Version 3.19.0

Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>

CHANGELOG.md

@@ -7,6 +7,12 @@
     to update the actual links at the bottom of the file.
 -->
 
+### Version 3.19.0
+
+* Allow verifying hashes of unsigned images with `avbroot avb verify` ([PR #477])
+* Warn when verifying image containing insecure flags field with `avbroot avb verify` ([PR #478])
+* Force re-signing of signed images in `avbroot avb pack` when fields were changed externally ([PR #479])
+
 ### Version 3.18.1
 
 * Fix output file corruption in `avbroot sparse unpack` when unpacking a sparse file with holes larger than 2^32 ([Issue #472], [PR #476])
@@ -558,3 +564,6 @@ Behind-the-scenes changes:
 [PR #474]: https://github.com/chenxiaolong/avbroot/pull/474
 [PR #475]: https://github.com/chenxiaolong/avbroot/pull/475
 [PR #476]: https://github.com/chenxiaolong/avbroot/pull/476
+[PR #477]: https://github.com/chenxiaolong/avbroot/pull/477
+[PR #478]: https://github.com/chenxiaolong/avbroot/pull/478
+[PR #479]: https://github.com/chenxiaolong/avbroot/pull/479

Cargo.lock

@@ -113,7 +113,7 @@ checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
 
 [[package]]
 name = "avbroot"
-version = "3.18.1"
+version = "3.19.0"
 dependencies = [
  "anyhow",
  "assert_matches",
@@ -567,7 +567,7 @@ checksum = "ecb08c4819242b1ec89b3d0c6affa229005bef46ae4f7eed8b80768187c10087"
 
 [[package]]
 name = "e2e"
-version = "3.18.1"
+version = "3.19.0"
 dependencies = [
  "anyhow",
  "avbroot",
@@ -662,7 +662,7 @@ dependencies = [
 
 [[package]]
 name = "fuzz"
-version = "3.18.1"
+version = "3.19.0"
 dependencies = [
  "avbroot",
  "honggfuzz",
@@ -2226,7 +2226,7 @@ dependencies = [
 
 [[package]]
 name = "xtask"
-version = "3.18.1"
+version = "3.19.0"
 dependencies = [
  "anyhow",
  "clap",

Cargo.toml

@@ -4,7 +4,7 @@ members = ["avbroot", "e2e", "fuzz", "xtask"]
 resolver = "2"
 
 [workspace.package]
-version = "3.18.1"
+version = "3.19.0"
 license = "GPL-3.0-only"
 edition = "2024"
 repository = "https://github.com/chenxiaolong/avbroot"

avbroot/src/cli/avb.rs

@@ -331,7 +331,7 @@ fn sign_or_clear(info: &mut AvbInfo, orig_header: &Header, key_group: &KeyGroup)
         } else {
             SignAction::Clear
         }
-    } else if originally_signed && &info.header != orig_header {
+    } else if originally_signed && (&info.header != orig_header || info.header.verify().is_err()) {
         SignAction::Sign
     } else {
         // If the original image was signed, we can preserve the existing
@@ -463,6 +463,10 @@ pub fn verify_headers(
         info!("{name} has an unsigned vbmeta header");
     }
 
+    if header.flags != 0 {
+        warn!("{name} has insecure flags: {:#x}", header.flags);
+    }
+
     for descriptor in &header.descriptors {
         let Some(target_name) = descriptor.partition_name() else {
             continue;

avbroot/src/format/avb.rs

@@ -1758,16 +1758,20 @@ impl Header {
     /// and return the public key. If the header is not signed, then `None` is
     /// returned.
     pub fn verify(&self) -> Result<Option<RsaPublicKey>> {
-        // Reconstruct the public key.
-        let public_key = decode_public_key(&self.public_key)?;
-
         if self.public_key.len() != self.algorithm_type.public_key_len() {
             return Err(Error::IncorrectKeySize(
-                public_key.size(),
+                self.public_key.len(),
                 self.algorithm_type,
             ));
         }
 
+        if self.algorithm_type == AlgorithmType::None {
+            return Ok(None);
+        }
+
+        // Reconstruct the public key.
+        let public_key = decode_public_key(&self.public_key)?;
+
         let mut without_auth_writer = Cursor::new(Vec::new());
         self.to_writer_internal(&mut without_auth_writer, true)?;
         let without_auth = without_auth_writer.into_inner();