debug_span, trace};
 use x509_cert::Certificate;
 use zip::ZipArchive;
 
@@ -190,23 +190,9 @@ pub fn patch_system_image(
         return Err(Error::OldZipNotFound);
     }
 
-    let update_ranges = if descriptor.hash_algorithm == "sha1" {
-        // Promote to a secure algorithm. SHA1 is allowed for verification only.
-        // The entire hash tree and FEC data will need to be recomputed.
-        let new_algorithm = "sha256".to_owned();
-
-        debug!(
-            "Changing insecure hash algorithm {} to {new_algorithm}",
-            descriptor.hash_algorithm,
-        );
-
-        descriptor.hash_algorithm = new_algorithm;
-        None
-    } else {
-        // Only need to update the hash tree and FEC data corresponding to the
-        // modified regions.
-        Some(modified_ranges.as_slice())
-    };
+    // Only need to update the hash tree and FEC data corresponding to the
+    // modified regions.
+    let update_ranges = Some(modified_ranges.as_slice());
 
     descriptor
         .update(input, output, update_ranges, cancel_signal)

avbroot/src/stream.rs

@@ -5,8 +5,8 @@ use std::{
     fs::File,
     io::{self, BufReader, BufWriter, Cursor, Read, Seek, SeekFrom, Write},
     sync::{
-        atomic::{AtomicBool, Ordering},
         Arc, Mutex, RwLock,
+        atomic::{AtomicBool, Ordering},
     },
 };
 

avbroot/src/util.rs

@@ -1,9 +1,10 @@
-// SPDX-FileCopyrightText: 2023-2024 Andrew Gunnerson
+// SPDX-FileCopyrightText: 2023-2025 Andrew Gunnerson
 // SPDX-License-Identifier: GPL-3.0-only
 
 use std::{
     cmp::Ordering,
-    fmt, mem,
+    fmt::{self, Display},
+    mem,
     ops::{
         Bound, Range, RangeBounds, RangeFrom, RangeFull, RangeInclusive, RangeTo, RangeToInclusive,
     },
@@ -378,6 +379,28 @@ where
         .is_ok()
 }
 
+pub fn join(into_iter: impl IntoIterator<Item = impl Display>, sep: &str) -> String {
+    use std::fmt::Write;
+
+    let mut result = String::new();
+
+    for (i, item) in into_iter.into_iter().enumerate() {
+        if i > 0 {
+            result.push_str(sep);
+        }
+
+        write!(result, "{item}").expect("Failed to allocate");
+    }
+
+    result
+}
+
+pub fn sort<T: Ord>(iter: impl Iterator<Item = T>) -> Vec<T> {
+    let mut items = iter.collect::<Vec<_>>();
+    items.sort();
+    items
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;

deny.toml

@@ -69,5 +69,5 @@ bypass = [
 unknown-registry = "deny"
 unknown-git = "deny"
 allow-git = [
-    "https://github.com/chenxiaolong/zip",
+    "https://github.com/chenxiaolong/zip2",
 ]

e2e/Cargo.toml

@@ -18,16 +18,18 @@ ring = "0.17.14"
 rsa = { version = "0.9.6", features = ["hazmat"] }
 serde = { version = "1.0.188", features = ["derive"] }
 tempfile = "3.8.0"
-toml_edit = { version = "0.22.9", features = ["serde"] }
+toml_edit = { version = "0.23.3", features = ["serde"] }
 topological-sort = "0.2.2"
 tracing = "0.1.40"
 tracing-subscriber = "0.3.18"
 x509-cert = "0.2.5"
 
-# https://github.com/zip-rs/zip/pull/383
+# https://github.com/zip-rs/zip2/pull/367
+# https://github.com/zip-rs/zip2/pull/368
+# For getting the data offset when writing new zip entries.
 [dependencies.zip]
-git = "https://github.com/chenxiaolong/zip"
-rev = "989101f9384b9e94e36e6e9e0f51908fdf98bde6"
+git = "https://github.com/chenxiaolong/zip2"
+rev = "59685f4dadbfee8cb3ea74c8fbb402b60d8137e8"
 default-features = false
 
 [features]

e2e/e2e.toml

@@ -51,12 +51,12 @@ data.version = "vendor_v4"
 data.ramdisks = [["otacerts", "first_stage", "dsu_key_dir"]]
 
 [profile.pixel_v4_gki.hashes_streaming]
-original = "c83bff30dbd30ed8baf5a954a158a2c3a75b25175089809e52ea9052020b0627"
-patched = "20bd1835c6ea90104eab7ec51be48ee8aae76508f8a6501621d7a1f384103c2f"
+original = "ef6261cd9ebea90f036e52a46160a400c5b8f6ef24ed2469c4a1e9689987aa06"
+patched = "37fd353a766a7b9a339fbf51fa79c703e94640dc6a2c6310d79357aaefcc7ca1"
 
 [profile.pixel_v4_gki.hashes_seekable]
-original = "ffc5c7839dfa68d5ff7d888287f808259be34bd63c5df0a385e2e78e6fdcc647"
-patched = "90a51e890560486d4bd73685176c833c94f31f9d05d524186bb4c544c8eca32c"
+original = "8a2c717607c10dfa5483d6f9a9f37b3d978acaf8d2ea18e36544af267943e750"
+patched = "2c4734c9e1d028ee6aaf02bb416e5e173857faffd2ca067366790655147b3afa"
 
 # Google Pixel 6a
 # What's unique: boot (boot v4, no ramdisk) + vendor_boot (vendor v4, 2 ramdisks)
@@ -93,12 +93,12 @@ data.version = "vendor_v4"
 data.ramdisks = [["init", "otacerts", "first_stage", "dsu_key_dir"], ["dlkm"]]
 
 [profile.pixel_v4_non_gki.hashes_streaming]
-original = "8d76f17b33949c8ca3d4d5872858bb725d755e315f67d61db0e0b7b58cf69685"
-patched = "7c7cb69087d4c8c54a7f4bac6525354b1e9c1550545bc954194aaf6882f7982d"
+original = "630220ef813a2b4743d1941179cc9705da86ad4805f1c52341dcb38fbce3d29e"
+patched = "b725e91751fe58aed20495aecbf9b4bdc14d2799cd88dcbd58f3a3b02b3af15b"
 
 [profile.pixel_v4_non_gki.hashes_seekable]
-original = "6825bc02115e0c64f05651571138fbcc5cc04459e5c7e225dcc5e3096051c341"
-patched = "373309f28234866625462253d6f41f5a3b016b3676c7cb87a88bf55099ad6b13"
+original = "1afbe6867ded345d941098ee7c7fcf94a3df52c50ff96ab8f3a67b2ab957259a"
+patched = "4357b977249006b101002c961916f962787315a80b8608494c6a1f0cf09cecd1"
 
 # Google Pixel 4a 5G
 # What's unique: boot (boot v3) + vendor_boot (vendor v3)
@@ -136,12 +136,12 @@ data.version = "vendor_v3"
 data.ramdisks = [["otacerts", "first_stage", "dsu_key_dir"]]
 
 [profile.pixel_v3.hashes_streaming]
-original = "678f5ba8cff01802ce964d31abf7a2c77b63e9c06e911857b588a16872fb6860"
-patched = "3691c2cf89728307e143b7084b40bbbfb181e15be6f65914a6c40408e0c6eab3"
+original = "9b65037343d45211e0f9706929cba34643a9c54274d1b39740c43f45974984e0"
+patched = "fb23ab9616968b38b96d1e5e6a503154f89aebc1741e89a9e9dfd2c4d9946b05"
 
 [profile.pixel_v3.hashes_seekable]
-original = "202d447215f80919f464bd59c7b38f20cbe3a9625d38bc81a0b71e5a3da334eb"
-patched = "ec94739fdef7efc4930e96828761c2ebd4ece79014b735eab303c5cbdda2e529"
+original = "e581934887dd93b8a9d9c3aa5dec1d48aa7e01bf01ac507e8c5fb256b59cbe7d"
+patched = "669a826abc6d67e7e0b1def724aa7b470461087255c65663d195df1426a355f0"
 
 # Google Pixel 4a
 # What's unique: boot (boot v2)
@@ -169,9 +169,9 @@ data.type = "vbmeta"
 data.deps = ["system"]
 
 [profile.pixel_v2.hashes_streaming]
-original = "79bb20bd57f51a8a7b52d0ff59b7d096a1e4ada425a6230818ca25916a81e021"
-patched = "7f199cc4a6fd244034b597cb916651e1c3e0d6f59450617a5cadbd274f02ec7a"
+original = "f10ee15c900a474cc6bbefa705f272cef42636ea096e75563d2d78f6c4327fd1"
+patched = "6929f65909037f5550a53982b71e96bdf69ab876bc5e86702c469ed601be8a9a"
 
 [profile.pixel_v2.hashes_seekable]
-original = "c9b32282f247555fed92cc6d599b9005c81ffdc88d5f55d2248e8bf6fb66f1b5"
-patched = "c856f7f7245c02d32b3cec93c2d4365a2b3823fed9a9b27f94508637d79b1492"
+original = "4e863d251b9ff6eaa1511f9c03e9bdb8919650b2e0eaf23e33892a639edafcaf"
+patched = "9a103222e73df70a097281525546d25c850df2ae7a2ba715aa5dfbbba3f7972b"

e2e/src/main.rs

@@ -14,12 +14,12 @@ use std::{
     path::{Path, PathBuf},
     slice,
     sync::{
-        atomic::{AtomicBool, Ordering},
         Arc,
+        atomic::{AtomicBool, Ordering},
     },
 };
 
-use anyhow::{anyhow, bail, Context, Result};
+use anyhow::{Context, Result, anyhow, bail};
 use avbroot::{
     cli::ota::{ExtractCli, PatchCli, VerifyCli},
     crypto::{self, PassphraseSource, RsaSigningKey},
@@ -37,10 +37,11 @@ use avbroot::{
         ota::{self, SigningWriter, ZipEntry, ZipMode},
         padding,
         payload::{self, CowVersion, PayloadHeader, PayloadWriter, VabcParams},
+        zip::ZipWriterWrapper,
     },
     patch::otacert::{self, OtaCertBuildFlags},
     protobuf::{
-        build::tools::releasetools::{ota_metadata::OtaType, DeviceState, OtaMetadata},
+        build::tools::releasetools::{DeviceState, OtaMetadata, ota_metadata::OtaType},
         chromeos_update_engine::{
             DeltaArchiveManifest, DynamicPartitionGroup, DynamicPartitionMetadata, PartitionUpdate,
         },
@@ -48,12 +49,12 @@ use avbroot::{
     stream::{self, CountingWriter, FromReader, HashingReader, PSeekFile, Reopen, ToWriter},
 };
 use clap::Parser;
-use rsa::{rand_core::OsRng, traits::PublicKeyParts, BigUint};
+use rsa::{BigUint, rand_core::OsRng, traits::PublicKeyParts};
 use tempfile::TempDir;
 use topological_sort::TopologicalSort;
 use tracing::{info, info_span};
 use x509_cert::Certificate;
-use zip::{write::FileOptions, CompressionMethod, ZipWriter};
+use zip::{CompressionMethod, DateTime, ZipWriter, write::SimpleFileOptions};
 
 use crate::{
     cli::{Cli, Command, HelperCli, ListCli, PassSource, ProfileGroup, TestCli},
@@ -374,7 +375,7 @@ fn create_boot_image(
                         .ramdisks
                         .iter()
                         .map(|c_list| {
-                            if c_list.iter().any(|c| *c == RamdiskContent::Dlkm) {
+                            if c_list.contains(&RamdiskContent::Dlkm) {
                                 RamdiskMeta {
                                     ramdisk_type: bootimage::VENDOR_RAMDISK_TYPE_DLKM,
                                     ramdisk_name: "dlkm".to_owned(),
@@ -741,14 +742,15 @@ fn create_ota(
     let mut zip_writer = match zip_mode {
         ZipMode::Streaming => {
             let signing_writer = SigningWriter::new_streaming(raw_writer);
-            ZipWriter::new_streaming(signing_writer)
+            ZipWriterWrapper::new_streaming(signing_writer)
         }
         ZipMode::Seekable => {
             let signing_writer = SigningWriter::new_seekable(raw_writer);
-            ZipWriter::new(signing_writer)
+            ZipWriterWrapper::new_seekable(signing_writer)
         }
     };
-    let options = FileOptions::default()
+    let options = SimpleFileOptions::default()
+        .last_modified_time(DateTime::default())
         .compression_method(CompressionMethod::Stored)
         .large_file(false);
 
@@ -758,12 +760,9 @@ fn create_ota(
 
     for path in [ota::PATH_OTACERT, ota::PATH_PAYLOAD, ota::PATH_PROPERTIES] {
         // All remaining entries are written immediately.
-        zip_writer
-            .start_file_with_extra_data(path, options)
-            .with_context(|| format!("Failed to begin new zip entry: {path}"))?;
         let offset = zip_writer
-            .end_extra_data()
-            .with_context(|| format!("Failed to end new zip entry: {path}"))?;
+            .start_file(path, options)
+            .with_context(|| format!("Failed to begin new zip entry: {path}"))?;
         let mut writer = CountingWriter::new(&mut zip_writer);
 
         match path {
@@ -798,7 +797,7 @@ fn create_ota(
         let size = writer.stream_position()?;
 
         entries.push(ZipEntry {
-            name: path.to_owned(),
+            path: path.to_owned(),
             offset,
             size,
         });
@@ -864,6 +863,7 @@ fn create_fake_magisk(output: &Path) -> Result<()> {
     let raw_writer =
         File::create(output).with_context(|| format!("Failed to open for writing: {output:?}"))?;
     let mut zip_writer = ZipWriter::new(raw_writer);
+    let options = SimpleFileOptions::default().last_modified_time(DateTime::default());
 
     for path in [
         "assets/stub.apk",
@@ -880,12 +880,12 @@ fn create_fake_magisk(output: &Path) -> Result<()> {
         "lib/x86_64/libmagisk64.so",
         "lib/x86_64/libmagiskinit.so",
     ] {
-        zip_writer.start_file(path, FileOptions::default())?;
+        zip_writer.start_file(path, options)?;
         write!(zip_writer, "dummy contents for {path}")?;
     }
 
     // avbroot looks for the version number in this file.
-    zip_writer.start_file("assets/util_functions.sh", FileOptions::default())?;
+    zip_writer.start_file("assets/util_functions.sh", options)?;
     zip_writer.write_all(b"MAGISK_VER_CODE=27000\n")?;
 
     Ok(())
@@ -1140,7 +1140,7 @@ fn clean_boot_image_certs(path: &Path, cancel_signal: &AtomicBool) -> Result<()>
         .iter_mut()
         .find(|e| e.path == b"system/etc/security/otacerts.zip")
     {
-        let mut zip_writer = ZipWriter::new(Cursor::new(Vec::new()));
+        let zip_writer = ZipWriter::new(Cursor::new(Vec::new()));
         let empty_zip = zip_writer.finish()?.into_inner();
 
         entry.data = CpioEntryData::Data(empty_zip);
@@ -1234,8 +1234,9 @@ fn test_subcommand(cli: &TestCli, cancel_signal: &AtomicBool) -> Result<()> {
         ] {
             let _span = info_span!("profile", name, %zip_mode).entered();
 
-            // Can't used NamedTempFile because avbroot does atomic replaces.
-            let profile_dir = work_dir.join(name);
+            // Can't use NamedTempFile because avbroot does atomic replaces.
+            let mut profile_dir = work_dir.join(name);
+            profile_dir.push(zip_mode.to_string());
             let out_original = profile_dir.join("ota.zip");
             let out_magisk = profile_dir.join("ota_magisk.zip");
             let out_prepatched = profile_dir.join("ota_prepatched.zip");

xtask/Cargo.toml

@@ -12,7 +12,7 @@ publish = false
 anyhow = "1.0.75"
 clap = { version = "4.4.1", features = ["derive"] }
 regex = { version = "1.9.4", default-features = false, features = ["perf", "std"] }
-toml_edit = "0.22.9"
+toml_edit = "0.23.3"
 
 [lints]
 workspace = true

xtask/src/changelog.rs

@@ -9,7 +9,7 @@ use std::{
     path::Path,
 };
 
-use anyhow::{anyhow, bail, Result};
+use anyhow::{Result, anyhow, bail};
 use regex::Regex;
 
 use crate::WORKSPACE_DIR;

xtask/src/version.rs

@@ -7,9 +7,9 @@ use std::{
     path::Path,
 };
 
-use anyhow::{bail, Result};
+use anyhow::{Result, bail};
 use clap::Parser;
-use toml_edit::{value, DocumentMut};
+use toml_edit::{DocumentMut, value};
 
 use crate::WORKSPACE_DIR;