Version 3.29.1

Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
CHANGELOG.md: Add entry for PR #594
2026-07-03 14:05:11 +02:00 · 2026-04-23 11:36:35 -04:00 · 2026-04-23 11:26:51 -04:00 · 2026-04-23 11:24:57 -04:00 · 2026-03-28 01:15:32 -04:00 · 2026-03-28 01:14:41 -04:00
112 changed files with 5164 additions and 2083 deletions
@@ -18,6 +18,8 @@ jobs:
      CARGO_TERM_COLOR: always
      # https://github.com/rust-lang/rust/issues/78210
      RUSTFLAGS: -C strip=symbols -C target-feature=+crt-static
+      # https://github.com/rust-lang/cargo/pull/15462
+      RUSTDOCFLAGS: -C target-feature=+crt-static
      TARGETS: ${{ join(matrix.artifact.targets, ' ') || matrix.artifact.name }}
      ANDROID_API: ${{ matrix.artifact.android_api }}
    strategy:
@@ -26,8 +28,12 @@ jobs:
        artifact:
          - os: ubuntu-latest
            name: x86_64-unknown-linux-gnu
+          - os: ubuntu-24.04-arm
+            name: aarch64-unknown-linux-gnu
          - os: windows-latest
            name: x86_64-pc-windows-msvc
+          - os: windows-11-arm
+            name: aarch64-pc-windows-msvc
          - os: macos-latest
            name: universal-apple-darwin
            targets:
@@ -41,7 +47,7 @@ jobs:
            android_api: '31'
    steps:
      - name: Check out repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          # For git describe
          fetch-depth: 0
@@ -83,7 +89,7 @@ jobs:
          done

      - name: Cache Rust dependencies
-        uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
        with:
          key: ${{ matrix.artifact.name }}

@@ -154,7 +160,7 @@ jobs:
        run: cp LICENSE README.md target/output/

      - name: Archive executable
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: avbroot-${{ steps.get_version.outputs.version }}-${{ matrix.artifact.name }}
          path: |
@@ -10,7 +10,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Run cargo-deny
-        uses: EmbarkStudios/cargo-deny-action@30f817c6f72275c6d54dc744fbca09ebc958599f # v2.0.12
+        uses: EmbarkStudios/cargo-deny-action@3fd3802e88374d3fe9159b834c7714ec57d6c979 # v2.0.15
@@ -24,10 +24,10 @@ jobs:
          echo "version=${version}" >> "${GITHUB_OUTPUT}"

      - name: Check out repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Create release
-        uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2
+        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
        with:
          tag_name: v${{ steps.get_version.outputs.version }}
          name: Version ${{ steps.get_version.outputs.version }}
@@ -7,6 +7,91 @@
    to update the actual links at the bottom of the file.
 -->

+### Version 3.29.1
+
+* Increase memory limit for payload manifest size to 16 MiB ([Issue #593], [PR #594])
+
+### Version 3.29.0
+
+* Add support for unpacking/packing payloads at the same time as the OTA in `avbroot zip {unpack,pack}` ([Discussion #582], [PR #586])
+* Add new `--skeleton` option to `avbroot payload unpack` ([Discussion #582], [PR #587])
+
+### Version 3.28.0
+
+* Add support for unpacking metadata from delta payloads in `avbroot payload unpack` ([Discussion #582], [PR #584])
+
+### Version 3.27.0
+
+* Add support for LZMA compression for ramdisks ([Issue #578], [PR #580])
+* Update dependencies ([PR #579])
+
+### Version 3.26.1
+
+* Add support for Magisk 30700 ([PR #573])
+
+### Version 3.26.0
+
+* Add new `--re-sign` option to `avbroot ota patch` for re-signing partitions that would otherwise be unmodified ([Issue #569], [PR #570])
+* Warn when a partition is signed with an AOSP test key in `avbroot ota verify` ([Issue #569], [PR #571])
+
+### Version 3.25.0
+
+* Remove outdated mentions of guarantees provided by cap-std in `--help` text, which was removed in version 3.20.0 ([PR #561])
+* Add new commands for packing and unpacking raw OTA zips ([PR #562])
+  * For folks who are familiar with how OTAs are built, this means it's now possible create an OTA from scratch without using `avbroot ota patch`.
+* Fix `-o` being used as the short option for both `--output` and `--output-properties` in `avbroot payload pack` and `avbroot payload repack` ([PR #563])
+  * The short option for `--output-properties` is now uppercase `-O`.
+* Add missing file flush operations and remove them where they are no-ops ([PR #564])
+* Update dependencies ([PR #565])
+
+### Version 3.24.1
+
+* Update `avbroot avb verify-device --help` to mention that `ro.boot.vbmeta.public_key_digest` is used when `-p` is not specified ([Issue #554], [PR #555])
+* Update dependencies ([PR #559])
+
+### Version 3.24.0
+
+* Always sort ramdisk cpio entries and ensure they have inode numbers assigned ([PR #540])
+* Relax LP image parser's validation to allow parsing the `/metadata/gsi/dsu/dsu/lp_metadata` image used by DSU ([PR #541], [PR #545])
+* Add support for devices with separate recovery partitions when using `--dsu` ([Issue #536], [PR #543])
+* Fix broken symlinks in fuzzing corpus ([Issue #532], [PR #544], [PR #548])
+* Ignore unused vbmeta partitions that are filled with zeros ([Issue #537], [PR #539])
+* Update dependencies ([PR #547], [PR #549])
+* Fix `cargo deny` failing after running fuzzers with `cargo hfuzz` ([PR #550])
+
+### Version 3.23.3
+
+* Add support for Magisk 30600 ([PR #529])
+* Update dependencies ([PR #530])
+
+### Version 3.23.2
+
+* Add prebuilt binaries for aarch64 GNU/Linux ([PR #523])
+* Add prebuilt binaries for aarch64 Windows ([PR #524])
+
+### Version 3.23.1
+
+* Add support for Magisk 30400 ([PR #521])
+
+### Version 3.23.0
+
+* Update dependencies and fix Rust 1.90 clippy lints ([PR #517], [PR #520])
+* Add support for Magisk 30300 ([PR #519])
+
+### Version 3.22.0
+
+* Fix CoW size estimates not being set when running `avbroot payload pack` ([PR #509])
+* Add support for only unpacking metadata in `avbroot {avb,boot,cpio,lp,payload} unpack` ([PR #510])
+* Specify minimum supported compiler version for building from source ([PR #511])
+* Update dependencies ([PR #512])
+
+### Version 3.21.0
+
+* Switch to using rawzip for zip parsing and writing ([PR #489])
+* Various code improvements ([PR #492], [PR #495], [PR #496], [PR #497], [PR #499], [PR #500], [PR #501], [PR #502], [PR #503], [PR #505])
+* Update dependencies ([PR #498])
+* Fix patching older OTAs with payloads using CoW v2 without the compression factor field ([Issue #493], [PR #504])
+
 ### Version 3.20.0

 * Switch to using lzma-rust2 for XZ compression and decompression ([PR #483])
@@ -369,6 +454,7 @@ Behind-the-scenes changes:
 [Discussion #294]: https://github.com/chenxiaolong/avbroot/discussions/294
 [Discussion #417]: https://github.com/chenxiaolong/avbroot/discussions/417
 [Discussion #426]: https://github.com/chenxiaolong/avbroot/discussions/426
+[Discussion #582]: https://github.com/chenxiaolong/avbroot/discussions/582
 [Issue #138]: https://github.com/chenxiaolong/avbroot/issues/138
 [Issue #144]: https://github.com/chenxiaolong/avbroot/issues/144
 [Issue #145]: https://github.com/chenxiaolong/avbroot/issues/145
@@ -401,6 +487,14 @@ Behind-the-scenes changes:
 [Issue #469]: https://github.com/chenxiaolong/avbroot/issues/469
 [Issue #472]: https://github.com/chenxiaolong/avbroot/issues/472
 [Issue #482]: https://github.com/chenxiaolong/avbroot/issues/482
+[Issue #493]: https://github.com/chenxiaolong/avbroot/issues/493
+[Issue #532]: https://github.com/chenxiaolong/avbroot/issues/532
+[Issue #536]: https://github.com/chenxiaolong/avbroot/issues/536
+[Issue #537]: https://github.com/chenxiaolong/avbroot/issues/537
+[Issue #554]: https://github.com/chenxiaolong/avbroot/issues/554
+[Issue #569]: https://github.com/chenxiaolong/avbroot/issues/569
+[Issue #578]: https://github.com/chenxiaolong/avbroot/issues/578
+[Issue #593]: https://github.com/chenxiaolong/avbroot/issues/593
 [PR #130]: https://github.com/chenxiaolong/avbroot/pull/130
 [PR #132]: https://github.com/chenxiaolong/avbroot/pull/132
 [PR #133]: https://github.com/chenxiaolong/avbroot/pull/133
@@ -581,3 +675,54 @@ Behind-the-scenes changes:
 [PR #485]: https://github.com/chenxiaolong/avbroot/pull/485
 [PR #486]: https://github.com/chenxiaolong/avbroot/pull/486
 [PR #487]: https://github.com/chenxiaolong/avbroot/pull/487
+[PR #489]: https://github.com/chenxiaolong/avbroot/pull/489
+[PR #492]: https://github.com/chenxiaolong/avbroot/pull/492
+[PR #495]: https://github.com/chenxiaolong/avbroot/pull/495
+[PR #496]: https://github.com/chenxiaolong/avbroot/pull/496
+[PR #497]: https://github.com/chenxiaolong/avbroot/pull/497
+[PR #498]: https://github.com/chenxiaolong/avbroot/pull/498
+[PR #499]: https://github.com/chenxiaolong/avbroot/pull/499
+[PR #500]: https://github.com/chenxiaolong/avbroot/pull/500
+[PR #501]: https://github.com/chenxiaolong/avbroot/pull/501
+[PR #502]: https://github.com/chenxiaolong/avbroot/pull/502
+[PR #503]: https://github.com/chenxiaolong/avbroot/pull/503
+[PR #504]: https://github.com/chenxiaolong/avbroot/pull/504
+[PR #505]: https://github.com/chenxiaolong/avbroot/pull/505
+[PR #509]: https://github.com/chenxiaolong/avbroot/pull/509
+[PR #510]: https://github.com/chenxiaolong/avbroot/pull/510
+[PR #511]: https://github.com/chenxiaolong/avbroot/pull/511
+[PR #512]: https://github.com/chenxiaolong/avbroot/pull/512
+[PR #517]: https://github.com/chenxiaolong/avbroot/pull/517
+[PR #519]: https://github.com/chenxiaolong/avbroot/pull/519
+[PR #520]: https://github.com/chenxiaolong/avbroot/pull/520
+[PR #521]: https://github.com/chenxiaolong/avbroot/pull/521
+[PR #523]: https://github.com/chenxiaolong/avbroot/pull/523
+[PR #524]: https://github.com/chenxiaolong/avbroot/pull/524
+[PR #529]: https://github.com/chenxiaolong/avbroot/pull/529
+[PR #530]: https://github.com/chenxiaolong/avbroot/pull/530
+[PR #539]: https://github.com/chenxiaolong/avbroot/pull/539
+[PR #540]: https://github.com/chenxiaolong/avbroot/pull/540
+[PR #541]: https://github.com/chenxiaolong/avbroot/pull/541
+[PR #543]: https://github.com/chenxiaolong/avbroot/pull/543
+[PR #544]: https://github.com/chenxiaolong/avbroot/pull/544
+[PR #545]: https://github.com/chenxiaolong/avbroot/pull/545
+[PR #547]: https://github.com/chenxiaolong/avbroot/pull/547
+[PR #548]: https://github.com/chenxiaolong/avbroot/pull/548
+[PR #549]: https://github.com/chenxiaolong/avbroot/pull/549
+[PR #550]: https://github.com/chenxiaolong/avbroot/pull/550
+[PR #555]: https://github.com/chenxiaolong/avbroot/pull/555
+[PR #559]: https://github.com/chenxiaolong/avbroot/pull/559
+[PR #561]: https://github.com/chenxiaolong/avbroot/pull/561
+[PR #562]: https://github.com/chenxiaolong/avbroot/pull/562
+[PR #563]: https://github.com/chenxiaolong/avbroot/pull/563
+[PR #564]: https://github.com/chenxiaolong/avbroot/pull/564
+[PR #565]: https://github.com/chenxiaolong/avbroot/pull/565
+[PR #570]: https://github.com/chenxiaolong/avbroot/pull/570
+[PR #571]: https://github.com/chenxiaolong/avbroot/pull/571
+[PR #573]: https://github.com/chenxiaolong/avbroot/pull/573
+[PR #579]: https://github.com/chenxiaolong/avbroot/pull/579
+[PR #580]: https://github.com/chenxiaolong/avbroot/pull/580
+[PR #584]: https://github.com/chenxiaolong/avbroot/pull/584
+[PR #586]: https://github.com/chenxiaolong/avbroot/pull/586
+[PR #587]: https://github.com/chenxiaolong/avbroot/pull/587
+[PR #594]: https://github.com/chenxiaolong/avbroot/pull/594
@@ -4,10 +4,12 @@ members = ["avbroot", "e2e", "fuzz", "xtask"]
 resolver = "2"

 [workspace.package]
-version = "3.20.0"
+version = "3.29.1"
 license = "GPL-3.0-only"
 edition = "2024"
 repository = "https://github.com/chenxiaolong/avbroot"
+publish = false
+rust-version = "1.88.0"

 [workspace.lints.clippy]
 cast_lossless = "deny"
@@ -19,7 +19,7 @@ The vbmeta descriptor digests are validated during unpacking. For dm-verity imag
 ### Packing an AVB image

 ```bash
-avbroot avb pack -o <output AVB image> [--key <AVB private key>]
+avbroot avb pack -o <output AVB image> [-k <AVB private key>]
 ```

 This subcommand packs a new AVB image from the `avb.toml` file and, for appended vbmeta images, the `raw.img` file.
@@ -52,6 +52,8 @@ avbroot avb info -i <image>

 This subcommand shows all of the vbmeta header and footer fields. `vbmeta` partition images will only have a header, while partitions with actual data (eg. boot images) will have both a header and a footer.

+(The `unpack`, `pack`, and `repack` subcommands also show this information. This specific subcommand just does so without performing any other operation.)
+
 ### Verifying AVB hashes and signatures

 ```bash
@@ -117,7 +119,9 @@ This subcommand repacks a boot image without writing the individual components t
 avbroot boot info -i <input boot image>
 ```

-All of the `boot` subcommands show the boot image information. This specific subcommand just does it without performing any other operation. To show avbroot's internal representation of the information, pass in `-d`.
+This subcommand shows the information contained in the boot image's header. To show avbroot's internal representation of the information, pass in `-d`.
+
+(All of the `boot` subcommands show this information. This specific subcommand just does so without performing any other operation.)

 ## `avbroot cpio`

@@ -159,7 +163,9 @@ This is almost equivalent to running `avbroot cpio unpack` followed by `avbroot
 avbroot cpio info -i <input cpio archive>
 ```

-All of the `cpio` subcommands show details about all the entries in the archive. This specific subcommand just does it without performing any other operation.
+This subcommand shows details about every entry in the archive.
+
+(All of the `cpio` subcommands show this information. This specific subcommand just does so without performing any other operation.)

 ## `avbroot fec`

@@ -320,6 +326,8 @@ avbroot lp info -i <first LP image>

 This subcommand shows the LP image metadata, including all metadata slots. If there are multiple images, only the first one is needed because it is the only one that stores the metadata.

+(All of the `lp` subcommands show this information. This specific subcommand just does so without performing any other operation.)
+
 ## `avbroot payload`

 This set of commands is for working with payload binary files (`payload.bin`). The `unpack` and `pack` commands can only work with full payloads because they require the complete data to be available, but the `repack` and `info` commands also work with delta payloads.
@@ -332,22 +340,24 @@ avbroot payload unpack -i <input payload>

 This subcommand unpacks the payload header information to `payload.toml` and the partition images to the `payload_images` directory.

-Only full payload binaries can be unpacked. Delta payload binaries from incremental OTAs are not supported.
+Data can only be unpacked from full payload binaries. For delta payloads, either use `--no-output-images` to skip image extraction or use `--skeleton` to create properly sized sparse files with no data.

 ### Packing a payload binary

 ```bash
-avbroot payload pack -o <output payload> --key <OTA private key>
+avbroot payload pack -o <output payload> -k <OTA private key> [-O <output properties>]
 ```

 This subcommand packs a new payload binary from the `payload.toml` file and `payload_images` directory. Any `.img` files in the `payload_images` directory that don't have a corresponding entry in `payload.toml` are silently ignored.

+When replacing the payload binary in an OTA, it is not sufficient to only update `payload.bin`. The checksums in `payload_properties.txt` need to be updated as well. Use `--output-properties` to generate a new properties file.
+
 Packing a payload binary requires compressing all of the partition images, which is very CPU intensive. If re-signing an existing payload binary without making any other modifications is all that's needed, use the `repack` subcommand instead.

 ### Repacking a payload binary

 ```bash
-avbroot payload repack -i <input payload> -o <output payload> --key <OTA private key>
+avbroot payload repack -i <input payload> -o <output payload> -k <OTA private key> [-O <output properties>]
 ```

 This subcommand is logically equivalent to `avbroot payload unpack` followed by `avbroot payload pack`, except significantly more efficient. Instead of decompressing and recompressing all partition images, the raw data is directly copied from the input payload binary.
@@ -362,6 +372,8 @@ avbroot payload info -i <payload>

 This subcommand shows all of the payload header fields (which will likely be extremely long).

+(All of the `payload` subcommands show this information. This specific subcommand just does so without performing any other operation.)
+
 ## `avbroot sparse`

 This set of commands is for working with Android sparse images. All features of the file format are supported, including hole chunks and CRC32 checksums.
@@ -405,3 +417,53 @@ avbroot sparse info -i <input sparse image>
 ```

 This subcommand shows the sparse image metadata, including the header and all chunks.
+
+(All of the `sparse` subcommands show this information. This specific subcommand just does so without performing any other operation.)
+
+## `avbroot zip`
+
+This set of commands is for working with raw OTA zip files. They are intentionally placed outside of `avbroot ota` to make them less discoverable by accident. These commands are useful for creating OTA zip files without going through the normal `avbroot ota patch` mechanism.
+
+**WARNING**: Make sure to run `avbroot ota verify` on OTA files before installing them. These pack commands are low level operations that only check that the file structure of the OTA itself is valid, not the contents contained within.
+
+### Unpacking an OTA zip
+
+```bash
+avbroot zip unpack -i <input OTA> [--payload]
+```
+
+This subcommand unpacks the OTA metadata to `ota.toml` and the OTA files to the `ota_files` directory.
+
+When `--payload` is specified, the payload and OTA zip will be unpacked at the same time, which is significantly more efficient that unpack the payload and OTA zip separately. The payload unpacking process writes to the same `payload.toml` and `payload_images` outputs as `avbroot payload unpack`.
+
+### Packing an OTA zip
+
+```bash
+avbroot zip pack -o <output OTA> -k <OTA private key> [--payload]
+```
+
+This subcommand packs a new OTA zip from the `ota.toml` file and `ota_files` directory. Any files in the `ota_files` directory that don't have a corresponding entry in `ota.toml` are silently ignored.
+
+When `--payload` is specified, the payload and OTA zip will be packed at the same time, which is significantly more efficient than packing the payload and OTA zip separately. The payload packing process reads the same `payload.toml` and `payload_images` inputs as `avbroot payload pack`.
+
+When packing an OTA zip, the `metadata.property_files` field in `ota.toml` may potentially be recomputed. To write a TOML file containing the new values, use `--output-info <output TOML>`. It is safe to overwrite the existing `ota.toml` if desired.
+
+### Repacking an OTA zip
+
+```bash
+avbroot zip repack -i <input OTA> -o <output OTA> -k <OTA private key>
+```
+
+This subcommand is logically equivalent to `avbroot zip unpack` followed by `avbroot zip pack`, except more efficient.
+
+**WARNING**: This is generally not a useful command. Resigning the OTA zip without also resigning the payload binary inside results in an invalid OTA.
+
+### Showing OTA metadata
+
+```bash
+avbroot zip info -i <input OTA>
+```
+
+This subcommand shows all of the OTA metadata fields. If both the modern protobuf metadata and the legacy plain text metadata exist, the protobuf metadata takes precedence.
+
+(All of the `zip` subcommands show this information. This specific subcommand just does so without performing any other operation.)
@@ -51,7 +51,7 @@ avbroot applies the following patches to the partition images:

 3. Follow the steps to [generate signing keys](#generating-keys).

-    Skip this step if you're updating Android, Magisk, or KernelSU after you've performed an [initial setup](#initial-setup). [Updates](#updates) do not require signing keys since you have already generated them in the initial setup.
+    Skip this step if you're updating Android, Magisk, or KernelSU after you've already performed an [initial setup](#initial-setup). There's no need to generate new signing keys for [updates](#updates): any further updates must use the keys that were created during the initial setup.

 4. Patch the OTA zip. The base command is:

@@ -237,13 +237,13 @@ Updates to Android, Magisk, and KernelSU are all done the same way: by patching

 2. If Magisk or KernelSU is being updated, first install their new `.apk`. If you happen to open the app, make sure it **does not** flash the boot image. Cancel the boot image update prompts if needed.

-3. Reboot to recovery mode. If the screen is stuck at a `No command` message, press the volume up button once while holding down the power button.
+3. Reboot to recovery mode: `adb reboot recovery`. If the screen is stuck at a `No command` message, press the volume up button once while holding down the power button.

 4. Sideload the patched OTA with `adb sideload`.

-5. Restart your phone. Note: the phone will likely take a long time to startup after an OS update (a few minutes in some cases).
+5. Restart your device. Note that the device will likely take longer than usual to start on the first boot after an OS update (a few minutes in some cases).

-**Warning**: Due to how virtual A/B works, there is a snapshot merge operation that Android runs invisibly in the background after installing an OTA and rebooting. During the snapshot merge process, it's not possible to sideload another OTA from recovery mode. Avoid doing anything that could result in a boot loop (eg. installing modules) until this process is complete because there is no way to recover, aside from unlocking the bootloader (and wiping) again.
+**WARNING**: Due to how virtual A/B works, there is a snapshot merge operation that Android runs invisibly in the background after installing an OTA and rebooting. During the snapshot merge process, it's not possible to sideload another OTA from recovery mode. Avoid doing anything that could result in a boot loop (eg. installing modules) until this process is complete because there is no way to recover, aside from unlocking the bootloader (and wiping) again.

 The status can be found by running `adb logcat -v color -s update_engine`. Alternatively, if [Custota](https://github.com/chenxiaolong/Custota) is installed (even if it's not configured to point to a custom OTA server), it will show a notification until the snapshot merge operation completes.

@@ -421,6 +421,10 @@ The only behavior this changes is where the partition is read from. When using `

 This has no impact on what patches are applied. For example, when using Magisk, the root patch is applied to the boot partition, no matter if the partition came from the original `payload.bin` or from `--replace`.

+### Re-signing partitions
+
+avbroot will automatically re-sign any partitions in the OTA that it modifies. However, partitions that are otherwise unmodified can also be re-signed with `--re-sign <partition name>`. This is useful, for example, when the OTA contains partitions signed with the public AOSP test key.
+
 ### Booting signed GSIs

 Android's [Dynamic System Updates (DSU)](https://developer.android.com/topic/dsu) feature uses a different root of trust than the regular system. Instead of using the bootloader's `avb_custom_key`, it obtains the trusted keys from the `first_stage_ramdisk/avb/*.avbpubkey` files inside the `init_boot` or `vendor_boot` ramdisk. These files are encoded in the same binary format as `avb_pkmd.bin`.
@@ -6,7 +6,7 @@ avbroot – это утилита для воспроизводимой моди

 ## Требования

-* Поддерживаются только устройства, использующие современную A/B-разметку. Это большинство девайсов, выпускаемых с Android 10 и новее (за исключением устройств от Samsung). Чтобы проверить, использует ли ваш телефон необходимую схему разметки, откройте zip-архив OTA и проверьте:
+* Поддерживаются только устройства, использующие современную A/B-разметку. Это большинство девайсов, выпускаемых с Android 10 и новее (за исключением устройств от Samsung). Чтобы проверить, использует ли ваше устройство необходимую схему разметки, откройте zip-архив OTA и проверьте:

  * наличие файла `payload.bin` (обычно находится в корне архива)
  * наличие файла `META-INF/com/android/metadata` (Android 10-11) или `META-INF/com/android/metadata.pb` (Android 12+)
@@ -49,6 +49,8 @@ avbroot модифицирует следующие образы:

 3. [Сгенерируйте ключи подписи.](#генерация-ключей)

+Пропустите этот шаг, если вы обновляете Android, Magisk или KernelSU уже после выполнения [первоначальной настройки](#первоначальная-настройка). Повторная генерация ключей подписи для [обновлений](#обновления) не требуется: для всех последующих обновлений должны использоваться те ключи, что были созданы при первоначальной настройке.
+
 4. Пропатчите ОТА-архив с помощью команды:

    ```bash
@@ -105,7 +107,7 @@ avbroot модифицирует следующие образы:

 Первые два компонента подписываются ключом AVB, а последние два – ключом OTA. Можно использовать один и тот же ключ, однако в следующих шагах описано, как сгенерировать два отдельных.

-Если вы патчите OTA сразу для нескольких устройств, настоятельно рекомендуется генерировать уникальные ключи для каждого девайса – так вы защитите себя от случайной прошивки неподходящего OTA для другого телефона.
+Если вы патчите OTA сразу для нескольких устройств, настоятельно рекомендуется генерировать уникальные ключи для каждого девайса – так вы защитите себя от случайной прошивки неподходящего OTA.

 1. Сгенерируйте ключи подписи для AVB и OTA.

@@ -209,6 +211,8 @@ avbroot совместим с любым стандартным 4096-битны
    init: [libfs_avb]Returning avb_handle with status: Success
    ```

+    Как ещё один вариант, Android-версию avbroot также можно использовать для [проверки разделов на устройстве](./README.extra.md#verifying-avb-hashes-and-signatures-on-device).
+
 9. Перезагрузитесь в fastboot и заблокируйте загрузчик. Это снова приведет к стиранию данных.

    ```bash
@@ -227,15 +231,19 @@ avbroot совместим с любым стандартным 4096-битны

 Обновления Android, Magisk и KernelSU выполняются одинаково – исключительно путем обновления или репатчинга того же самого OTA.

-1. Если Magisk или KernelSU обновились, сначала установите их новый `.apk`. Если вы случайно открыли приложение после обновления, убедитесь, что оно не начало прошивать загрузочный образ. Если появится предложение обновить сам загрузочный образ – отклоните его.
+1. Сгенерируйте новый пропатченный OTA согласно инструкции в разделе [использования.](#использование)

-2. Следуйте инструкции в разделе [использования,](#использование) чтобы пропатчить OTA уже с новым .apk Magisk'а/предварительно пропатченным образом с Magisk или KernelSU.
+2. Если обновляется Magisk или KernelSU, сначала установите их новый `.apk`. Если вы случайно открыли приложение, убедитесь, что оно **не начало** прошивать загрузочный образ. Если в самом приложении появится предложение обновить загрузочный образ, отклоните его.

-3. Перезагрузитесь в режим Recovery. Если устройство повисло на сплеше с сообщением "No command", удерживайте кнопку питания, а затем нажмите кнопку увеличения громкости один раз.
+3. Перезагрузитесь в режим Recovery: `adb reboot recovery`. Если устройство повисло на сплеше с сообщением "No command", удерживайте кнопку питания, а затем один раз нажмите кнопку увеличения громкости.

 4. Обновитесь (Apply update from adb → `adb sideload <ota.zip.patched>`).

-5. Готово!
+5. Перезагрузите устройство. Обратите внимание, что при первом запуске после обновления ОС устройство может загружаться дольше обычного (иногда до нескольких минут).
+
+**ПРЕДУПРЕЖДЕНИЕ**: В силу специфики работы виртуального A/B в Android, сразу после установки OTA и перезагрузки, в фоновом режиме незаметно запускается операция слияния снапшотов. Во время этого процесса невозможно установить другой OTA через режим Recovery. Пока продолжается слияние снапшотов, избегайте любых действий, которые могут привести к бутлупу (например, установка модулей), поскольку в случае сбоя восстановить устройство получится только повторно разблокировав загрузчик, стирая все данные.
+
+Узнать текущий статус процесса можно, выполнив команду: `adb logcat -v color -s update_engine`. Дополнительно, если установлено [Custota](https://github.com/chenxiaolong/Custota) (даже если оно не настроено на использование пользовательского OTA-сервера), приложение будет отображать соответствующее уведомление до завершения операции слияния снапшота.

 ## Возврат на заводскую прошивку

@@ -315,7 +323,7 @@ Magisk версии 25211 и новее требует наличие разде

    Теперь, когда имя раздела известно, его нужно указать avbroot с помощью команды `--magisk-preinit-device <имя>`. Имя раздела стоит запомнить или сохранить где-нибудь на будущее, оно вряд ли изменится при обновлении Magisk.

-Если запустить приложение Magisk на целевом устройстве невозможно (например, телефон не загружается), пропатчите OTA с аргументом `--ignore-magisk-warnings` и прошейте его. Затем выполните указанные выше шаги и повторно пропатчите OTA, но уже с указанием аргумента `--magisk-preinit-device <имя>`.
+Если запустить приложение Magisk на целевом устройстве невозможно (например, оно не загружается), пропатчите OTA с аргументом `--ignore-magisk-warnings` и прошейте его. Затем выполните указанные выше шаги и повторно пропатчите OTA, но уже с указанием аргумента `--magisk-preinit-device <имя>`.

 ## Проверка OTA

@@ -4,7 +4,8 @@ version.workspace = true
 license.workspace = true
 edition.workspace = true
 repository.workspace = true
-publish = false
+publish.workspace = true
+rust-version.workspace = true

 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

@@ -26,17 +27,19 @@ dlv-list = "0.6.0"
 flate2 = { version = "1.0.29", features = ["zlib-rs"] }
 gf256 = { version = "0.3.0", features = ["rs"] }
 hex = { version = "0.4.3", features = ["serde"] }
-lz4_flex = "0.11.1"
-lzma-rust2 = "0.8.0"
+lz4_flex = "0.13.0"
+lzma-rust2 = "0.16.1"
 memchr = "2.6.0"
+# We can't upgrade to 0.9.0 until rsa updates its dependency.
 num-bigint-dig = "0.8.4"
 num-traits = "0.2.16"
 passterm = "2.0.3"
-phf = { version = "0.12.1", features = ["macros"] }
+phf = { version = "0.13.1", features = ["macros"] }
 pkcs8 = { version = "0.10.2", features = ["encryption", "pem"] }
 prost = "0.14.1"
 # We can't upgrade to 0.9.0 until rsa updates its rand_core dependency.
 rand = "0.8.5"
+rawzip = "0.4.0"
 rayon = "1.7.0"
 regex = { version = "1.9.4", default-features = false, features = ["perf", "std"] }
 # We use ring instead of sha2 for sha256 digest computation of large files
@@ -50,7 +53,7 @@ sha1 = "0.10.5"
 sha2 = "0.10.7"
 tempfile = "3.8.0"
 thiserror = "2.0.3"
-toml_edit = { version = "0.23.3", features = ["serde"] }
+toml = { version = "1.0.1", features = ["serde"] }
 topological-sort = "0.2.2"
 tracing = "0.1.40"
 tracing-subscriber = "0.3.18"
@@ -58,15 +61,6 @@ x509-cert = { version = "0.2.4", features = ["builder"] }
 zerocopy = { version = "0.8.10", features = ["std"] }
 zerocopy-derive = "0.8.5"

-# https://github.com/zip-rs/zip2/pull/367
-# https://github.com/zip-rs/zip2/pull/368
-# For getting the data offset when writing new zip entries.
-[dependencies.zip]
-git = "https://github.com/chenxiaolong/zip2"
-rev = "59685f4dadbfee8cb3ea74c8fbb402b60d8137e8"
-default-features = false
-features = ["deflate"]
-
 [target.'cfg(unix)'.dependencies]
 libc = "0.2.158"
 rustix = { version = "1.0.3", default-features = false, features = ["process"] }
@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: 2023-2024 Andrew Gunnerson
+// SPDX-FileCopyrightText: 2023-2026 Andrew Gunnerson
 // SPDX-License-Identifier: GPL-3.0-only

 use std::{env, ffi::OsStr, fs, io, path::Path};
@@ -35,6 +35,10 @@ fn main() {
    const CUE_PU: &str = ".chromeos_update_engine.PartitionUpdate";
    const CUE_VABCFS: &str = ".chromeos_update_engine.VABCFeatureSet";

+    const BTR_DS: &str = ".build.tools.releasetools.DeviceState";
+    const BTR_OM: &str = ".build.tools.releasetools.OtaMetadata";
+    const BTR_PS: &str = ".build.tools.releasetools.PartitionState";
+
    const DERIVE_SERDE: &str = "#[derive(serde::Deserialize, serde::Serialize)]";
    const SERDE_DEFAULT: &str = "#[serde(default)]";
    const SERDE_SKIP: &str = "#[serde(skip)]";
@@ -45,19 +49,25 @@ fn main() {
    prost_build::Config::new()
        .btree_map(["."])
        // Allow deserializing and serializing the types we care about.
-        .type_attribute(CUE_AI, DERIVE_SERDE)
-        .type_attribute(CUE_DAM, DERIVE_SERDE)
-        .type_attribute(CUE_DPG, DERIVE_SERDE)
-        .type_attribute(CUE_DPM, DERIVE_SERDE)
-        .type_attribute(CUE_PU, DERIVE_SERDE)
-        .type_attribute(CUE_VABCFS, DERIVE_SERDE)
+        .message_attribute(CUE_AI, DERIVE_SERDE)
+        .message_attribute(CUE_DAM, DERIVE_SERDE)
+        .message_attribute(CUE_DPG, DERIVE_SERDE)
+        .message_attribute(CUE_DPM, DERIVE_SERDE)
+        .message_attribute(CUE_PU, DERIVE_SERDE)
+        .message_attribute(CUE_VABCFS, DERIVE_SERDE)
+        .message_attribute(BTR_DS, DERIVE_SERDE)
+        .message_attribute(BTR_OM, DERIVE_SERDE)
+        .message_attribute(BTR_PS, DERIVE_SERDE)
        // Allow default-initializing all fields.
-        .type_attribute(CUE_AI, SERDE_DEFAULT)
-        .type_attribute(CUE_DAM, SERDE_DEFAULT)
-        .type_attribute(CUE_DPG, SERDE_DEFAULT)
-        .type_attribute(CUE_DPM, SERDE_DEFAULT)
-        .type_attribute(CUE_PU, SERDE_DEFAULT)
-        .type_attribute(CUE_VABCFS, SERDE_DEFAULT)
+        .message_attribute(CUE_AI, SERDE_DEFAULT)
+        .message_attribute(CUE_DAM, SERDE_DEFAULT)
+        .message_attribute(CUE_DPG, SERDE_DEFAULT)
+        .message_attribute(CUE_DPM, SERDE_DEFAULT)
+        .message_attribute(CUE_PU, SERDE_DEFAULT)
+        .message_attribute(CUE_VABCFS, SERDE_DEFAULT)
+        .message_attribute(BTR_DS, SERDE_DEFAULT)
+        .message_attribute(BTR_OM, SERDE_DEFAULT)
+        .message_attribute(BTR_PS, SERDE_DEFAULT)
        // Don't serialize fields that define the structure of the payload
        // binary and that we recompute during packing.
        .field_attribute(c!(CUE_DAM, ".signatures_offset"), SERDE_SKIP)
@@ -84,6 +94,11 @@ fn main() {
        .field_attribute(c!(CUE_DAM, ".partitions"), SERDE_SKIP_IF_VEC_EMPTY)
        .field_attribute(c!(CUE_DPG, ".partition_names"), SERDE_SKIP_IF_VEC_EMPTY)
        .field_attribute(c!(CUE_DPM, ".groups"), SERDE_SKIP_IF_VEC_EMPTY)
+        // Serialize enums as their enum types, not their underlying reprs.
+        .field_attribute(
+            c!(BTR_OM, ".type"),
+            "#[serde(with = \"crate::protobuf::ota_type\")]",
+        )
        .compile_fds(file_descriptors)
        .unwrap();
 }
@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: 2023-2024 Andrew Gunnerson
+// SPDX-FileCopyrightText: 2023-2026 Andrew Gunnerson
 // SPDX-License-Identifier: GPL-3.0-only

 use std::{
@@ -13,7 +13,7 @@ use clap::{Parser, Subcommand, ValueEnum};
 use tracing::{Level, debug};
 use tracing_subscriber::fmt::{format::Writer, time::FormatTime};

-use crate::cli::{avb, boot, completion, cpio, fec, hashtree, key, lp, ota, payload, sparse};
+use crate::cli::{avb, boot, completion, cpio, fec, hashtree, key, lp, ota, payload, sparse, zip};

 #[allow(clippy::large_enum_variant)]
 #[derive(Debug, Subcommand)]
@@ -29,6 +29,7 @@ pub enum Command {
    Ota(ota::OtaCli),
    Payload(payload::PayloadCli),
    Sparse(sparse::SparseCli),
+    Zip(zip::ZipCli),
    /// (Deprecated: Use `avbroot ota patch` instead.)
    #[command(hide = true)]
    Patch(ota::PatchCli),
@@ -40,19 +41,14 @@ pub enum Command {
    MagiskInfo(boot::MagiskInfoCli),
 }

-#[derive(Debug, Clone, Copy, ValueEnum)]
+#[derive(Clone, Copy, Debug, Default, ValueEnum)]
 pub enum LogFormat {
+    #[default]
    Short,
    Medium,
    Long,
 }

-impl Default for LogFormat {
-    fn default() -> Self {
-        Self::Short
-    }
-}
-
 impl fmt::Display for LogFormat {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        f.write_str(self.to_possible_value().ok_or(fmt::Error)?.get_name())
@@ -137,6 +133,7 @@ pub fn main(logging_initialized: &AtomicBool, cancel_signal: &AtomicBool) -> Res
        Command::Ota(c) => ota::ota_main(&c, cancel_signal),
        Command::Payload(c) => payload::payload_main(&c, cancel_signal),
        Command::Sparse(c) => sparse::sparse_main(&c, cancel_signal),
+        Command::Zip(c) => zip::zip_main(&c, cancel_signal),
        // Deprecated aliases.
        Command::Patch(c) => ota::patch_subcommand(&c, cancel_signal),
        Command::Extract(c) => ota::extract_subcommand(&c, cancel_signal),
@@ -25,10 +25,57 @@ use crate::{
        self, AlgorithmType, AppendedDescriptorMut, AppendedDescriptorRef, Descriptor, Footer,
        HashTreeDescriptor, Header, KernelCmdlineDescriptor,
    },
-    stream::{self, PSeekFile, ReadFixedSizeExt, Reopen, ToWriter, check_cancel},
+    stream::{self, ReadFixedSizeExt, ToWriter, UserPosFile, check_cancel},
    util,
 };

+/// SHA-256 digests of the AOSP test keys encoded in the AVB binary format. This
+/// excludes 8192-bit keys since RustCrypto doesn't support them anyway.
+const PUBLIC_PUBKEYS: [[u8; 32]; 7] = [
+    // testkey_cert_pik.pem
+    [
+        0xce, 0x46, 0x4c, 0x0f, 0xef, 0xc0, 0x23, 0x76, 0x0a, 0xdc, 0x3f, 0xe0, 0x20, 0x7c, 0x28,
+        0x2d, 0x33, 0x7e, 0x1b, 0x91, 0xe3, 0xdf, 0x7a, 0xb4, 0xfe, 0xe4, 0x3f, 0xcd, 0x62, 0x0d,
+        0xb4, 0x6d,
+    ],
+    // testkey_cert_prk.pem
+    [
+        0x86, 0xb0, 0x4a, 0x9d, 0x62, 0x80, 0x7f, 0xda, 0x80, 0xcb, 0xf4, 0x45, 0x11, 0x8e, 0x8a,
+        0x4a, 0x73, 0xaa, 0x59, 0x37, 0x28, 0x3b, 0x49, 0xe0, 0x18, 0xe4, 0x32, 0xdd, 0x8e, 0x3a,
+        0x76, 0xa1,
+    ],
+    // testkey_cert_psk.pem
+    [
+        0x7e, 0xc0, 0x2e, 0xe1, 0xbe, 0x69, 0x63, 0x66, 0xf3, 0xfa, 0x91, 0x24, 0x0a, 0x8e, 0xc6,
+        0x81, 0x25, 0xc4, 0x14, 0x5d, 0x69, 0x8f, 0x59, 0x7a, 0xa2, 0xb3, 0x46, 0x4b, 0x59, 0xca,
+        0x7f, 0xc3,
+    ],
+    // testkey_cert_puk.pem
+    [
+        0xc6, 0x08, 0xff, 0xa5, 0xe7, 0xee, 0x92, 0x98, 0x4f, 0x44, 0x86, 0xe0, 0x30, 0x88, 0x44,
+        0x0c, 0x36, 0x0c, 0xf3, 0x15, 0xec, 0x6a, 0x5f, 0x52, 0xae, 0xf7, 0x90, 0xcb, 0x30, 0xef,
+        0xce, 0xc9,
+    ],
+    // testkey_rsa2048.pem
+    [
+        0x22, 0xde, 0x39, 0x94, 0x53, 0x21, 0x96, 0xf6, 0x1c, 0x03, 0x9e, 0x90, 0x26, 0x0d, 0x78,
+        0xa9, 0x3a, 0x4c, 0x57, 0x36, 0x2c, 0x7e, 0x78, 0x9b, 0xe9, 0x28, 0x03, 0x6e, 0x80, 0xb7,
+        0x7c, 0x8c,
+    ],
+    // testkey_rsa2048_2.pem
+    [
+        0x2b, 0xed, 0x47, 0x45, 0x1b, 0xc6, 0x98, 0xe9, 0xe8, 0x2d, 0x92, 0xa6, 0x66, 0x8b, 0xd0,
+        0x3a, 0xb6, 0xcf, 0x8d, 0xd1, 0xa1, 0x44, 0x34, 0x1c, 0xb7, 0xf4, 0x26, 0xf2, 0x0b, 0x28,
+        0x79, 0xcf,
+    ],
+    // testkey_rsa4096.pem
+    [
+        0x77, 0x28, 0xe3, 0x0f, 0x50, 0xbf, 0xa5, 0xce, 0xa1, 0x65, 0xf4, 0x73, 0x17, 0x5a, 0x08,
+        0x80, 0x3f, 0x6a, 0x83, 0x46, 0x64, 0x2b, 0x5a, 0xa1, 0x09, 0x13, 0xe9, 0xd9, 0xe6, 0xde,
+        0xfe, 0xf6,
+    ],
+];
+
 #[derive(Clone, Debug, PartialEq, Eq, Deserialize, Serialize)]
 struct AvbInfo {
    header: Header,
@@ -37,9 +84,9 @@ struct AvbInfo {
 }

 fn read_avb_image(path: &Path) -> Result<(AvbInfo, BufReader<File>)> {
-    let file = File::open(path)
+    let mut reader = File::open(path)
+        .map(BufReader::new)
        .with_context(|| format!("Failed to open AVB image for reading: {path:?}"))?;
-    let mut reader = BufReader::new(file);
    let (header, footer, image_size) = avb::load_image(&mut reader)
        .with_context(|| format!("Failed to load AVB image: {path:?}"))?;

@@ -52,7 +99,7 @@ fn read_avb_image(path: &Path) -> Result<(AvbInfo, BufReader<File>)> {
    Ok((info, reader))
 }

-fn write_avb_image(file: PSeekFile, info: &mut AvbInfo, recompute_size: bool) -> Result<()> {
+fn write_avb_image(file: &File, info: &mut AvbInfo, recompute_size: bool) -> Result<()> {
    let mut writer = BufWriter::new(file);

    info.image_size = if let Some(f) = &mut info.footer {
@@ -78,7 +125,7 @@ fn write_avb_image(file: PSeekFile, info: &mut AvbInfo, recompute_size: bool) ->
 fn read_info(path: &Path) -> Result<AvbInfo> {
    let data = fs::read_to_string(path)
        .with_context(|| format!("Failed to read AVB info TOML: {path:?}"))?;
-    let info = toml_edit::de::from_str(&data)
+    let info = toml::de::from_str(&data)
        .with_context(|| format!("Failed to parse AVB info TOML: {path:?}"))?;

    Ok(info)
@@ -86,7 +133,7 @@ fn read_info(path: &Path) -> Result<AvbInfo> {

 /// Write AVB information to TOML file.
 fn write_info(path: &Path, info: &AvbInfo) -> Result<()> {
-    let data = toml_edit::ser::to_string_pretty(info)
+    let data = toml::ser::to_string_pretty(info)
        .with_context(|| format!("Failed to serialize AVB info TOML: {path:?}"))?;
    fs::write(path, data).with_context(|| format!("Failed to write AVB info TOML: {path:?}"))?;

@@ -100,16 +147,15 @@ fn write_raw(
    reader: &mut BufReader<File>,
    size: u64,
    cancel_signal: &AtomicBool,
-) -> Result<PSeekFile> {
-    let file = fs::OpenOptions::new()
+) -> Result<File> {
+    let mut writer = fs::OpenOptions::new()
        .read(true)
        .write(true)
        .create(true)
        .truncate(true)
        .open(path)
-        .map(PSeekFile::new)
+        .map(BufWriter::new)
        .with_context(|| format!("Failed to open raw image for writing: {path:?}"))?;
-    let mut writer = BufWriter::new(file);

    reader
        .rewind()
@@ -132,7 +178,7 @@ fn write_raw_and_verify(
    info: &AvbInfo,
    ignore_invalid: bool,
    cancel_signal: &AtomicBool,
-) -> Result<PSeekFile> {
+) -> Result<File> {
    let f = info.footer.as_ref().expect("Not an appended image");

    let descriptor = info.header.appended_descriptor()?;
@@ -146,7 +192,7 @@ fn write_raw_and_verify(

    let raw_file = write_raw(path, reader, copy_size, cancel_signal)?;

-    let result = verify_and_repair(None, raw_file.reopen()?, descriptor, true, cancel_signal);
+    let result = verify_and_repair(None, &raw_file, descriptor, true, cancel_signal);

    // Chop off the old hash tree and FEC data.
    raw_file.set_len(f.original_image_size)?;
@@ -169,7 +215,7 @@ fn write_raw_and_update(
    reader: &mut BufReader<File>,
    info: &mut AvbInfo,
    cancel_signal: &AtomicBool,
-) -> Result<PSeekFile> {
+) -> Result<File> {
    assert!(info.footer.is_some(), "Not an appended image");

    let image_size = reader
@@ -181,7 +227,7 @@ fn write_raw_and_update(
    match info.header.appended_descriptor_mut()? {
        AppendedDescriptorMut::HashTree(d) => {
            d.image_size = image_size;
-            d.update(&raw_file, &raw_file, None, cancel_signal)
+            d.update(&raw_file, None, cancel_signal)
                .context("Failed to update hash tree descriptor")?;
        }
        AppendedDescriptorMut::Hash(d) => {
@@ -501,6 +547,8 @@ pub fn verify_headers(

    if let Some(k) = &public_key {
        let prefix = format!("{name} has a signed vbmeta header");
+        let encoded = avb::encode_public_key(k)?;
+        let digest = Sha256::digest(&encoded);

        match trust_method {
            TrustMethod::Key(expected) => {
@@ -511,9 +559,6 @@ pub fn verify_headers(
                }
            }
            TrustMethod::KeyDigest(expected_sha256) => {
-                let encoded = avb::encode_public_key(k)?;
-                let digest = Sha256::digest(&encoded);
-
                if digest.as_slice() == expected_sha256 {
                    info!("{prefix}");
                } else {
@@ -524,6 +569,10 @@ pub fn verify_headers(
                warn!("{prefix}, but parent does not list a trusted key");
            }
        }
+
+        if PUBLIC_PUBKEYS.iter().any(|p| p == digest.as_slice()) {
+            warn!("{name} is signed with public AOSP test key");
+        }
    } else {
        info!("{name} has an unsigned vbmeta header");
    }
@@ -568,7 +617,7 @@ pub fn verify_headers(
 /// work.
 fn verify_and_repair(
    name: Option<&str>,
-    mut file: PSeekFile,
+    file: &File,
    descriptor: AppendedDescriptorRef,
    repair: bool,
    cancel_signal: &AtomicBool,
@@ -585,7 +634,7 @@ fn verify_and_repair(
                    warn!("Failed to verify hash tree descriptor{suffix}: {e}");
                    warn!("Attempting to repair using FEC data{suffix}");

-                    d.repair(&file, &file, cancel_signal)
+                    d.repair(&file, cancel_signal)
                        .with_context(|| format!("Failed to repair data{suffix}"))?;

                    d.verify(&file, cancel_signal).inspect(|()| {
@@ -599,8 +648,7 @@ fn verify_and_repair(
        AppendedDescriptorRef::Hash(d) => {
            info!("Verifying hash descriptor{suffix}");

-            file.rewind()?;
-            d.verify(file, cancel_signal)
+            d.verify(UserPosFile::new(file), cancel_signal)
                .with_context(|| format!("Failed to verify hash descriptor{suffix}"))?;
        }
    }
@@ -623,32 +671,28 @@ pub fn verify_descriptors(
    options.read(true);
    options.write(repair);

-    descriptors
-        .par_iter()
-        .map(|(name, descriptor)| {
-            let _span = parent_span.enter();
+    descriptors.par_iter().try_for_each(|(name, descriptor)| {
+        let _span = parent_span.enter();

-            let file = match opener.open(name, &options) {
-                Ok((_, f)) => PSeekFile::new(f),
-                // Some devices, like bluejay, have vbmeta descriptors that
-                // refer to partitions that exist on the device, but not in the
-                // OTA.
-                Err(e) if e.kind() == io::ErrorKind::NotFound && allow_missing => {
-                    warn!("{e}");
-                    return Ok(());
-                }
-                Err(e) => return Err(e.into()),
-            };
+        let file = match opener.open(name, &options) {
+            Ok((_, f)) => f,
+            // Some devices, like bluejay, have vbmeta descriptors that refer to
+            // partitions that exist on the device, but not in the OTA.
+            Err(e) if e.kind() == io::ErrorKind::NotFound && allow_missing => {
+                warn!("{e}");
+                return Ok(());
+            }
+            Err(e) => return Err(e.into()),
+        };

-            verify_and_repair(
-                Some(name),
-                file,
-                descriptor.try_into()?,
-                repair,
-                cancel_signal,
-            )
-        })
-        .collect()
+        verify_and_repair(
+            Some(name),
+            &file,
+            descriptor.try_into()?,
+            repair,
+            cancel_signal,
+        )
+    })
 }

 fn compute_digest_recursive(
@@ -741,7 +785,7 @@ fn unpack_subcommand(cli: &UnpackCli, cancel_signal: &AtomicBool) -> Result<()>

    write_info(&cli.output_info, &info)?;

-    if info.footer.is_some() {
+    if info.footer.is_some() && !cli.no_output_raw {
        write_raw_and_verify(
            &cli.output_raw,
            &mut reader,
@@ -772,13 +816,12 @@ fn pack_subcommand(cli: &PackCli, cancel_signal: &AtomicBool) -> Result<()> {
        file
    } else {
        File::create(&cli.output)
-            .map(PSeekFile::new)
            .with_context(|| format!("Failed to open output for writing: {:?}", cli.output))?
    };

    sign_or_clear(&mut info, &orig_header, &cli.key)?;

-    write_avb_image(file, &mut info, cli.recompute_size)?;
+    write_avb_image(&file, &mut info, cli.recompute_size)?;

    // We display the info at the very end after both the header and footer are
    // updated so that incorrect/incomplete information isn't shown.
@@ -801,7 +844,7 @@ fn repack_subcommand(cli: &RepackCli, cancel_signal: &AtomicBool) -> Result<()>
        // Write new hash tree and FEC data instead of copying the original.
        // There could have been errors in the original FEC data itself.
        if let AppendedDescriptorMut::HashTree(d) = info.header.appended_descriptor_mut()? {
-            d.update(&file, &file, None, cancel_signal)?;
+            d.update(&file, None, cancel_signal)?;
        }

        update_dm_verity_cmdline(&mut info)?;
@@ -809,13 +852,12 @@ fn repack_subcommand(cli: &RepackCli, cancel_signal: &AtomicBool) -> Result<()>
        file
    } else {
        File::create(&cli.output)
-            .map(PSeekFile::new)
            .with_context(|| format!("Failed to open for writing: {:?}", cli.output))?
    };

    sign_or_clear(&mut info, &orig_header, &cli.key)?;

-    write_avb_image(file, &mut info, false)?;
+    write_avb_image(&file, &mut info, false)?;

    // We display the info at the very end after both the header and footer are
    // updated so that incorrect/incomplete information isn't shown.
@@ -1033,6 +1075,10 @@ struct UnpackCli {
    #[arg(long, value_name = "FILE", value_parser, default_value = "raw.img")]
    output_raw: PathBuf,

+    /// Do not output raw image.
+    #[arg(long, conflicts_with = "output_raw")]
+    no_output_raw: bool,
+
    /// Ignore invalid digests or FEC data.
    #[arg(long)]
    ignore_invalid: bool,
@@ -1173,8 +1219,8 @@ struct VerifyCli {
 struct VerifyDeviceCli {
    /// Path to public key in AVB binary format.
    ///
-    /// If this is not specified, the signatures can only be checked for
-    /// validity, not whether they are trusted.
+    /// If this is not specified, then the signature is verified against the
+    /// ro.boot.vbmeta.public_key_digest value provided by the bootloader.
    #[arg(short, long, value_name = "FILE", value_parser)]
    public_key: Option<PathBuf>,

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: 2023 Andrew Gunnerson
+// SPDX-FileCopyrightText: 2023-2025 Andrew Gunnerson
 // SPDX-License-Identifier: GPL-3.0-only

 use std::{
@@ -16,8 +16,9 @@ use crate::{
 };

 fn read_image(path: &Path) -> Result<BootImage> {
-    let file = File::open(path).with_context(|| format!("Failed to open for reading: {path:?}"))?;
-    let reader = BufReader::new(file);
+    let reader = File::open(path)
+        .map(BufReader::new)
+        .with_context(|| format!("Failed to open for reading: {path:?}"))?;
    let image = BootImage::from_reader(reader)
        .with_context(|| format!("Failed to read boot image: {path:?}"))?;

@@ -25,9 +26,9 @@ fn read_image(path: &Path) -> Result<BootImage> {
 }

 fn write_image(path: &Path, image: &BootImage) -> Result<()> {
-    let file =
-        File::create(path).with_context(|| format!("Failed to open for writing: {path:?}"))?;
-    let mut writer = BufWriter::new(file);
+    let mut writer = File::create(path)
+        .map(BufWriter::new)
+        .with_context(|| format!("Failed to open for writing: {path:?}"))?;
    image
        .to_writer(&mut writer)
        .with_context(|| format!("Failed to write boot image: {path:?}"))?;
@@ -41,14 +42,14 @@ fn write_image(path: &Path, image: &BootImage) -> Result<()> {
 fn read_header(path: &Path) -> Result<BootImage> {
    let data = fs::read_to_string(path)
        .with_context(|| format!("Failed to read header TOML: {path:?}"))?;
-    let image = toml_edit::de::from_str(&data)
+    let image = toml::de::from_str(&data)
        .with_context(|| format!("Failed to parse header TOML: {path:?}"))?;

    Ok(image)
 }

 fn write_header(path: &Path, image: &BootImage) -> Result<()> {
-    let data = toml_edit::ser::to_string_pretty(image)
+    let data = toml::ser::to_string_pretty(image)
        .with_context(|| format!("Failed to serialize header TOML: {path:?}"))?;
    fs::write(path, data).with_context(|| format!("Failed to write header TOML: {path:?}"))?;

@@ -76,12 +77,12 @@ fn read_text_if_exists(path: &Path) -> Result<Option<String>> {
 }

 fn read_avb_header_if_exists(path: &Path) -> Result<Option<Header>> {
-    let file = match File::open(path) {
-        Ok(f) => f,
+    let reader = match File::open(path) {
+        Ok(f) => BufReader::new(f),
        Err(e) if e.kind() == io::ErrorKind::NotFound => return Ok(None),
        Err(e) => Err(e).with_context(|| format!("Failed to open for reading: {path:?}"))?,
    };
-    let header = Header::from_reader(BufReader::new(file))
+    let header = Header::from_reader(reader)
        .with_context(|| format!("Failed to read vbmeta header: {path:?}"))?;

    Ok(Some(header))
@@ -105,9 +106,15 @@ fn write_text_if_not_empty(path: &Path, text: &str) -> Result<()> {
 }

 fn write_avb_header(path: &Path, header: &Header) -> Result<()> {
-    let file =
-        File::create(path).with_context(|| format!("Failed to open for writing: {path:?}"))?;
-    header.to_writer(BufWriter::new(file))?;
+    let mut writer = File::create(path)
+        .map(BufWriter::new)
+        .with_context(|| format!("Failed to open for writing: {path:?}"))?;
+    header
+        .to_writer(&mut writer)
+        .with_context(|| format!("Failed to write AVB header: {path:?}"))?;
+    writer
+        .flush()
+        .with_context(|| format!("Failed to flush AVB header: {path:?}"))?;

    Ok(())
 }
@@ -164,30 +171,44 @@ fn unpack_subcommand(boot_cli: &BootCli, cli: &UnpackCli) -> Result<()> {
        }
    }

-    if let Some(data) = kernel {
+    if let Some(data) = kernel
+        && !cli.no_output_kernel
+    {
        write_data_if_not_empty(&cli.output_kernel, data)?;
    }
-    if let Some(data) = second {
+    if let Some(data) = second
+        && !cli.no_output_second
+    {
        write_data_if_not_empty(&cli.output_second, data)?;
    }
-    if let Some(data) = recovery_dtbo {
+    if let Some(data) = recovery_dtbo
+        && !cli.no_output_recovery_dtbo
+    {
        write_data_if_not_empty(&cli.output_recovery_dtbo, data)?;
    }
-    if let Some(data) = dtb {
+    if let Some(data) = dtb
+        && !cli.no_output_dtb
+    {
        write_data_if_not_empty(&cli.output_dtb, data)?;
    }
-    if let Some(header) = vts_signature {
+    if let Some(header) = vts_signature
+        && !cli.no_output_vts_signature
+    {
        write_avb_header(&cli.output_vts_signature, header)?;
    }
-    if let Some(text) = bootconfig {
+    if let Some(text) = bootconfig
+        && !cli.no_output_bootconfig
+    {
        write_text_if_not_empty(&cli.output_bootconfig, text)?;
    }

-    for (i, data) in ramdisks.iter().enumerate() {
-        let mut path = cli.output_ramdisk_prefix.as_os_str().to_owned();
-        path.push(i.to_string());
+    if !cli.no_output_ramdisk {
+        for (i, data) in ramdisks.iter().enumerate() {
+            let mut path = cli.output_ramdisk_prefix.as_os_str().to_owned();
+            path.push(i.to_string());

-        write_data_if_not_empty(Path::new(&path), data)?;
+            write_data_if_not_empty(Path::new(&path), data)?;
+        }
    }

    Ok(())
@@ -272,8 +293,9 @@ fn info_subcommand(boot_cli: &BootCli, cli: &InfoCli) -> Result<()> {

 pub fn magisk_info_subcommand(cli: &MagiskInfoCli) -> Result<()> {
    let raw_reader = File::open(&cli.image)
+        .map(BufReader::new)
        .with_context(|| format!("Failed to open for reading: {:?}", cli.image))?;
-    let boot_image = BootImage::from_reader(BufReader::new(raw_reader))
+    let boot_image = BootImage::from_reader(raw_reader)
        .with_context(|| format!("Failed to load boot image: {:?}", cli.image))?;

    let mut ramdisks = vec![];
@@ -339,6 +361,10 @@ struct UnpackCli {
    #[arg(long, value_name = "FILE", value_parser, default_value = "kernel.img")]
    output_kernel: PathBuf,

+    /// Do not output kernel image.
+    #[arg(long, conflicts_with = "output_kernel")]
+    no_output_kernel: bool,
+
    /// Path prefix for output ramdisk images.
    #[arg(
        long,
@@ -348,10 +374,18 @@ struct UnpackCli {
    )]
    output_ramdisk_prefix: PathBuf,

+    /// Do not output ramdisk images.
+    #[arg(long, conflicts_with = "output_ramdisk_prefix")]
+    no_output_ramdisk: bool,
+
    /// Path to output second stage bootloader image.
    #[arg(long, value_name = "FILE", value_parser, default_value = "second.img")]
    output_second: PathBuf,

+    /// Do not output second stage bootloader image.
+    #[arg(long, conflicts_with = "output_second")]
+    no_output_second: bool,
+
    /// Path to output recovery dtbo/acpio image.
    #[arg(
        long,
@@ -361,10 +395,18 @@ struct UnpackCli {
    )]
    output_recovery_dtbo: PathBuf,

+    /// Do not output recovery dtbo/acpio image.
+    #[arg(long, conflicts_with = "output_recovery_dtbo")]
+    no_output_recovery_dtbo: bool,
+
    /// Path to output device tree blob image.
    #[arg(long, value_name = "FILE", value_parser, default_value = "dtb.img")]
    output_dtb: PathBuf,

+    /// Do not output device tree blob image.
+    #[arg(long, conflicts_with = "output_dtb")]
+    no_output_dtb: bool,
+
    /// Path to output VTS signature.
    #[arg(
        long,
@@ -374,6 +416,10 @@ struct UnpackCli {
    )]
    output_vts_signature: PathBuf,

+    /// Do not output VTS signature.
+    #[arg(long, conflicts_with = "output_vts_signature")]
+    no_output_vts_signature: bool,
+
    /// Path to output bootconfig text.
    #[arg(
        long,
@@ -382,6 +428,10 @@ struct UnpackCli {
        default_value = "bootconfig.txt"
    )]
    output_bootconfig: PathBuf,
+
+    /// Do not output bootconfig text.
+    #[arg(long, conflicts_with = "output_bootconfig")]
+    no_output_bootconfig: bool,
 }

 /// Pack a boot image.
@@ -33,12 +33,13 @@ fn open_reader(
    path: &Path,
    include_trailer: bool,
 ) -> Result<(
-    CpioReader<CompressedReader<'_, BufReader<File>>>,
+    CpioReader<CompressedReader<BufReader<File>>>,
    CompressedFormat,
 )> {
-    let file =
-        File::open(path).with_context(|| format!("Failed to open cpio for reading: {path:?}"))?;
-    let reader = CompressedReader::new(BufReader::new(file), true)
+    let raw_reader = File::open(path)
+        .map(BufReader::new)
+        .with_context(|| format!("Failed to open cpio for reading: {path:?}"))?;
+    let reader = CompressedReader::new(raw_reader, true)
        .with_context(|| format!("Failed to open decompressor: {path:?}"))?;
    let format = reader.format();
    let cpio_reader = CpioReader::new(reader, include_trailer);
@@ -49,10 +50,11 @@ fn open_reader(
 fn open_writer(
    path: &Path,
    format: CompressedFormat,
-) -> Result<CpioWriter<CompressedWriter<'_, BufWriter<File>>>> {
-    let file =
-        File::create(path).with_context(|| format!("Failed to open cpio for writing: {path:?}"))?;
-    let writer = CompressedWriter::new(BufWriter::new(file), format)
+) -> Result<CpioWriter<CompressedWriter<BufWriter<File>>>> {
+    let raw_writer = File::create(path)
+        .map(BufWriter::new)
+        .with_context(|| format!("Failed to open cpio for writing: {path:?}"))?;
+    let writer = CompressedWriter::new(raw_writer, format)
        .with_context(|| format!("Failed to open compressor: {path:?}"))?;
    let cpio_writer = CpioWriter::new(writer, false);

@@ -73,7 +75,7 @@ fn flush_writer(writer: CpioWriter<CompressedWriter<BufWriter<File>>>) -> Result
 fn read_info(path: &Path) -> Result<CpioInfo> {
    let data = fs::read_to_string(path)
        .with_context(|| format!("Failed to read cpio info TOML: {path:?}"))?;
-    let info = toml_edit::de::from_str(&data)
+    let info = toml::de::from_str(&data)
        .with_context(|| format!("Failed to parse cpio info TOML: {path:?}"))?;

    Ok(info)
@@ -81,7 +83,7 @@ fn read_info(path: &Path) -> Result<CpioInfo> {

 /// Write cpio information to TOML file.
 fn write_info(path: &Path, info: &CpioInfo) -> Result<()> {
-    let data = toml_edit::ser::to_string_pretty(info)
+    let data = toml::ser::to_string_pretty(info)
        .with_context(|| format!("Failed to serialize cpio info TOML: {path:?}"))?;
    fs::write(path, data).with_context(|| format!("Failed to write cpio info TOML: {path:?}"))?;

@@ -170,22 +172,24 @@ fn unpack_subcommand(

    display_format(cpio_cli, format);

-    fs::create_dir_all(&cli.output_tree)
-        .with_context(|| format!("Failed to create directory: {:?}", cli.output_tree))?;
+    if !cli.no_output_tree {
+        fs::create_dir_all(&cli.output_tree)
+            .with_context(|| format!("Failed to create directory: {:?}", cli.output_tree))?;

-    while let Some(entry) = reader.next_entry().context("Failed to read cpio entry")? {
-        display_entry(cpio_cli, &entry);
+        while let Some(entry) = reader.next_entry().context("Failed to read cpio entry")? {
+            display_entry(cpio_cli, &entry);

-        if let Some(mut writer) = create_tree_file(&cli.output_tree, &entry)? {
-            let file_size = entry.data.size()?;
+            if let Some(mut writer) = create_tree_file(&cli.output_tree, &entry)? {
+                let file_size = entry.data.size()?;

-            stream::copy_n(&mut reader, &mut writer, file_size.into(), cancel_signal)
-                .context("Failed to copy data")?;
+                stream::copy_n(&mut reader, &mut writer, file_size.into(), cancel_signal)
+                    .context("Failed to copy data")?;

-            writer.into_inner().context("Failed to flush data")?;
+                writer.into_inner().context("Failed to flush data")?;
+            }
+
+            info.entries.push(entry);
        }
-
-        info.entries.push(entry);
    }

    write_info(&cli.output_info, &info)?;
@@ -285,8 +289,7 @@ pub fn cpio_main(cli: &CpioCli, cancel_signal: &AtomicBool) -> Result<()> {
 /// TOML file, like the UID/GID, permissions, and symlink targets.
 ///
 /// If any paths inside the cpio archive are unsafe, the extraction process will
-/// fail and exit. Extracted files are never written outside of the tree
-/// directory, even if an external process tries to interfere.
+/// fail and exit.
 #[derive(Debug, Parser)]
 struct UnpackCli {
    /// Path to input cpio file.
@@ -300,6 +303,10 @@ struct UnpackCli {
    /// Path to output files directory.
    #[arg(long, value_name = "DIR", value_parser, default_value = "cpio_tree")]
    output_tree: PathBuf,
+
+    /// Do not output files.
+    #[arg(long, conflicts_with = "output_tree")]
+    no_output_tree: bool,
 }

 /// Pack a cpio archive.
@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: 2023 Andrew Gunnerson
+// SPDX-FileCopyrightText: 2023-2025 Andrew Gunnerson
 // SPDX-License-Identifier: GPL-3.0-only

 use std::{
@@ -13,15 +13,14 @@ use clap::{Parser, Subcommand};

 use crate::{
    format::fec::FecImage,
-    stream::{FromReader, PSeekFile, ToWriter},
+    stream::{FromReader, ToWriter},
 };

-fn open_input(path: &Path, rw: bool) -> Result<PSeekFile> {
+fn open_input(path: &Path, rw: bool) -> Result<File> {
    OpenOptions::new()
        .read(true)
        .write(rw)
        .open(path)
-        .map(PSeekFile::new)
        .with_context(|| format!("Failed to open file: {path:?}"))
 }

@@ -91,10 +90,7 @@ fn repair_subcommand(cli: &RepairCli, cancel_signal: &AtomicBool) -> Result<()>
    let input = open_input(&cli.input, true)?;
    let fec = read_fec(&cli.fec)?;

-    // The separate buffered readers and writers are safe because the function
-    // guarantees that every thread touches disjoint offsets and every offset is
-    // read and written at most once.
-    fec.repair(&input, &input, cancel_signal)
+    fec.repair(&input, cancel_signal)
        .context("Failed to repair file")?;

    Ok(())
@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: 2023 Andrew Gunnerson
+// SPDX-FileCopyrightText: 2023-2025 Andrew Gunnerson
 // SPDX-License-Identifier: GPL-3.0-only

 use std::{
@@ -13,15 +13,14 @@ use clap::{Parser, Subcommand};

 use crate::{
    format::hashtree::HashTreeImage,
-    stream::{FromReader, PSeekFile, ToWriter},
+    stream::{FromReader, ToWriter},
 };

-fn open_input(path: &Path, rw: bool) -> Result<PSeekFile> {
+fn open_input(path: &Path, rw: bool) -> Result<File> {
    OpenOptions::new()
        .read(true)
        .write(rw)
        .open(path)
-        .map(PSeekFile::new)
        .with_context(|| format!("Failed to open file: {path:?}"))
 }

@@ -16,37 +16,33 @@ use rayon::iter::{

 use crate::{
    format::lp::{Extent, ExtentType, ImageType, Metadata, SECTOR_SIZE},
-    stream::{self, FromReader, PSeekFile, Reopen, ToWriter},
+    stream::{self, FromReader, ToWriter, UserPosFile},
    util,
 };

-fn open_lp_inputs(paths: &[impl AsRef<Path>]) -> Result<(Vec<PSeekFile>, Metadata)> {
-    let mut inputs = paths
+fn open_lp_inputs(paths: &[impl AsRef<Path>]) -> Result<(Vec<File>, Metadata)> {
+    let inputs = paths
        .iter()
        .map(|p| {
            let p = p.as_ref();

-            File::open(p)
-                .map(PSeekFile::new)
-                .with_context(|| format!("Failed to open LP image for reading: {p:?}"))
+            File::open(p).with_context(|| format!("Failed to open LP image for reading: {p:?}"))
        })
        .collect::<Result<Vec<_>>>()?;

-    let metadata = Metadata::from_reader(&mut inputs[0])
+    let metadata = Metadata::from_reader(&inputs[0])
        .with_context(|| format!("Failed to parse LP image metadata: {:?}", paths[0].as_ref()))?;

    Ok((inputs, metadata))
 }

-fn open_lp_outputs(paths: &[impl AsRef<Path>]) -> Result<Vec<PSeekFile>> {
+fn open_lp_outputs(paths: &[impl AsRef<Path>]) -> Result<Vec<File>> {
    paths
        .iter()
        .map(|p| {
            let p = p.as_ref();

-            File::create(p)
-                .map(PSeekFile::new)
-                .with_context(|| format!("Failed to open LP image for writing: {p:?}"))
+            File::create(p).with_context(|| format!("Failed to open LP image for writing: {p:?}"))
        })
        .collect::<Result<Vec<_>>>()
 }
@@ -54,14 +50,14 @@ fn open_lp_outputs(paths: &[impl AsRef<Path>]) -> Result<Vec<PSeekFile>> {
 fn read_info(path: &Path) -> Result<Metadata> {
    let data = fs::read_to_string(path)
        .with_context(|| format!("Failed to read metadata info TOML: {path:?}"))?;
-    let info = toml_edit::de::from_str(&data)
+    let info = toml::de::from_str(&data)
        .with_context(|| format!("Failed to parse metadata info TOML: {path:?}"))?;

    Ok(info)
 }

 fn write_info(path: &Path, metadata: &Metadata) -> Result<()> {
-    let data = toml_edit::ser::to_string_pretty(metadata)
+    let data = toml::ser::to_string_pretty(metadata)
        .with_context(|| format!("Failed to serialize metadata info TOML: {path:?}"))?;
    fs::write(path, data)
        .with_context(|| format!("Failed to write metadata info TOML: {path:?}"))?;
@@ -165,17 +161,15 @@ fn fill_slots(metadata: &mut Metadata) {
 }

 fn unpack_subcommand(lp_cli: &LpCli, cli: &UnpackCli, cancel_signal: &AtomicBool) -> Result<()> {
-    let mut inputs = cli
+    let inputs = cli
        .input
        .iter()
        .map(|p| {
-            File::open(p)
-                .map(PSeekFile::new)
-                .with_context(|| format!("Failed to open LP image for reading: {p:?}"))
+            File::open(p).with_context(|| format!("Failed to open LP image for reading: {p:?}"))
        })
        .collect::<Result<Vec<_>>>()?;

-    let mut metadata = Metadata::from_reader(&mut inputs[0])
+    let mut metadata = Metadata::from_reader(&inputs[0])
        .with_context(|| format!("Failed to read LP image metadata: {:?}", cli.input[0]))?;

    // Display and write only the selected slot.
@@ -185,7 +179,7 @@ fn unpack_subcommand(lp_cli: &LpCli, cli: &UnpackCli, cancel_signal: &AtomicBool
    write_info(&cli.output_info, &metadata)?;

    // For empty images, there's no data to unpack.
-    if metadata.image_type == ImageType::Empty {
+    if metadata.image_type == ImageType::Empty || cli.no_output_images {
        return Ok(());
    }

@@ -216,7 +210,6 @@ fn unpack_subcommand(lp_cli: &LpCli, cli: &UnpackCli, cancel_signal: &AtomicBool
                util::path_join_single(&cli.output_images, format!("{}.img", partition.name))?;

            let file = File::create(&path)
-                .map(PSeekFile::new)
                .with_context(|| format!("Failed to open for writing: {path:?}"))?;

            file.set_len(partition.size()?)
@@ -247,10 +240,9 @@ fn unpack_subcommand(lp_cli: &LpCli, cli: &UnpackCli, cancel_signal: &AtomicBool
                .into_par_iter()
                .map(move |e| (g_index, p_index, e))
        })
-        .map(|(g_index, p_index, extent)| {
-            // Never fails for PSeekFiles.
-            let mut reader = inputs[extent.device_index].reopen()?;
-            let mut writer = files[g_index][p_index].reopen()?;
+        .try_for_each(|(g_index, p_index, extent)| {
+            let mut reader = UserPosFile::new(&inputs[extent.device_index]);
+            let mut writer = UserPosFile::new(&files[g_index][p_index]);

            let r_path = &cli.input[extent.device_index];
            let w_path = &paths[g_index][p_index];
@@ -267,9 +259,6 @@ fn unpack_subcommand(lp_cli: &LpCli, cli: &UnpackCli, cancel_signal: &AtomicBool

            Ok(())
        })
-        .collect::<Result<()>>()?;
-
-    Ok(())
 }

 fn pack_subcommand(lp_cli: &LpCli, cli: &PackCli, cancel_signal: &AtomicBool) -> Result<()> {
@@ -313,7 +302,6 @@ fn pack_subcommand(lp_cli: &LpCli, cli: &PackCli, cancel_signal: &AtomicBool) ->
                    util::path_join_single(&cli.input_images, format!("{}.img", partition.name))?;

                let mut file = File::open(&path)
-                    .map(PSeekFile::new)
                    .with_context(|| format!("Failed to open for reading: {path:?}"))?;

                let size = file
@@ -380,10 +368,9 @@ fn pack_subcommand(lp_cli: &LpCli, cli: &PackCli, cancel_signal: &AtomicBool) ->
                .into_par_iter()
                .map(move |e| (g_index, p_index, e))
        })
-        .map(|(g_index, p_index, extent)| {
-            // Never fails for PSeekFiles.
-            let mut reader = files[g_index][p_index].reopen()?;
-            let mut writer = outputs[extent.device_index].reopen()?;
+        .try_for_each(|(g_index, p_index, extent)| {
+            let mut reader = UserPosFile::new(&files[g_index][p_index]);
+            let mut writer = UserPosFile::new(&outputs[extent.device_index]);

            let r_path = &paths[g_index][p_index];
            let w_path = &cli.output[extent.device_index];
@@ -400,9 +387,6 @@ fn pack_subcommand(lp_cli: &LpCli, cli: &PackCli, cancel_signal: &AtomicBool) ->

            Ok(())
        })
-        .collect::<Result<()>>()?;
-
-    Ok(())
 }

 fn repack_subcommand(lp_cli: &LpCli, cli: &RepackCli, cancel_signal: &AtomicBool) -> Result<()> {
@@ -485,10 +469,9 @@ fn repack_subcommand(lp_cli: &LpCli, cli: &RepackCli, cancel_signal: &AtomicBool
        // Flatten extents in all partitions and split them to smaller chunks
        // for better parallelism.
        .flat_map(|partition| split_extents(&partition.extents))
-        .map(|extent| {
-            // Never fails for PSeekFiles.
-            let mut reader = inputs[extent.device_index].reopen()?;
-            let mut writer = outputs[extent.device_index].reopen()?;
+        .try_for_each(|extent| {
+            let mut reader = UserPosFile::new(&inputs[extent.device_index]);
+            let mut writer = UserPosFile::new(&outputs[extent.device_index]);

            let r_path = &cli.input[extent.device_index];
            let w_path = &cli.output[extent.device_index];
@@ -505,9 +488,6 @@ fn repack_subcommand(lp_cli: &LpCli, cli: &RepackCli, cancel_signal: &AtomicBool

            Ok(())
        })
-        .collect::<Result<()>>()?;
-
-    Ok(())
 }

 fn info_subcommand(lp_cli: &LpCli, cli: &InfoCli) -> Result<()> {
@@ -535,8 +515,7 @@ pub fn lp_main(cli: &LpCli, cancel_signal: &AtomicBool) -> Result<()> {
 /// directory. For empty images, the output images directory is unused.
 ///
 /// If any partition names are unsafe to use in a path, the extraction process
-/// will fail and exit. Extracted files are never written outside of the tree
-/// directory, even if an external process tries to interfere.
+/// will fail and exit.
 #[derive(Debug, Parser)]
 struct UnpackCli {
    /// Path to input LP images.
@@ -555,6 +534,10 @@ struct UnpackCli {
    #[arg(long, value_name = "DIR", value_parser, default_value = "lp_images")]
    output_images: PathBuf,

+    /// Do not output images.
+    #[arg(long, conflicts_with = "output_images")]
+    no_output_images: bool,
+
    /// The LP metadata slot to use.
    ///
    /// This slot is the only slot where data extents are copied from. Any data
@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: 2023-2024 Andrew Gunnerson
+// SPDX-FileCopyrightText: 2023-2026 Andrew Gunnerson
 // SPDX-License-Identifier: GPL-3.0-only

 pub mod args;
@@ -13,3 +13,4 @@ pub mod lp;
 pub mod ota;
 pub mod payload;
 pub mod sparse;
+pub mod zip;
@@ -1,13 +1,13 @@
-// SPDX-FileCopyrightText: 2024-2025 Andrew Gunnerson
+// SPDX-FileCopyrightText: 2024-2026 Andrew Gunnerson
 // SPDX-License-Identifier: GPL-3.0-only

 use std::{
    collections::HashMap,
    ffi::OsString,
    fs::{self, File},
-    io::{BufReader, BufWriter, Seek, SeekFrom},
+    io::{BufReader, BufWriter, Seek, SeekFrom, Write},
    path::{Path, PathBuf},
-    sync::atomic::AtomicBool,
+    sync::{Arc, atomic::AtomicBool},
 };

 use anyhow::{Context, Result, anyhow, bail};
@@ -18,31 +18,34 @@ use crate::{
    cli::ota,
    crypto::{self, PassphraseSource, RsaSigningKey},
    format::payload::{PayloadHeader, PayloadWriter},
-    stream::{self, FromReader, PSeekFile},
+    stream::{self, FromReader, SectionReader},
    util,
 };

-fn open_reader(path: &Path, allow_delta: bool) -> Result<(BufReader<File>, PayloadHeader)> {
-    let mut reader = File::open(path)
-        .map(BufReader::new)
-        .with_context(|| format!("Failed to open payload for reading: {path:?}"))?;
+fn open_raw_reader(path: &Path) -> Result<File> {
+    File::open(path).with_context(|| format!("Failed to open payload for reading: {path:?}"))
+}
+
+fn open_reader(path: &Path) -> Result<(BufReader<File>, PayloadHeader)> {
+    let mut reader = open_raw_reader(path).map(BufReader::new)?;
    let header = PayloadHeader::from_reader(&mut reader)
        .with_context(|| format!("Failed to read payload header: {path:?}"))?;
-    if !allow_delta && !header.is_full_ota() {
-        bail!("Payload is a delta OTA, not a full OTA");
-    }

    Ok((reader, header))
 }

+fn open_raw_writer(path: &Path) -> Result<BufWriter<File>> {
+    File::create(path)
+        .map(BufWriter::new)
+        .with_context(|| format!("Failed to open payload for writing: {path:?}"))
+}
+
 fn open_writer(
    path: &Path,
    header: PayloadHeader,
    key: RsaSigningKey,
 ) -> Result<PayloadWriter<BufWriter<File>>> {
-    let writer = File::create(path)
-        .map(BufWriter::new)
-        .with_context(|| format!("Failed to open payload for writing: {path:?}"))?;
+    let writer = open_raw_writer(path)?;
    let payload_writer = PayloadWriter::new(writer, header, key)
        .with_context(|| format!("Failed to write payload header: {path:?}"))?;

@@ -52,14 +55,14 @@ fn open_writer(
 fn read_info(path: &Path) -> Result<PayloadHeader> {
    let data = fs::read_to_string(path)
        .with_context(|| format!("Failed to read payload info TOML: {path:?}"))?;
-    let info = toml_edit::de::from_str(&data)
+    let info = toml::de::from_str(&data)
        .with_context(|| format!("Failed to parse payload info TOML: {path:?}"))?;

    Ok(info)
 }

 fn write_info(path: &Path, manifest: &PayloadHeader) -> Result<()> {
-    let data = toml_edit::ser::to_string_pretty(manifest)
+    let data = toml::ser::to_string_pretty(manifest)
        .with_context(|| format!("Failed to serialize payload info TOML: {path:?}"))?;
    fs::write(path, data)
        .with_context(|| format!("Failed to write payload info TOML: {path:?}"))?;
@@ -67,8 +70,8 @@ fn write_info(path: &Path, manifest: &PayloadHeader) -> Result<()> {
    Ok(())
 }

-fn display_header(cli: &PayloadCli, header: &PayloadHeader) {
-    if !cli.quiet {
+fn display_header(quiet: bool, header: &PayloadHeader) {
+    if !quiet {
        println!("{header:#?}");
    }
 }
@@ -99,50 +102,105 @@ fn load_key(group: &KeyGroup) -> Result<RsaSigningKey> {
    Ok(signing_key)
 }

+#[allow(clippy::too_many_arguments)]
+pub fn unpack_payload(
+    quiet: bool,
+    output_info: &Path,
+    output_images: &Path,
+    no_output_images: bool,
+    skeleton: bool,
+    reader: &File,
+    payload_offset: u64,
+    payload_size: u64,
+    cancel_signal: &AtomicBool,
+) -> Result<()> {
+    let section_reader = SectionReader::new(reader, payload_offset, payload_size)
+        .context("Failed to directly open payload section")?;
+    let header =
+        PayloadHeader::from_reader(section_reader).context("Failed to read payload header")?;
+
+    display_header(quiet, &header);
+
+    write_info(output_info, &header)?;
+
+    if !no_output_images {
+        fs::create_dir_all(output_images)
+            .with_context(|| format!("Failed to create directory: {output_images:?}"))?;
+
+        if skeleton {
+            for partition in &header.manifest.partitions {
+                let name = &partition.partition_name;
+                let path = util::path_join_single(output_images, format!("{name}.img"))?;
+                let size = partition
+                    .new_partition_info
+                    .as_ref()
+                    .and_then(|info| info.size)
+                    .ok_or_else(|| anyhow!("Size not found for partition: {name}"))?;
+
+                let file = File::create(&path)
+                    .with_context(|| format!("Failed to create file: {path:?}"))?;
+
+                file.set_len(size)
+                    .with_context(|| format!("Failed to truncate file: {path:?}"))?;
+            }
+        } else {
+            if !header.is_full_ota() {
+                bail!("Cannot extract images from a delta payload");
+            }
+
+            ota::extract_payload(
+                reader,
+                output_images,
+                payload_offset,
+                payload_size,
+                &header,
+                &header
+                    .manifest
+                    .partitions
+                    .iter()
+                    .map(|p| &p.partition_name)
+                    .cloned()
+                    .collect(),
+                cancel_signal,
+            )?;
+        }
+    }
+
+    Ok(())
+}
+
 fn unpack_subcommand(
    payload_cli: &PayloadCli,
    cli: &UnpackCli,
    cancel_signal: &AtomicBool,
 ) -> Result<()> {
-    let (mut reader, header) = open_reader(&cli.input, false)?;
+    let mut reader = open_raw_reader(&cli.input)?;
    let payload_size = reader
        .seek(SeekFrom::End(0))
        .with_context(|| format!("Failed to get file size: {:?}", cli.input))?;

-    display_header(payload_cli, &header);
-
-    write_info(&cli.output_info, &header)?;
-
-    fs::create_dir_all(&cli.output_images)
-        .with_context(|| format!("Failed to create directory: {:?}", cli.output_images))?;
-
-    ota::extract_payload(
-        &PSeekFile::new(reader.into_inner()),
+    unpack_payload(
+        payload_cli.quiet,
+        &cli.output_info,
        &cli.output_images,
+        cli.no_output_images,
+        cli.skeleton,
+        &reader,
        0,
        payload_size,
-        &header,
-        &header
-            .manifest
-            .partitions
-            .iter()
-            .map(|p| &p.partition_name)
-            .cloned()
-            .collect(),
        cancel_signal,
-    )?;
-
-    Ok(())
+    )
 }

-fn pack_subcommand(
-    payload_cli: &PayloadCli,
-    cli: &PackCli,
+pub fn pack_payload(
+    quiet: bool,
+    input_info: &Path,
+    input_images: &Path,
+    writer: &mut dyn Write,
+    signing_key: &RsaSigningKey,
    cancel_signal: &AtomicBool,
-) -> Result<()> {
-    let signing_key = load_key(&cli.key)?;
-
-    let mut header = read_info(&cli.input_info)?;
+) -> Result<(String, u64)> {
+    let mut header = read_info(input_info)?;

    // Pre-open all of the image files.
    let input_files = header
@@ -150,16 +208,35 @@ fn pack_subcommand(
        .partitions
        .iter()
        .map(|p| {
-            let path =
-                util::path_join_single(&cli.input_images, format!("{}.img", p.partition_name))?;
+            let path = util::path_join_single(input_images, format!("{}.img", p.partition_name))?;
            let file = File::open(&path)
-                .map(PSeekFile::new)
+                .map(Arc::new)
                .with_context(|| format!("Failed to open file: {path:?}"))?;

            Ok((p.partition_name.clone(), file))
        })
        .collect::<Result<HashMap<_, _>>>()?;

+    for (name, input_file) in &input_files {
+        let Some(dpm) = &header.manifest.dynamic_partition_metadata else {
+            continue;
+        };
+
+        if !dpm.groups.iter().any(|g| g.partition_names.contains(name)) {
+            continue;
+        }
+
+        header
+            .manifest
+            .partitions
+            .iter_mut()
+            .find(|p| p.partition_name == *name)
+            .unwrap()
+            .estimate_cow_size = Some(0);
+
+        ota::recow_image(name, input_file, &mut header, cancel_signal)?;
+    }
+
    // Compress the images and compute the list of install operations for
    // insertion into the payload header. The compressed data is stored in new
    // temp files and the original input files are dropped.
@@ -177,7 +254,8 @@ fn pack_subcommand(

    // Now we can write the actual payload. With everything precomputed, this is
    // mostly just a simple copy.
-    let mut payload_writer = open_writer(&cli.output, header.clone(), signing_key)?;
+    let mut payload_writer = PayloadWriter::new(writer, header.clone(), signing_key.clone())
+        .context("Failed to write payload header")?;

    while payload_writer
        .begin_next_operation()
@@ -213,12 +291,35 @@ fn pack_subcommand(
            .with_context(|| format!("Failed to copy from replacement image: {name}"))?;
    }

-    let (_, header, properties, _) = payload_writer
+    let (_, header, properties) = payload_writer
        .finish()
        .context("Failed to finalize payload")?;

    // Display the header information now that it has been finalized.
-    display_header(payload_cli, &header);
+    display_header(quiet, &header);
+
+    Ok((properties, header.blob_offset))
+}
+
+fn pack_subcommand(
+    payload_cli: &PayloadCli,
+    cli: &PackCli,
+    cancel_signal: &AtomicBool,
+) -> Result<()> {
+    let signing_key = load_key(&cli.key)?;
+
+    let mut writer = open_raw_writer(&cli.output)?;
+
+    let (properties, _) = pack_payload(
+        payload_cli.quiet,
+        &cli.input_info,
+        &cli.input_images,
+        &mut writer,
+        &signing_key,
+        cancel_signal,
+    )?;
+
+    writer.into_inner().context("Failed to flush payload")?;

    // Optionally, write payload_properties.txt.
    if let Some(path) = &cli.output_properties {
@@ -236,7 +337,7 @@ fn repack_subcommand(
 ) -> Result<()> {
    let signing_key = load_key(&cli.key)?;

-    let (mut reader, header) = open_reader(&cli.input, true)?;
+    let (mut reader, header) = open_reader(&cli.input)?;

    info!("Generating new OTA payload");

@@ -275,12 +376,12 @@ fn repack_subcommand(
            .with_context(|| format!("Failed to copy from original payload: {name}"))?;
    }

-    let (_, header, properties, _) = payload_writer
+    let (_, header, properties) = payload_writer
        .finish()
        .context("Failed to finalize payload")?;

    // Display the header information now that it has been finalized.
-    display_header(payload_cli, &header);
+    display_header(payload_cli.quiet, &header);

    // Optionally, write payload_properties.txt.
    if let Some(path) = &cli.output_properties {
@@ -292,9 +393,9 @@ fn repack_subcommand(
 }

 fn info_subcommand(payload_cli: &PayloadCli, cli: &InfoCli) -> Result<()> {
-    let (_, header) = open_reader(&cli.input, true)?;
+    let (_, header) = open_reader(&cli.input)?;

-    display_header(payload_cli, &header);
+    display_header(payload_cli.quiet, &header);

    Ok(())
 }
@@ -341,8 +442,7 @@ struct KeyGroup {
 /// directory. The payload header metadata is written to the info TOML file.
 ///
 /// If any partition names are unsafe to use in a path, the extraction process
-/// will fail and exit. Extracted files are never written outside of the tree
-/// directory, even if an external process tries to interfere.
+/// will fail and exit.
 #[derive(Debug, Parser)]
 struct UnpackCli {
    /// Path to input payload binary.
@@ -366,6 +466,14 @@ struct UnpackCli {
        default_value = "payload_images"
    )]
    output_images: PathBuf,
+
+    /// Do not output images.
+    #[arg(long, conflicts_with_all = ["output_images", "skeleton"])]
+    no_output_images: bool,
+
+    /// Only create empty sparse files for output images.
+    #[arg(long)]
+    skeleton: bool,
 }

 /// Pack a payload binary.
@@ -381,7 +489,7 @@ struct PackCli {
    output: PathBuf,

    /// Path to output payload properties file.
-    #[arg(short, long, value_name = "FILE", value_parser)]
+    #[arg(short = 'O', long, value_name = "FILE", value_parser)]
    output_properties: Option<PathBuf>,

    /// Path to input info TOML.
@@ -421,7 +529,7 @@ struct RepackCli {
    output: PathBuf,

    /// Path to output payload properties file.
-    #[arg(short, long, value_name = "FILE", value_parser)]
+    #[arg(short = 'O', long, value_name = "FILE", value_parser)]
    output_properties: Option<PathBuf>,

    #[command(flatten)]
@@ -431,7 +539,7 @@ struct RepackCli {
 /// Display payload information.
 #[derive(Debug, Parser)]
 struct InfoCli {
-    /// Path to input payload file.
+    /// Path to input payload binary.
    #[arg(short, long, value_name = "FILE", value_parser)]
    input: PathBuf,
 }
@@ -321,7 +321,7 @@ fn unpack_subcommand(
                let to_skip = i64::from(chunk.bounds.len()) * i64::from(metadata.header.block_size);

                writer
-                    .seek(SeekFrom::Current(to_skip))
+                    .seek_relative(to_skip)
                    .with_context(|| format!("Failed to seek file: {:?}", cli.output))?;
            }
            ChunkData::Crc32(_) => {}
@@ -0,0 +1,751 @@
+// SPDX-FileCopyrightText: 2026 Andrew Gunnerson
+// SPDX-License-Identifier: GPL-3.0-only
+
+use std::{
+    collections::BTreeMap,
+    ffi::OsString,
+    fs::{self, File, OpenOptions},
+    io::{BufReader, Seek, Write},
+    path::{Path, PathBuf},
+    sync::atomic::AtomicBool,
+};
+
+use anyhow::{Context, Result, anyhow};
+use clap::{Args, Parser, Subcommand};
+use rawzip::{
+    CompressionMethod, RECOMMENDED_BUFFER_SIZE, ZipArchive, ZipArchiveEntryWayfinder,
+    ZipArchiveWriter, ZipDataWriter, ZipEntryWriter, extra_fields::ExtraFieldId,
+};
+use serde::{Deserialize, Serialize};
+use tracing::warn;
+use x509_cert::Certificate;
+
+use crate::{
+    cli::payload,
+    crypto::{self, PassphraseSource, RsaSigningKey},
+    format::{
+        ota::{self, SigningWriter, ZipEntry, ZipMode},
+        payload::PayloadHeader,
+        zip::{
+            self, ReaderAtWrapper, ZipArchiveReadAtExt, ZipEntriesSafeExt, ZipFileHeaderRecordExt,
+        },
+    },
+    protobuf::build::tools::releasetools::OtaMetadata,
+    stream::{self, FromReader},
+    util,
+};
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+struct OtaInfo {
+    metadata: OtaMetadata,
+    files: Vec<String>,
+}
+
+struct InputEntry {
+    compression_method: CompressionMethod,
+    is_zip64: bool,
+    wayfinder: ZipArchiveEntryWayfinder,
+}
+
+fn is_excluded_path(path: &str) -> bool {
+    path == ota::PATH_METADATA || path == ota::PATH_METADATA_PB || path == ota::PATH_OTACERT
+}
+
+#[allow(clippy::type_complexity)]
+fn open_reader(
+    path: &Path,
+) -> Result<(
+    ZipArchive<ReaderAtWrapper<File>>,
+    OtaMetadata,
+    BTreeMap<String, InputEntry>,
+)> {
+    let mut reader =
+        File::open(path).with_context(|| format!("Failed to open OTA for reading: {path:?}"))?;
+
+    let (metadata, _, _, _) = ota::parse_zip_ota_info(&mut reader)
+        .with_context(|| format!("Failed to parse OTA metadata: {path:?}"))?;
+
+    let mut buffer = vec![0u8; RECOMMENDED_BUFFER_SIZE];
+    let zip_reader =
+        ZipArchive::from_read_at(reader, &mut buffer).context("Failed to read OTA zip")?;
+
+    let mut entries = zip_reader.entries_safe(&mut buffer);
+    let mut input_entries = BTreeMap::new();
+
+    while let Some((cd_entry, _)) = entries.next_entry().context("Failed to list zip entries")? {
+        if cd_entry.is_dir() {
+            continue;
+        }
+
+        let path = cd_entry
+            .file_path_utf8()
+            .context("Zip contains non-UTF-8 paths")?;
+
+        if is_excluded_path(path) {
+            // OTA metadata is never copied from the input file.
+            continue;
+        }
+
+        input_entries.insert(
+            path.to_owned(),
+            InputEntry {
+                compression_method: cd_entry.compression_method(),
+                // We only check for the sizes here instead of the presence of
+                // the ZIP64 extra field. The central header's extra fields may
+                // have ZIP64 only for the local header offset.
+                is_zip64: cd_entry.compressed_size_hint() >= 0xffffffff
+                    || cd_entry.uncompressed_size_hint() >= 0xffffffff,
+                wayfinder: cd_entry.wayfinder(),
+            },
+        );
+    }
+
+    Ok((zip_reader, metadata, input_entries))
+}
+
+fn open_writer(path: &Path, zip_mode: ZipMode) -> Result<ZipArchiveWriter<SigningWriter<File>>> {
+    let writer = OpenOptions::new()
+        .read(true)
+        .write(true)
+        .create(true)
+        .truncate(true)
+        .open(path)
+        .with_context(|| format!("Failed to open OTA for writing: {path:?}"))?;
+
+    let signing_writer = match zip_mode {
+        ZipMode::Streaming => SigningWriter::new_streaming(writer),
+        ZipMode::Seekable => SigningWriter::new_seekable(writer),
+    };
+    let zip_writer = ZipArchiveWriter::new(signing_writer);
+
+    Ok(zip_writer)
+}
+
+fn read_info(path: &Path) -> Result<OtaInfo> {
+    let data = fs::read_to_string(path)
+        .with_context(|| format!("Failed to read OTA info TOML: {path:?}"))?;
+    let info = toml::de::from_str(&data)
+        .with_context(|| format!("Failed to parse OTA info TOML: {path:?}"))?;
+
+    Ok(info)
+}
+
+fn write_info(path: &Path, info: &OtaInfo) -> Result<()> {
+    let data = toml::ser::to_string_pretty(info)
+        .with_context(|| format!("Failed to serialize OTA info TOML: {path:?}"))?;
+    fs::write(path, data).with_context(|| format!("Failed to write OTA info TOML: {path:?}"))?;
+
+    Ok(())
+}
+
+fn display_info(quiet: bool, info: &OtaInfo) {
+    if !quiet {
+        println!("{info:#?}");
+    }
+}
+
+fn load_key(group: &KeyGroup) -> Result<(RsaSigningKey, Certificate)> {
+    let source = PassphraseSource::new(
+        &group.key,
+        group.pass_file.as_deref(),
+        group.pass_env_var.as_deref(),
+    );
+    let signing_key = if let Some(helper) = &group.signing_helper {
+        let public_key = crypto::read_pem_public_key_file(&group.key)
+            .with_context(|| format!("Failed to load key: {:?}", group.key))?;
+
+        RsaSigningKey::External {
+            program: helper.clone(),
+            public_key_file: group.key.clone(),
+            public_key,
+            passphrase_source: source,
+        }
+    } else {
+        let private_key = crypto::read_pem_key_file(&group.key, &source)
+            .with_context(|| format!("Failed to load key: {:?}", group.key))?;
+
+        RsaSigningKey::Internal(private_key)
+    };
+
+    let cert = crypto::read_pem_cert_file(&group.cert)
+        .with_context(|| format!("Failed to load certificate: {:?}", group.cert))?;
+
+    Ok((signing_key, cert))
+}
+
+fn start_entry<'a>(
+    zip_writer: &'a mut ZipArchiveWriter<SigningWriter<File>>,
+    path: &str,
+    zip_mode: ZipMode,
+    is_zip64: bool,
+) -> Result<(u64, ZipDataWriter<ZipEntryWriter<'a, SigningWriter<File>>>)> {
+    let mut builder = zip_writer
+        .new_file(path)
+        .compression_method(CompressionMethod::Store);
+
+    if zip_mode == ZipMode::Seekable && is_zip64 {
+        // We need to reserve space for the ZIP64 extra field when doing the
+        // post-processing to convert a streaming zip to a seekable one.
+        builder = builder.extra_field(
+            ExtraFieldId::ANDROID_ZIP_ALIGNMENT,
+            &[0u8; 16],
+            rawzip::Header::LOCAL,
+        )?;
+    }
+
+    let (entry_writer, data_config) = builder
+        .start()
+        .with_context(|| format!("Failed to begin new zip entry: {path}"))?;
+    let offset = entry_writer.stream_offset();
+    let data_writer = data_config.wrap(entry_writer);
+
+    Ok((offset, data_writer))
+}
+
+fn finalize_entry(
+    path: &str,
+    offset: u64,
+    data_writer: ZipDataWriter<ZipEntryWriter<SigningWriter<File>>>,
+    metadata_entries: &mut Vec<ZipEntry>,
+) -> Result<()> {
+    let size = data_writer
+        .finish()
+        .and_then(|(w, d)| w.finish(d))
+        .with_context(|| format!("Failed to finalize zip entry: {path}"))?;
+
+    metadata_entries.push(ZipEntry {
+        path: path.to_owned(),
+        offset,
+        size,
+    });
+
+    Ok(())
+}
+
+fn add_otacert_entry(
+    zip_writer: &mut ZipArchiveWriter<SigningWriter<File>>,
+    zip_mode: ZipMode,
+    cert: &Certificate,
+    metadata_entries: &mut Vec<ZipEntry>,
+) -> Result<()> {
+    let (offset, mut data_writer) = start_entry(zip_writer, ota::PATH_OTACERT, zip_mode, false)?;
+
+    crypto::write_pem_cert(Path::new(ota::PATH_OTACERT), &mut data_writer, cert)
+        .with_context(|| format!("Failed to write entry: {}", ota::PATH_OTACERT))?;
+
+    finalize_entry(ota::PATH_OTACERT, offset, data_writer, metadata_entries)?;
+
+    Ok(())
+}
+
+#[allow(clippy::too_many_arguments)]
+fn finalize_ota(
+    key: &RsaSigningKey,
+    cert: &Certificate,
+    mut zip_writer: ZipArchiveWriter<SigningWriter<File>>,
+    zip_mode: ZipMode,
+    metadata_entries: &mut Vec<ZipEntry>,
+    payload_metadata_size: Option<u64>,
+    metadata: &mut OtaMetadata,
+    cancel_signal: &AtomicBool,
+) -> Result<File> {
+    add_otacert_entry(&mut zip_writer, zip_mode, cert, metadata_entries)?;
+
+    let payload_metadata_size =
+        payload_metadata_size.ok_or_else(|| anyhow!("Missing payload metadata size"))?;
+    let metadata_offset = zip_writer.stream_offset();
+
+    *metadata = ota::add_metadata(
+        metadata_entries,
+        &mut zip_writer,
+        // Offset where next entry would begin.
+        metadata_offset,
+        metadata,
+        payload_metadata_size,
+    )
+    .context("Failed to write new OTA metadata")?;
+
+    let signing_writer = zip_writer
+        .finish()
+        .context("Failed to finalize output zip")?;
+    let mut raw_writer = signing_writer
+        .finish(key, cert, cancel_signal)
+        .context("Failed to sign output zip")?;
+
+    raw_writer.rewind().context("Failed to seek output zip")?;
+    ota::verify_metadata(
+        BufReader::new(&mut raw_writer),
+        metadata,
+        payload_metadata_size,
+    )
+    .context("Failed to verify OTA metadata offsets")?;
+
+    Ok(raw_writer)
+}
+
+fn unpack_subcommand(zip_cli: &ZipCli, cli: &UnpackCli, cancel_signal: &AtomicBool) -> Result<()> {
+    let (zip_reader, metadata, input_entries) = open_reader(&cli.input)?;
+
+    for (path, input_entry) in &input_entries {
+        let entry = zip_reader
+            .get_entry(input_entry.wayfinder)
+            .with_context(|| format!("Failed to open zip entry: {path}"))?;
+
+        if cli.payload && path == ota::PATH_PAYLOAD {
+            let (payload_offset, payload_size) = {
+                let range = entry.compressed_data_range();
+
+                (range.0, range.1 - range.0)
+            };
+
+            payload::unpack_payload(
+                zip_cli.quiet,
+                &cli.output_payload_info,
+                &cli.output_payload_images,
+                cli.no_output_payload_images,
+                cli.payload_skeleton,
+                &zip_reader.get_ref().0,
+                payload_offset,
+                payload_size,
+                cancel_signal,
+            )?;
+        } else if cli.payload && path == ota::PATH_PROPERTIES {
+            // We intentionally ignore this since it's recomputed when
+            // packing with --payload.
+        } else if !cli.no_output_files {
+            let mut entry_reader = zip::verifying_reader(&entry, input_entry.compression_method)
+                .with_context(|| format!("Failed to open zip entry: {path}"))?;
+
+            let output_path = util::path_join(&cli.output_files, path)?;
+            let output_parent = output_path.parent().expect("No parent path");
+
+            fs::create_dir_all(output_parent)
+                .with_context(|| format!("Failed to create directory: {output_parent:?}"))?;
+
+            let mut output_file = File::create(&output_path)
+                .with_context(|| format!("Failed to open for writing: {output_path:?}"))?;
+
+            stream::copy(&mut entry_reader, &mut output_file, cancel_signal)
+                .with_context(|| format!("Failed to extract zip entry: {path}"))?;
+        }
+    }
+
+    let info = OtaInfo {
+        metadata,
+        files: input_entries.into_keys().collect(),
+    };
+
+    display_info(zip_cli.quiet, &info);
+    write_info(&cli.output_info, &info)?;
+
+    Ok(())
+}
+
+fn pack_subcommand(zip_cli: &ZipCli, cli: &PackCli, cancel_signal: &AtomicBool) -> Result<()> {
+    let (signing_key, cert) = load_key(&cli.key)?;
+    let mut info = read_info(&cli.input_info)?;
+    let mut zip_writer = open_writer(&cli.output, cli.zip_mode.zip_mode)?;
+
+    let mut input_entries = BTreeMap::new();
+
+    for path in &info.files {
+        if is_excluded_path(path) {
+            warn!("Ignoring input file: {path}");
+            continue;
+        }
+
+        let input_size =
+            if cli.payload && (path == ota::PATH_PAYLOAD || path == ota::PATH_PROPERTIES) {
+                0
+            } else {
+                let input_path = util::path_join(&cli.input_files, path)?;
+                fs::metadata(&input_path)
+                    .map(|m| m.len())
+                    .with_context(|| format!("Failed to get file size: {input_path:?}"))?
+            };
+
+        input_entries.insert(path, input_size >= 0xffffffff);
+    }
+
+    let mut payload_metadata_size = None;
+    let mut metadata_entries = vec![];
+
+    // Only used when packing the zip and payload at the same time.
+    let mut payload_properties = None;
+
+    for (&path, &is_zip64) in &input_entries {
+        let (offset, mut data_writer) =
+            start_entry(&mut zip_writer, path, cli.zip_mode.zip_mode, is_zip64)?;
+
+        if path == ota::PATH_PAYLOAD && cli.payload {
+            // Pack the payload directly into the zip.
+            let (properties, metadata_size) = payload::pack_payload(
+                zip_cli.quiet,
+                &cli.input_payload_info,
+                &cli.input_payload_images,
+                &mut data_writer,
+                &signing_key,
+                cancel_signal,
+            )?;
+
+            payload_metadata_size = Some(metadata_size);
+            payload_properties = Some(properties);
+        } else if path == ota::PATH_PROPERTIES && cli.payload {
+            // We process files in order, so this would only happen if the file
+            // list did not contain the payload.
+            let properties = payload_properties
+                .as_ref()
+                .ok_or_else(|| anyhow!("Payload has not been processed yet"))?;
+
+            data_writer
+                .write_all(properties.as_bytes())
+                .with_context(|| format!("Failed to write zip entry: {path}"))?;
+        } else {
+            let input_path = util::path_join(&cli.input_files, path)?;
+            let mut input_file = File::open(&input_path)
+                .with_context(|| format!("Failed to open for reading: {input_path:?}"))?;
+
+            if path == ota::PATH_PAYLOAD {
+                let header = PayloadHeader::from_reader(&mut input_file)
+                    .with_context(|| format!("Failed to read payload header: {input_path:?}"))?;
+
+                payload_metadata_size = Some(header.blob_offset);
+
+                input_file
+                    .rewind()
+                    .with_context(|| format!("Failed to seek file: {input_path:?}"))?;
+            }
+
+            stream::copy(&mut input_file, &mut data_writer, cancel_signal)
+                .with_context(|| format!("Failed to copy zip entry: {path}"))?;
+        }
+
+        finalize_entry(path, offset, data_writer, &mut metadata_entries)?;
+    }
+
+    finalize_ota(
+        &signing_key,
+        &cert,
+        zip_writer,
+        cli.zip_mode.zip_mode,
+        &mut metadata_entries,
+        payload_metadata_size,
+        &mut info.metadata,
+        cancel_signal,
+    )?;
+
+    drop(input_entries);
+    info.files.retain(|p| !is_excluded_path(p));
+    info.files.sort();
+
+    display_info(zip_cli.quiet, &info);
+
+    if let Some(path) = &cli.output_info {
+        write_info(path, &info)?;
+    }
+
+    Ok(())
+}
+
+fn repack_subcommand(zip_cli: &ZipCli, cli: &RepackCli, cancel_signal: &AtomicBool) -> Result<()> {
+    let (signing_key, cert) = load_key(&cli.key)?;
+    let (zip_reader, mut metadata, input_entries) = open_reader(&cli.input)?;
+    let mut zip_writer = open_writer(&cli.output, cli.zip_mode.zip_mode)?;
+
+    let mut payload_metadata_size = None;
+    let mut metadata_entries = vec![];
+
+    for (path, input_entry) in &input_entries {
+        let (offset, mut data_writer) = start_entry(
+            &mut zip_writer,
+            path,
+            cli.zip_mode.zip_mode,
+            input_entry.is_zip64,
+        )?;
+
+        let entry = zip_reader
+            .get_entry(input_entry.wayfinder)
+            .with_context(|| format!("Failed to open zip entry: {path}"))?;
+
+        if path == ota::PATH_PAYLOAD {
+            let entry_reader = zip::verifying_reader(&entry, input_entry.compression_method)
+                .with_context(|| format!("Failed to open zip entry: {path}"))?;
+
+            let header = PayloadHeader::from_reader(entry_reader)
+                .with_context(|| format!("Failed to read payload header: {path:?}"))?;
+
+            payload_metadata_size = Some(header.blob_offset);
+        }
+
+        let mut entry_reader = zip::verifying_reader(&entry, input_entry.compression_method)
+            .with_context(|| format!("Failed to open zip entry: {path}"))?;
+
+        stream::copy(&mut entry_reader, &mut data_writer, cancel_signal)
+            .with_context(|| format!("Failed to copy zip entry: {path}"))?;
+
+        finalize_entry(path, offset, data_writer, &mut metadata_entries)?;
+    }
+
+    finalize_ota(
+        &signing_key,
+        &cert,
+        zip_writer,
+        cli.zip_mode.zip_mode,
+        &mut metadata_entries,
+        payload_metadata_size,
+        &mut metadata,
+        cancel_signal,
+    )?;
+
+    let info = OtaInfo {
+        metadata,
+        files: input_entries.into_keys().collect(),
+    };
+
+    display_info(zip_cli.quiet, &info);
+
+    Ok(())
+}
+
+fn info_subcommand(zip_cli: &ZipCli, cli: &InfoCli) -> Result<()> {
+    let (_, metadata, input_entries) = open_reader(&cli.input)?;
+    let info = OtaInfo {
+        metadata,
+        files: input_entries.into_keys().collect(),
+    };
+
+    display_info(zip_cli.quiet, &info);
+
+    Ok(())
+}
+
+pub fn zip_main(cli: &ZipCli, cancel_signal: &AtomicBool) -> Result<()> {
+    match &cli.command {
+        ZipCommand::Unpack(c) => unpack_subcommand(cli, c, cancel_signal),
+        ZipCommand::Pack(c) => pack_subcommand(cli, c, cancel_signal),
+        ZipCommand::Repack(c) => repack_subcommand(cli, c, cancel_signal),
+        ZipCommand::Info(c) => info_subcommand(cli, c),
+    }
+}
+
+#[derive(Debug, Args)]
+struct KeyGroup {
+    /// Path to signing key.
+    ///
+    /// This should normally be a private key. However, if --signing-helper is
+    /// used, then it should be a public key instead.
+    #[arg(short, long, value_name = "FILE", value_parser)]
+    key: PathBuf,
+
+    /// Certificate for signing key.
+    #[arg(short, long, value_name = "FILE", value_parser)]
+    cert: PathBuf,
+
+    /// Environment variable containing private key passphrase.
+    #[arg(long, value_name = "ENV_VAR", value_parser, group = "pass")]
+    pass_env_var: Option<OsString>,
+
+    /// File containing private key passphrase.
+    #[arg(long, value_name = "FILE", value_parser, group = "pass")]
+    pass_file: Option<PathBuf>,
+
+    /// External program for signing.
+    ///
+    /// If this option is specified, then --key must refer to a public key. The
+    /// program will be invoked as:
+    ///
+    /// <program> <algo> <public key> [file <pass file>|env <pass env>]
+    #[arg(long, value_name = "PROGRAM", value_parser)]
+    signing_helper: Option<PathBuf>,
+}
+
+#[derive(Debug, Args)]
+struct ZipModeGroup {
+    /// Zip creation mode for the output OTA zip.
+    ///
+    /// The streaming mode produces zip files that contain data descriptors.
+    /// The zip file is hashed as it is being written. This mode is the default
+    /// and works with the vast majority of devices.
+    ///
+    /// The seekable mode produces zip files that do not use data descriptors.
+    /// The zip file is reread and hashed after it has been fully written. The
+    /// output file is more likely to be compatible with devices that have
+    /// broken zip file parsers.
+    #[arg(
+        long,
+        value_name = "MODE",
+        default_value_t = ZipMode::Streaming,
+    )]
+    zip_mode: ZipMode,
+}
+
+/// Unpack an OTA zip.
+#[derive(Debug, Parser)]
+struct UnpackCli {
+    /// Path to input OTA zip.
+    #[arg(short, long, value_name = "FILE", value_parser)]
+    input: PathBuf,
+
+    /// Path to output info TOML.
+    #[arg(long, value_name = "FILE", value_parser, default_value = "ota.toml")]
+    output_info: PathBuf,
+
+    /// Path to output files directory.
+    #[arg(long, value_name = "DIR", value_parser, default_value = "ota_files")]
+    output_files: PathBuf,
+
+    /// Do not output files.
+    #[arg(long, conflicts_with = "output_files")]
+    no_output_files: bool,
+
+    /// Also unpack the payload in the OTA.
+    ///
+    /// Unpacking the zip and payload at the same time is more efficient than
+    /// unpacking them separately.
+    #[arg(long)]
+    payload: bool,
+
+    /// Path to output payload info TOML.
+    #[arg(
+        long,
+        value_name = "FILE",
+        value_parser,
+        default_value = "payload.toml",
+        requires = "payload"
+    )]
+    output_payload_info: PathBuf,
+
+    /// Path to output payload images directory.
+    #[arg(
+        long,
+        value_name = "DIR",
+        value_parser,
+        default_value = "payload_images",
+        requires = "payload"
+    )]
+    output_payload_images: PathBuf,
+
+    /// Do not output payload images.
+    #[arg(
+        long,
+        conflicts_with_all = ["output_payload_images", "payload_skeleton"],
+        requires = "payload"
+    )]
+    no_output_payload_images: bool,
+
+    /// Only create empty sparse files for output payload images.
+    #[arg(long, requires = "payload")]
+    payload_skeleton: bool,
+}
+
+/// Pack an OTA zip.
+///
+/// The new OTA zip will *only* contain files listed in the info TOML file.
+/// Extra files in the input files directory that aren't listed will be silently
+/// ignored.
+///
+/// WARNING: This subcommand is for raw file manipulation and does not perform
+/// any validation of the contents of the payload binary. For normal usage, use
+/// `avbroot ota patch` instead.
+#[derive(Debug, Parser)]
+struct PackCli {
+    /// Path to output OTA zip.
+    #[arg(short, long, value_name = "FILE", value_parser)]
+    output: PathBuf,
+
+    /// Path to input info TOML.
+    #[arg(long, value_name = "FILE", value_parser, default_value = "ota.toml")]
+    input_info: PathBuf,
+
+    /// Path to output info TOML.
+    ///
+    /// If specified, the OTA info containing all recomputed fields will be
+    /// written to this file. This can point to the same file as --input-info.
+    #[arg(long, value_name = "FILE", value_parser)]
+    output_info: Option<PathBuf>,
+
+    /// Path to input files directory.
+    #[arg(long, value_name = "DIR", value_parser, default_value = "ota_files")]
+    input_files: PathBuf,
+
+    /// Also pack the payload in the OTA.
+    ///
+    /// Packing the zip and payload at the same time is more efficient than
+    /// packing them separately.
+    #[arg(long)]
+    payload: bool,
+
+    /// Path to input payload info TOML.
+    #[arg(
+        long,
+        value_name = "FILE",
+        value_parser,
+        default_value = "payload.toml",
+        requires = "payload"
+    )]
+    input_payload_info: PathBuf,
+
+    /// Path to input payload images directory.
+    #[arg(
+        long,
+        value_name = "DIR",
+        value_parser,
+        default_value = "payload_images",
+        requires = "payload"
+    )]
+    input_payload_images: PathBuf,
+
+    #[command(flatten)]
+    key: KeyGroup,
+
+    #[command(flatten)]
+    zip_mode: ZipModeGroup,
+}
+
+/// Repack an OTA zip.
+///
+/// This command is equivalent to running `unpack` and `pack`, except without
+/// storing the unpacked data to disk first.
+#[derive(Debug, Parser)]
+struct RepackCli {
+    /// Path to input OTA zip.
+    #[arg(short, long, value_name = "FILE", value_parser)]
+    input: PathBuf,
+
+    /// Path to output OTA zip.
+    #[arg(short, long, value_name = "FILE", value_parser)]
+    output: PathBuf,
+
+    #[command(flatten)]
+    key: KeyGroup,
+
+    #[command(flatten)]
+    zip_mode: ZipModeGroup,
+}
+
+/// Display OTA zip information.
+#[derive(Debug, Parser)]
+struct InfoCli {
+    /// Path to input OTA zip.
+    #[arg(short, long, value_name = "FILE", value_parser)]
+    input: PathBuf,
+}
+
+#[derive(Debug, Subcommand)]
+enum ZipCommand {
+    Unpack(UnpackCli),
+    Pack(PackCli),
+    Repack(RepackCli),
+    Info(InfoCli),
+}
+
+/// Pack, unpack, and inspect OTA zips.
+#[derive(Debug, Parser)]
+pub struct ZipCli {
+    #[command(subcommand)]
+    command: ZipCommand,
+
+    /// Don't print OTA metadata information.
+    #[arg(short, long, global = true)]
+    quiet: bool,
+}
@@ -151,11 +151,11 @@ mod tests {
        contents.extend("💩".as_bytes());

        let data = TestData { contents };
-        let serialized = toml_edit::ser::to_string(&data).unwrap();
+        let serialized = toml::ser::to_string(&data).unwrap();

        assert_eq!(serialized, "contents = 'foo\\xFFbar💩'\n");

-        let new_data: TestData = toml_edit::de::from_str(&serialized).unwrap();
+        let new_data: TestData = toml::de::from_str(&serialized).unwrap();
        assert_eq!(data.contents, new_data.contents);
    }
 }
@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: 2023-2024 Andrew Gunnerson
+// SPDX-FileCopyrightText: 2023-2025 Andrew Gunnerson
 // SPDX-License-Identifier: GPL-3.0-only

 use std::{
@@ -29,8 +29,8 @@ use crate::{
        padding::{self, ZeroPadding},
    },
    stream::{
-        self, CountingReader, CountingWriter, FromReader, ReadFixedSizeExt, ReadSeekReopen,
-        ToWriter, WriteSeekReopen, WriteZerosExt,
+        self, CountingReader, CountingWriter, FromReader, ReadAt, ReadFixedSizeExt, ReadWriteAt,
+        ToWriter, UserPosFile, WriteZerosExt,
    },
    util::{self, OutOfBoundsError},
 };
@@ -149,10 +149,6 @@ pub enum Error {
    FecVerify(#[source] fec::Error),
    #[error("Failed to repair file with FEC data")]
    FecRepair(#[source] fec::Error),
-    #[error("Failed to reopen input file")]
-    InputReopen(#[source] io::Error),
-    #[error("Failed to reopen output file")]
-    OutputReopen(#[source] io::Error),
    #[error("Failed to compute hash of input file")]
    InputDigest(#[source] io::Error),
    #[error("Failed to read AVB data: {0}")]
@@ -510,10 +506,7 @@ impl HashTreeDescriptor {

    /// Update the root hash, hash tree, and FEC data. The hash tree and FEC
    /// data will be written immediately following the image data at offset
-    /// [`Self::image_size`]. Both `open_input` and `open_output` may be called
-    /// from multiple threads and must return independently seekable handles to
-    /// the same file. It is guaranteed that every thread will read and write
-    /// disjoint file offsets.
+    /// [`Self::image_size`].
    ///
    /// If `ranges` is [`Option::None`], then the hash tree and FEC data are
    /// updated for the whole while. Due to the nature of the file access
@@ -525,42 +518,37 @@ impl HashTreeDescriptor {
    /// that what is specified in order to perform the computations.
    ///
    /// The fields in this instance are updated atomically. No fields are
-    /// updated if an error occurs. The input file can be restored back to its
+    /// updated if an error occurs. The file can be restored back to its
    /// original state by truncating it to [`Self::image_size`].
    pub fn update(
        &mut self,
-        input: &(dyn ReadSeekReopen + Sync),
-        output: &(dyn WriteSeekReopen + Sync),
+        file: &(dyn ReadWriteAt + Sync),
        ranges: Option<&[Range<u64>]>,
        cancel_signal: &AtomicBool,
    ) -> Result<()> {
+        let mut pos_file = UserPosFile::new(file);
+
        let algorithm = digest_algorithm(&self.hash_algorithm)?;
        let hash_tree = HashTree::new(self.data_block_size, algorithm, &self.salt);
+        let tree_offset = self.image_size;
        let (root_digest, hash_tree_data) = match ranges {
            Some(r) => {
-                let mut reader = input.reopen_boxed().map_err(Error::InputReopen)?;
-                reader
-                    .seek(SeekFrom::Start(self.tree_offset))
+                pos_file
+                    .seek(SeekFrom::Start(tree_offset))
                    .map_err(|e| Error::DataRead("HashTree::tree_data", e))?;

-                let mut hash_tree_data = reader
+                let mut hash_tree_data = pos_file
                    .read_vec_exact(self.tree_size as usize)
                    .map_err(|e| Error::DataRead("HashTree::tree_data", e))?;

                let root_digest = hash_tree
-                    .update(
-                        input,
-                        self.image_size,
-                        r,
-                        &mut hash_tree_data,
-                        cancel_signal,
-                    )
+                    .update(file, self.image_size, r, &mut hash_tree_data, cancel_signal)
                    .map_err(Error::HashTreeUpdate)?;

                (root_digest, hash_tree_data)
            }
            None => hash_tree
-                .generate(input, self.image_size, cancel_signal)
+                .generate(file, self.image_size, cancel_signal)
                .map_err(Error::HashTreeGenerate)?,
        };

@@ -569,11 +557,10 @@ impl HashTreeDescriptor {

        let tree_size = hash_tree_data.len() as u64;

-        let mut writer = output.reopen_boxed().map_err(Error::OutputReopen)?;
-        writer
-            .seek(SeekFrom::Start(self.image_size))
+        pos_file
+            .seek(SeekFrom::Start(tree_offset))
            .map_err(|e| Error::DataWrite("HashTree::tree_data", e))?;
-        writer
+        pos_file
            .write_all(&hash_tree_data)
            .map_err(|e| Error::DataWrite("HashTree::tree_data", e))?;

@@ -588,58 +575,54 @@ impl HashTreeDescriptor {

            let parity: u8 = util::try_cast(self.fec_num_roots)
                .map_err(|e| Error::IntOutOfBounds("HashTree::fec_num_roots", e))?;
+            let fec_offset = tree_offset + tree_size;

            let fec_data = if let Some(r) = ranges {
                let mut r_with_hash_tree = r.to_vec();
-                r_with_hash_tree.push(self.tree_offset..self.tree_offset + tree_size);
+                r_with_hash_tree.push(tree_offset..tree_offset + tree_size);

                let (fec, fec_size) = self.get_fec()?;

-                let mut reader = input.reopen_boxed().map_err(Error::InputReopen)?;
-                reader
-                    .seek(SeekFrom::Start(self.fec_offset))
+                pos_file
+                    .seek(SeekFrom::Start(fec_offset))
                    .map_err(|e| Error::DataRead("HashTree::fec_data", e))?;

-                let mut fec_data = reader
+                let mut fec_data = pos_file
                    .read_vec_exact(fec_size)
                    .map_err(|e| Error::DataRead("HashTree::fec_data", e))?;

-                fec.update(input, &r_with_hash_tree, &mut fec_data, cancel_signal)
+                fec.update(file, &r_with_hash_tree, &mut fec_data, cancel_signal)
                    .map_err(Error::FecUpdate)?;

                fec_data
            } else {
                // The FEC covers the hash tree as well.
-                let fec = Fec::new(self.image_size + tree_size, self.data_block_size, parity)
-                    .map_err(Error::FecInit)?;
-                fec.generate(input, cancel_signal)
+                let fec =
+                    Fec::new(fec_offset, self.data_block_size, parity).map_err(Error::FecInit)?;
+                fec.generate(file, cancel_signal)
                    .map_err(Error::FecGenerate)?
            };

-            // Already seeked to FEC.
-            writer
+            pos_file
+                .seek(SeekFrom::Start(fec_offset))
+                .map_err(|e| Error::DataWrite("HashTree::fec_data", e))?;
+            pos_file
                .write_all(&fec_data)
                .map_err(|e| Error::DataWrite("HashTree::fec_data", e))?;

-            self.fec_offset = self.image_size + tree_size;
+            self.fec_offset = fec_offset;
            self.fec_size = fec_data.len() as u64;
        }

-        self.tree_offset = self.image_size;
+        self.tree_offset = tree_offset;
        self.tree_size = tree_size;
        self.root_digest = root_digest;

        Ok(())
    }

-    /// Verify the root hash, hash tree, and FEC data. `open_input` will be
-    /// called from multiple threads and must return independently seekable
-    /// handles to the same file.
-    pub fn verify(
-        &self,
-        input: &(dyn ReadSeekReopen + Sync),
-        cancel_signal: &AtomicBool,
-    ) -> Result<()> {
+    /// Verify the root hash, hash tree, and FEC data.
+    pub fn verify(&self, input: &(dyn ReadAt + Sync), cancel_signal: &AtomicBool) -> Result<()> {
        self.check_offsets()?;

        let algorithm = digest_algorithm(&self.hash_algorithm)?;
@@ -647,7 +630,7 @@ impl HashTreeDescriptor {
        util::check_bounds(self.tree_size, ..=HASH_TREE_MAX_SIZE)
            .map_err(|e| Error::IntOutOfBounds("HashTree::tree_size", e))?;

-        let mut reader = input.reopen_boxed().map_err(Error::InputReopen)?;
+        let mut reader = UserPosFile::new(input);
        reader
            .seek(SeekFrom::Start(self.tree_offset))
            .map_err(|e| Error::DataRead("HashTree::tree_data", e))?;
@@ -684,9 +667,7 @@ impl HashTreeDescriptor {
        Ok(())
    }

-    /// Try to repair errors in the input file using the FEC data. Both
-    /// `open_input` and `open_output` may be called from multiple threads and
-    /// must return independently seekable handles to the same file.
+    /// Try to repair errors in the input file using the FEC data.
    ///
    /// Due to the nature of FEC, when there are too many errors, it's possible
    /// for the data to be miscorrected to a "valid" state. [`Self::verify()`]
@@ -694,8 +675,7 @@ impl HashTreeDescriptor {
    /// actually valid.
    pub fn repair(
        &self,
-        input: &(dyn ReadSeekReopen + Sync),
-        output: &(dyn WriteSeekReopen + Sync),
+        file: &(dyn ReadWriteAt + Sync),
        cancel_signal: &AtomicBool,
    ) -> Result<()> {
        self.check_offsets()?;
@@ -705,7 +685,7 @@ impl HashTreeDescriptor {
            return Err(Error::FecMissing);
        }

-        let mut reader = input.reopen_boxed().map_err(Error::InputReopen)?;
+        let mut reader = UserPosFile::new(file);
        reader
            .seek(SeekFrom::Start(self.fec_offset))
            .map_err(|e| Error::DataRead("HashTree::fec_data", e))?;
@@ -717,7 +697,7 @@ impl HashTreeDescriptor {
            .read_vec_exact(fec_size)
            .map_err(|e| Error::DataRead("HashTree::fec_data", e))?;

-        fec.repair(input, output, &fec_data, cancel_signal)
+        fec.repair(file, &fec_data, cancel_signal)
            .map_err(Error::FecRepair)?;

        Ok(())
@@ -1,11 +1,15 @@
-// SPDX-FileCopyrightText: 2023-2025 Andrew Gunnerson
+// SPDX-FileCopyrightText: 2023-2026 Andrew Gunnerson
 // SPDX-License-Identifier: GPL-3.0-only

 use std::io::{self, Read, Seek, Write};

-use flate2::{Compression, read::GzDecoder, write::GzEncoder};
+use flate2::{
+    Compression,
+    read::{DeflateDecoder, GzDecoder},
+    write::{DeflateEncoder, GzEncoder},
+};
 use lz4_flex::frame::FrameDecoder;
-use lzma_rust2::{CheckType, XZOptions, XZReader, XZWriter};
+use lzma_rust2::{CheckType, LzmaOptions, LzmaReader, LzmaWriter, XzOptions, XzReader, XzWriter};
 use serde::{Deserialize, Serialize};
 use thiserror::Error;

@@ -14,6 +18,14 @@ use crate::stream::ReadFixedSizeExt;
 static GZIP_MAGIC: &[u8; 2] = b"\x1f\x8b";
 static LZ4_LEGACY_MAGIC: &[u8; 4] = b"\x02\x21\x4c\x18";
 static XZ_MAGIC: &[u8; 6] = b"\xfd\x37\x7a\x58\x5a\x00";
+// This is not actually a magic value, but is good enough. The first byte
+// encodes (lc=3, lp=0, pb=2) and the next two bytes are two of the U32LE bytes
+// encoding the dictionary size. If this heuristic is good enough for libmagic,
+// then it's good enough for us too.
+// https://nigeltao.github.io/blog/2024/xz-lzma-part-5-xz.html
+static LZMA_MAGIC: &[u8; 3] = b"\x5d\x00\x00";
+
+const LZMA_MAX_MEMORY_KIB: u32 = 16 * 1024;

 #[derive(Debug, Error)]
 pub enum Error {
@@ -22,9 +34,13 @@ pub enum Error {
    #[error("I/O error when autodetecting compression format")]
    AutoDetect(#[source] io::Error),
    #[error("Failed to initialize legacy LZ4 encoder")]
-    Lz4Init(#[source] io::Error),
+    Lz4EncodeInit(#[source] io::Error),
    #[error("Failed to initialize XZ encoder")]
-    XzInit(#[source] io::Error),
+    XzEncodeInit(#[source] io::Error),
+    #[error("Failed to initialize LZMA decoder")]
+    LzmaDecodeInit(#[source] io::Error),
+    #[error("Failed to initialize LZMA encoder")]
+    LzmaEncodeInit(#[source] io::Error),
 }

 type Result<T> = std::result::Result<T, Error>;
@@ -105,93 +121,140 @@ impl<W: Write> Write for Lz4LegacyEncoder<W> {
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
 pub enum CompressedFormat {
    None,
+    Deflate,
    Gzip,
    Lz4Legacy,
    Xz,
+    Lzma,
 }

-pub enum CompressedReader<'reader, R: Read> {
+pub enum CompressedReader<R: Read> {
    None(R),
+    /// Not autodetected.
+    Deflate(DeflateDecoder<R>),
    Gzip(GzDecoder<R>),
    Lz4(FrameDecoder<R>),
-    Xz(XZReader<'reader, R>),
+    /// Boxed because the [`XzReader`] is nearly 4 KiB.
+    Xz(Box<XzReader<R>>),
+    Lzma(Box<LzmaReader<R>>),
 }

-impl<'reader, R: Read + Seek + 'reader> CompressedReader<'reader, R> {
-    pub fn new(mut reader: R, raw_if_unknown: bool) -> Result<Self> {
-        let magic = reader.read_array_exact::<6>().map_err(Error::AutoDetect)?;
-
-        reader.rewind().map_err(Error::AutoDetect)?;
-
-        if &magic[0..2] == GZIP_MAGIC {
-            Ok(Self::Gzip(GzDecoder::new(reader)))
-        } else if &magic[0..4] == LZ4_LEGACY_MAGIC {
-            Ok(Self::Lz4(FrameDecoder::new(reader)))
-        } else if &magic == XZ_MAGIC {
-            Ok(Self::Xz(XZReader::new(reader, false)))
-        } else if raw_if_unknown {
-            Ok(Self::None(reader))
-        } else {
-            Err(Error::UnknownFormat)
+impl<R: Read> CompressedReader<R> {
+    pub fn with_format(reader: R, format: CompressedFormat) -> Result<Self> {
+        match format {
+            CompressedFormat::None => Ok(Self::None(reader)),
+            CompressedFormat::Deflate => Ok(Self::Deflate(DeflateDecoder::new(reader))),
+            CompressedFormat::Gzip => Ok(Self::Gzip(GzDecoder::new(reader))),
+            CompressedFormat::Lz4Legacy => Ok(Self::Lz4(FrameDecoder::new(reader))),
+            CompressedFormat::Xz => Ok(Self::Xz(Box::new(XzReader::new(reader, false)))),
+            CompressedFormat::Lzma => Ok(Self::Lzma(Box::new(
+                LzmaReader::new_mem_limit(reader, LZMA_MAX_MEMORY_KIB, None)
+                    .map_err(Error::LzmaDecodeInit)?,
+            ))),
        }
    }

    pub fn format(&self) -> CompressedFormat {
        match self {
            Self::None(_) => CompressedFormat::None,
+            Self::Deflate(_) => CompressedFormat::Deflate,
            Self::Gzip(_) => CompressedFormat::Gzip,
            Self::Lz4(_) => CompressedFormat::Lz4Legacy,
            Self::Xz(_) => CompressedFormat::Xz,
+            Self::Lzma(_) => CompressedFormat::Lzma,
        }
    }

    pub fn into_inner(self) -> R {
        match self {
            Self::None(r) => r,
+            Self::Deflate(r) => r.into_inner(),
            Self::Gzip(r) => r.into_inner(),
            Self::Lz4(r) => r.into_inner(),
            Self::Xz(r) => r.into_inner(),
+            Self::Lzma(r) => r.into_inner(),
        }
    }
 }

-impl<'reader, R: Read + 'reader> Read for CompressedReader<'reader, R> {
+impl<R: Read + Seek> CompressedReader<R> {
+    pub fn new(mut reader: R, raw_if_unknown: bool) -> Result<Self> {
+        let magic = reader.read_array_exact::<6>().map_err(Error::AutoDetect)?;
+
+        reader.rewind().map_err(Error::AutoDetect)?;
+
+        let format = if &magic[0..2] == GZIP_MAGIC {
+            CompressedFormat::Gzip
+        } else if &magic[0..4] == LZ4_LEGACY_MAGIC {
+            CompressedFormat::Lz4Legacy
+        } else if &magic == XZ_MAGIC {
+            CompressedFormat::Xz
+        } else if &magic[0..3] == LZMA_MAGIC {
+            CompressedFormat::Lzma
+        } else if raw_if_unknown {
+            CompressedFormat::None
+        } else {
+            return Err(Error::UnknownFormat);
+        };
+
+        Self::with_format(reader, format)
+    }
+}
+
+impl<R: Read> Read for CompressedReader<R> {
    fn read(&mut self, buf: &mut [u8]) -> io::Result<usize> {
        match self {
            Self::None(r) => r.read(buf),
+            Self::Deflate(r) => r.read(buf),
            Self::Gzip(r) => r.read(buf),
            Self::Lz4(r) => r.read(buf),
            Self::Xz(r) => r.read(buf),
+            Self::Lzma(r) => r.read(buf),
        }
    }
 }

 #[allow(clippy::large_enum_variant)]
-pub enum CompressedWriter<'writer, W: Write> {
+pub enum CompressedWriter<W: Write> {
    None(W),
+    Deflate(DeflateEncoder<W>),
    Gzip(GzEncoder<W>),
    Lz4Legacy(Lz4LegacyEncoder<W>),
-    Xz(XZWriter<'writer, W>),
+    Xz(Box<XzWriter<W>>),
+    Lzma(Box<LzmaWriter<W>>),
 }

-impl<'writer, W: Write + 'writer> CompressedWriter<'writer, W> {
+impl<W: Write> CompressedWriter<W> {
    pub fn new(writer: W, format: CompressedFormat) -> Result<Self> {
        match format {
            CompressedFormat::None => Ok(Self::None(writer)),
+            CompressedFormat::Deflate => Ok(Self::Deflate(DeflateEncoder::new(
+                writer,
+                Compression::default(),
+            ))),
            CompressedFormat::Gzip => {
                Ok(Self::Gzip(GzEncoder::new(writer, Compression::default())))
            }
            CompressedFormat::Lz4Legacy => {
-                let encoder = Lz4LegacyEncoder::new(writer).map_err(Error::Lz4Init)?;
+                let encoder = Lz4LegacyEncoder::new(writer).map_err(Error::Lz4EncodeInit)?;
                Ok(Self::Lz4Legacy(encoder))
            }
            CompressedFormat::Xz => {
                // Some kernels are compiled without support for the default CRC64.
-                let mut options = XZOptions::with_preset(6);
+                let mut options = XzOptions::with_preset(6);
                options.set_check_sum_type(CheckType::Crc32);

-                let xz_writer = XZWriter::new(writer, options).map_err(Error::XzInit)?;
-                Ok(Self::Xz(xz_writer))
+                let xz_writer = XzWriter::new(writer, options).map_err(Error::XzEncodeInit)?;
+                Ok(Self::Xz(Box::new(xz_writer)))
+            }
+            CompressedFormat::Lzma => {
+                // Defaults are already (lc=3, lp=0, pb=2) and has preset 6.
+                let options = LzmaOptions::default();
+
+                // We only support streaming output.
+                let lzma_writer = LzmaWriter::new_use_header(writer, &options, None)
+                    .map_err(Error::LzmaEncodeInit)?;
+                Ok(Self::Lzma(Box::new(lzma_writer)))
            }
        }
    }
@@ -199,38 +262,118 @@ impl<'writer, W: Write + 'writer> CompressedWriter<'writer, W> {
    pub fn format(&self) -> CompressedFormat {
        match self {
            Self::None(_) => CompressedFormat::None,
+            Self::Deflate(_) => CompressedFormat::Deflate,
            Self::Gzip(_) => CompressedFormat::Gzip,
            Self::Lz4Legacy(_) => CompressedFormat::Lz4Legacy,
            Self::Xz(_) => CompressedFormat::Xz,
+            Self::Lzma(_) => CompressedFormat::Lzma,
        }
    }

    pub fn finish(self) -> io::Result<W> {
        match self {
            Self::None(w) => Ok(w),
+            Self::Deflate(w) => w.finish(),
            Self::Gzip(w) => w.finish(),
            Self::Lz4Legacy(w) => w.finish(),
            Self::Xz(w) => w.finish(),
+            Self::Lzma(w) => w.finish(),
        }
    }
 }

-impl<'writer, W: Write + 'writer> Write for CompressedWriter<'writer, W> {
+impl<W: Write> Write for CompressedWriter<W> {
    fn write(&mut self, buf: &[u8]) -> io::Result<usize> {
        match self {
            Self::None(w) => w.write(buf),
+            Self::Deflate(w) => w.write(buf),
            Self::Gzip(w) => w.write(buf),
            Self::Lz4Legacy(w) => w.write(buf),
            Self::Xz(w) => w.write(buf),
+            Self::Lzma(w) => w.write(buf),
        }
    }

    fn flush(&mut self) -> io::Result<()> {
        match self {
            Self::None(w) => w.flush(),
+            Self::Deflate(w) => w.flush(),
            Self::Gzip(w) => w.flush(),
            Self::Lz4Legacy(w) => w.flush(),
            Self::Xz(w) => w.flush(),
+            Self::Lzma(w) => w.flush(),
        }
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use std::io::Cursor;
+
+    use rand::Rng;
+
+    use super::*;
+
+    fn round_trip(format: CompressedFormat, can_autodetect: bool) {
+        let mut data = vec![0u8; 1024 * 1024];
+        rand::thread_rng().fill(data.as_mut_slice());
+
+        let mut writer = CompressedWriter::new(Cursor::new(Vec::new()), format).unwrap();
+        writer.write_all(&data).unwrap();
+
+        let mut compressed = writer.finish().unwrap();
+        compressed.rewind().unwrap();
+
+        let mut reader = if can_autodetect {
+            CompressedReader::new(compressed, true).unwrap()
+        } else {
+            CompressedReader::with_format(compressed, format).unwrap()
+        };
+        assert_eq!(reader.format(), format);
+
+        let mut buf = [0u8; 8192];
+        let mut total_read = 0;
+
+        loop {
+            let n = reader.read(&mut buf).unwrap();
+            if n == 0 {
+                break;
+            }
+
+            assert_eq!(&buf[..n], &data[total_read..][..n]);
+            total_read += n;
+        }
+
+        assert_eq!(total_read, data.len());
+    }
+
+    #[test]
+    fn round_trip_none() {
+        round_trip(CompressedFormat::None, true);
+    }
+
+    #[test]
+    fn round_trip_deflate() {
+        round_trip(CompressedFormat::Deflate, false);
+    }
+
+    #[test]
+    fn round_trip_gzip() {
+        round_trip(CompressedFormat::Gzip, true);
+    }
+
+    #[test]
+    fn round_trip_lz4_legacy() {
+        round_trip(CompressedFormat::Lz4Legacy, true);
+    }
+
+    #[test]
+    fn round_trip_xz() {
+        round_trip(CompressedFormat::Xz, true);
+    }
+
+    #[test]
+    fn round_trip_lzma() {
+        round_trip(CompressedFormat::Lzma, true);
+    }
+}
@@ -89,12 +89,10 @@ impl fmt::Debug for RawHexU32 {
 impl From<u32> for RawHexU32 {
    fn from(mut value: u32) -> Self {
        let mut buf = [b'0'; 8];
-        let mut index = 7;

-        while value != 0 {
-            buf[index] = char::from_digit(value & 0xf, 16).unwrap() as u8;
+        for c in buf.iter_mut().rev() {
+            *c = char::from_digit(value & 0xf, 16).unwrap() as u8;
            value >>= 4;
-            index -= 1;
        }

        Self(buf)
@@ -777,8 +775,8 @@ pub fn assign_inodes(entries: &mut [CpioEntry], missing_only: bool) -> Result<()
    // (dev maj, dev min) -> (inode set, last assigned inode)
    let mut inodes: HashMap<(u32, u32), (HashSet<u32>, u32)> = HashMap::new();

-    if missing_only {
-        for entry in &mut *entries {
+    for entry in &mut *entries {
+        if missing_only {
            if entry.inode != 0 {
                let key = (entry.dev_maj, entry.dev_min);
                let (set, last) = inodes.entry(key).or_default();
@@ -786,6 +784,8 @@ pub fn assign_inodes(entries: &mut [CpioEntry], missing_only: bool) -> Result<()
                set.insert(entry.inode);
                *last = (*last).max(entry.inode);
            }
+        } else {
+            entry.inode = 0;
        }
    }

@@ -837,3 +837,56 @@ pub fn save(

    Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_assign_inodes_missing() {
+        let mut entries = [
+            CpioEntry::new_directory(b"a", 0o755),
+            CpioEntry::new_directory(b"b", 0o755),
+            CpioEntry::new_directory(b"c", 0o755),
+            CpioEntry::new_directory(b"d", 0o755),
+            CpioEntry::new_directory(b"e", 0o755),
+        ];
+        entries[0].inode = 999;
+        entries[2].inode = 500;
+        entries[3].dev_maj = 1;
+        entries[3].dev_min = 1;
+
+        assign_inodes(&mut entries, true).unwrap();
+
+        assert_eq!(entries[0].inode, 999);
+        assert_eq!(entries[1].inode, 1000);
+        assert_eq!(entries[2].inode, 500);
+        assert_eq!(entries[3].inode, 300000);
+        assert_eq!(entries[4].inode, 1001);
+    }
+
+    #[test]
+    fn test_assign_inodes_reassign() {
+        let mut entries = [
+            CpioEntry::new_directory(b"a", 0o755),
+            CpioEntry::new_directory(b"b", 0o755),
+            CpioEntry::new_directory(b"c", 0o755),
+            CpioEntry::new_directory(b"d", 0o755),
+            CpioEntry::new_directory(b"e", 0o755),
+        ];
+        entries[0].dev_maj = 1;
+        entries[0].dev_min = 1;
+        entries[0].inode = 1000;
+        entries[1].inode = 1000;
+        entries[2].inode = 500;
+        entries[3].dev_maj = 1;
+        entries[3].dev_min = 1;
+
+        assign_inodes(&mut entries, false).unwrap();
+
+        assert_eq!(entries[0].inode, 300000);
+        assert_eq!(entries[1].inode, 300000);
+        assert_eq!(entries[2].inode, 300001);
+        assert_eq!(entries[3].inode, 300001);
+    }
+}
@@ -1,10 +1,10 @@
-// SPDX-FileCopyrightText: 2023-2024 Andrew Gunnerson
+// SPDX-FileCopyrightText: 2023-2025 Andrew Gunnerson
 // SPDX-License-Identifier: GPL-3.0-only

 use std::{
    collections::HashSet,
    fmt,
-    io::{self, Read, Seek, SeekFrom, Write},
+    io::{self, Read, SeekFrom, Write},
    mem,
    ops::Range,
    sync::atomic::AtomicBool,
@@ -21,7 +21,10 @@ use zerocopy_derive::{FromBytes, Immutable, IntoBytes, KnownLayout, Unaligned};

 use crate::{
    format::verityrs,
-    stream::{self, FromReader, ReadSeekReopen, ToWriter, WriteSeekReopen, WriteZerosExt},
+    stream::{
+        self, FromReader, ReadAt, ReadSeek, ReadWriteAt, ReadWriteSeek, ToWriter, UserPosFile,
+        WriteSeek, WriteZerosExt,
+    },
    util::{self, NumBytes, OutOfBoundsError},
 };

@@ -68,10 +71,8 @@ pub enum Error {
    IntOutOfBounds(&'static str, #[source] OutOfBoundsError),
    #[error("{0:?} overflowed integer bounds during calculations")]
    IntOverflow(&'static str),
-    #[error("Failed to reopen input file")]
-    InputReopen(#[source] io::Error),
-    #[error("Failed to reopen output file")]
-    OutputReopen(#[source] io::Error),
+    #[error("Failed to get input file size")]
+    InputSize(#[source] io::Error),
    #[error("Failed to read FEC data: {0}")]
    DataRead(&'static str, #[source] io::Error),
    #[error("Failed to write FEC data: {0}")]
@@ -248,7 +249,7 @@ impl Fec {
    /// slice in the file offset grid.
    fn read_seq_block(
        &self,
-        mut reader: impl Read + Seek,
+        reader: &mut dyn ReadSeek,
        offset: u64,
        buf: &mut [u8],
    ) -> io::Result<()> {
@@ -276,7 +277,7 @@ impl Fec {
    /// slice in the file offset grid.
    fn write_seq_block(
        &self,
-        mut writer: impl Write + Seek,
+        writer: &mut dyn WriteSeek,
        offset: u64,
        buf: &[u8],
    ) -> io::Result<()> {
@@ -299,7 +300,7 @@ impl Fec {

    /// Read the nth round from the file. The data is laid out sequentially
    /// (row-by-row).
-    fn read_round(&self, mut reader: impl Read + Seek, round: u64) -> io::Result<Vec<u8>> {
+    fn read_round(&self, reader: &mut dyn ReadSeek, round: u64) -> io::Result<Vec<u8>> {
        let mut grid = vec![0u8; usize::from(self.rs_k) * self.block_size as usize];

        for row in 0..self.rs_k {
@@ -309,7 +310,7 @@ impl Fec {
            let row_end = row_start + self.block_size as usize;
            let row_slice = &mut grid[row_start..row_end];

-            self.read_seq_block(&mut reader, interleaved_offset, row_slice)?;
+            self.read_seq_block(reader, interleaved_offset, row_slice)?;
        }

        Ok(grid)
@@ -317,12 +318,7 @@ impl Fec {

    /// Write the nth round to the file. The data is expected to be laid out
    /// sequentially (row-by-row).
-    fn write_round(
-        &self,
-        mut writer: impl Write + Seek,
-        round: u64,
-        grid: &[u8],
-    ) -> io::Result<()> {
+    fn write_round(&self, writer: &mut dyn WriteSeek, round: u64, grid: &[u8]) -> io::Result<()> {
        for row in 0..self.rs_k {
            let interleaved_offset =
                round * u64::from(self.rs_k) * u64::from(self.block_size) + u64::from(row);
@@ -330,7 +326,7 @@ impl Fec {
            let row_end = row_start + self.block_size as usize;
            let row_slice = &grid[row_start..row_end];

-            self.write_seq_block(&mut writer, interleaved_offset, row_slice)?;
+            self.write_seq_block(writer, interleaved_offset, row_slice)?;
        }

        Ok(())
@@ -360,7 +356,7 @@ impl Fec {
    /// Generate FEC data for a single round.
    fn generate_one_round(
        &self,
-        reader: impl Read + Seek,
+        reader: &mut dyn ReadSeek,
        round: u64,
        fec: &mut [u8],
    ) -> Result<()> {
@@ -386,7 +382,7 @@ impl Fec {
    }

    /// Verify file data for a single round.
-    fn verify_one_round(&self, reader: impl Read + Seek, round: u64, fec: &[u8]) -> Result<()> {
+    fn verify_one_round(&self, reader: &mut dyn ReadSeek, round: u64, fec: &[u8]) -> Result<()> {
        assert_eq!(
            fec.len(),
            usize::from(self.parity()) * self.block_size as usize,
@@ -414,8 +410,7 @@ impl Fec {
    /// Repair file data for a single round.
    fn repair_one_round(
        &self,
-        reader: impl Read + Seek,
-        writer: impl Write + Seek,
+        file: &mut dyn ReadWriteSeek,
        round: u64,
        fec: &[u8],
    ) -> Result<u64> {
@@ -426,7 +421,7 @@ impl Fec {
        );

        let mut grid = self
-            .read_round(reader, round)
+            .read_round(file, round)
            .map_err(|e| Error::DataRead("round", e))?;
        let correct_errors = verityrs::FN_CORRECT_ERRORS[&self.rs_k];
        let parity = usize::from(self.parity());
@@ -445,7 +440,7 @@ impl Fec {
        }

        if num_corrected > 0 {
-            self.write_round(writer, round, &grid)
+            self.write_round(file, round, &grid)
                .map_err(|e| Error::DataWrite("round", e))?;
        }

@@ -458,7 +453,7 @@ impl Fec {
    /// This function is multithreaded and uses rayon's global thread pool.
    pub fn generate(
        &self,
-        input: &(dyn ReadSeekReopen + Sync),
+        input: &(dyn ReadAt + Sync),
        cancel_signal: &AtomicBool,
    ) -> Result<Vec<u8>> {
        let fec_size = self.fec_size();
@@ -466,13 +461,12 @@ impl Fec {

        fec.par_chunks_exact_mut(fec_size / self.rounds as usize)
            .enumerate()
-            .map(|(round, buf)| -> Result<()> {
-                stream::check_cancel(cancel_signal).map_err(Error::InputReopen)?;
+            .try_for_each(|(round, buf)| -> Result<()> {
+                stream::check_cancel(cancel_signal).map_err(|e| Error::DataRead("(init)", e))?;

-                let reader = input.reopen_boxed().map_err(Error::InputReopen)?;
-                self.generate_one_round(reader, round as u64, buf)
-            })
-            .collect::<Result<()>>()?;
+                let mut reader = UserPosFile::new(input);
+                self.generate_one_round(&mut reader, round as u64, buf)
+            })?;

        Ok(fec)
    }
@@ -482,7 +476,7 @@ impl Fec {
    /// This function is multithreaded and uses rayon's global thread pool.
    pub fn update(
        &self,
-        input: &(dyn ReadSeekReopen + Sync),
+        input: &(dyn ReadAt + Sync),
        ranges: &[Range<u64>],
        fec: &mut [u8],
        cancel_signal: &AtomicBool,
@@ -501,15 +495,12 @@ impl Fec {
        fec.par_chunks_exact_mut(fec_size / self.rounds as usize)
            .enumerate()
            .filter(|(round, _)| rounds_to_update.contains(&(*round as u64)))
-            .map(|(round, buf)| -> Result<()> {
-                stream::check_cancel(cancel_signal).map_err(Error::InputReopen)?;
+            .try_for_each(|(round, buf)| -> Result<()> {
+                stream::check_cancel(cancel_signal).map_err(|e| Error::DataRead("(init)", e))?;

-                let reader = input.reopen_boxed().map_err(Error::InputReopen)?;
-                self.generate_one_round(reader, round as u64, buf)
+                let mut reader = UserPosFile::new(input);
+                self.generate_one_round(&mut reader, round as u64, buf)
            })
-            .collect::<Result<()>>()?;
-
-        Ok(())
    }

    /// Verify that the file contains no errors. This is significantly faster
@@ -519,7 +510,7 @@ impl Fec {
    /// This function is multithreaded and uses rayon's global thread pool.
    pub fn verify(
        &self,
-        input: &(dyn ReadSeekReopen + Sync),
+        input: &(dyn ReadAt + Sync),
        fec: &[u8],
        cancel_signal: &AtomicBool,
    ) -> Result<()> {
@@ -534,15 +525,12 @@ impl Fec {

        fec.par_chunks_exact(fec_size / self.rounds as usize)
            .enumerate()
-            .map(|(round, buf)| -> Result<()> {
-                stream::check_cancel(cancel_signal).map_err(Error::InputReopen)?;
+            .try_for_each(|(round, buf)| -> Result<()> {
+                stream::check_cancel(cancel_signal).map_err(|e| Error::DataRead("(init)", e))?;

-                let reader = input.reopen_boxed().map_err(Error::InputReopen)?;
-                self.verify_one_round(reader, round as u64, buf)
+                let mut reader = UserPosFile::new(input);
+                self.verify_one_round(&mut reader, round as u64, buf)
            })
-            .collect::<Result<()>>()?;
-
-        Ok(())
    }

    /// Repair the file. Up to `parity / 2` bytes per codeword can be repaired.
@@ -558,8 +546,7 @@ impl Fec {
    /// This function is multithreaded and uses rayon's global thread pool.
    pub fn repair(
        &self,
-        input: &(dyn ReadSeekReopen + Sync),
-        output: &(dyn WriteSeekReopen + Sync),
+        file: &(dyn ReadWriteAt + Sync),
        fec: &[u8],
        cancel_signal: &AtomicBool,
    ) -> Result<u64> {
@@ -576,15 +563,12 @@ impl Fec {
            .par_chunks_exact(fec_size / self.rounds as usize)
            .enumerate()
            .map(|(round, buf)| -> Result<u64> {
-                stream::check_cancel(cancel_signal).map_err(Error::InputReopen)?;
+                stream::check_cancel(cancel_signal).map_err(|e| Error::DataRead("(init)", e))?;

-                let reader = input.reopen_boxed().map_err(Error::InputReopen)?;
-                let writer = output.reopen_boxed().map_err(Error::OutputReopen)?;
-                self.repair_one_round(reader, writer, round as u64, buf)
+                let mut file = UserPosFile::new(file);
+                self.repair_one_round(&mut file, round as u64, buf)
            })
-            .collect::<Result<Vec<u64>>>()?
-            .into_iter()
-            .sum();
+            .try_reduce(|| 0, |prev, cur| Ok(prev + cur))?;

        Ok(num_corrected)
    }
@@ -636,14 +620,11 @@ impl FecImage {
    /// Generate FEC data for a file. `parity` is the number of parity bytes per
    /// 255-byte Reed-Solomon codeword.
    pub fn generate(
-        input: &(dyn ReadSeekReopen + Sync),
+        input: &(dyn ReadAt + Sync),
        parity: u8,
        cancel_signal: &AtomicBool,
    ) -> Result<Self> {
-        let data_size = input
-            .reopen_boxed()
-            .and_then(|mut f| f.seek(SeekFrom::End(0)))
-            .map_err(Error::InputReopen)?;
+        let data_size = input.file_len().map_err(Error::InputSize)?;
        let fec = Fec::new(data_size, FEC_BLOCK_SIZE as u32, parity)?;
        let fec_data = fec.generate(input, cancel_signal)?;

@@ -657,7 +638,7 @@ impl FecImage {
    /// Update FEC data coreesponding to the specified file ranges.
    pub fn update(
        &mut self,
-        input: &(dyn ReadSeekReopen + Sync),
+        input: &(dyn ReadAt + Sync),
        ranges: &[Range<u64>],
        cancel_signal: &AtomicBool,
    ) -> Result<()> {
@@ -667,11 +648,7 @@ impl FecImage {

    /// Check that a file contains no errors. This is significantly faster than
    /// [`Self::repair()`] if performing a repair is not necessary.
-    pub fn verify(
-        &self,
-        input: &(dyn ReadSeekReopen + Sync),
-        cancel_signal: &AtomicBool,
-    ) -> Result<()> {
+    pub fn verify(&self, input: &(dyn ReadAt + Sync), cancel_signal: &AtomicBool) -> Result<()> {
        let fec = Fec::new(self.data_size, FEC_BLOCK_SIZE as u32, self.parity)?;
        fec.verify(input, &self.fec, cancel_signal)
    }
@@ -687,18 +664,13 @@ impl FecImage {
    /// possible for there to be a false positive where the corrupted codeword
    /// is "corrected" into an incorrect value. FEC error detection is not a
    /// replacement for cryptographically secure digests.
-    ///
-    /// The inputs and outputs should point to the same underlying file because
-    /// only regions where errors are corrected are written. It is guaranteed
-    /// that multiple threads will always read and write disjoint file offsets.
    pub fn repair(
        &self,
-        input: &(dyn ReadSeekReopen + Sync),
-        output: &(dyn WriteSeekReopen + Sync),
+        file: &(dyn ReadWriteAt + Sync),
        cancel_signal: &AtomicBool,
    ) -> Result<u64> {
        let fec = Fec::new(self.data_size, FEC_BLOCK_SIZE as u32, self.parity)?;
-        fec.repair(input, output, &self.fec, cancel_signal)
+        fec.repair(file, &self.fec, cancel_signal)
    }

    /// Build one instance of the FEC header. The caller is responsible for
@@ -833,7 +805,7 @@ mod tests {
    use assert_matches::assert_matches;
    use rand::RngCore;

-    use crate::stream::SharedCursor;
+    use crate::stream::MutexFile;

    use super::*;

@@ -862,7 +834,7 @@ mod tests {
        );
    }

-    fn corrupt_byte(file: &mut SharedCursor, offset: u64) {
+    fn corrupt_byte(file: &mut UserPosFile<&MutexFile<Cursor<Vec<u8>>>>, offset: u64) {
        let mut buf = [0u8; 1];

        file.seek(SeekFrom::Start(offset)).unwrap();
@@ -881,11 +853,13 @@ mod tests {
        // Generate data big enough to span multiple rounds, but don't fill the
        // offset grid to ensure that the out-of-bounds-is-0 behavior works.
        let size = usize::from(rs_k) * block_size as usize * 3 - block_size as usize;
-        let mut file = SharedCursor::default();
+        let file = MutexFile::new(Cursor::new(Vec::new()));
+        let mut pos_file = UserPosFile::new(&file);
+
        let orig_digest = {
            let mut buf = vec![0u8; size];
            rand::thread_rng().fill_bytes(&mut buf);
-            file.write_all(&buf).unwrap();
+            pos_file.write_all(&buf).unwrap();
            ring::digest::digest(&ring::digest::SHA256, &buf)
        };

@@ -901,7 +875,7 @@ mod tests {
        fec.verify(&file, &fec_data, &cancel_signal).unwrap();

        // Verify that errors are detected.
-        corrupt_byte(&mut file, 0);
+        corrupt_byte(&mut pos_file, 0);
        assert_matches!(
            fec.verify(&file, &fec_data, &cancel_signal),
            Err(Error::HasErrors)
@@ -909,24 +883,24 @@ mod tests {

        // Corrupt one byte in every single codeword.
        for offset in 1..num_codewords {
-            corrupt_byte(&mut file, offset as u64);
+            corrupt_byte(&mut pos_file, offset as u64);
        }

        // Verify that all the single-byte errors can be fixed. We don't test
        // for Error::TooManyErrors because of the chance of false positives due
        // to the nature of RS.
-        fec.repair(&file, &file, &fec_data, &cancel_signal).unwrap();
+        fec.repair(&file, &fec_data, &cancel_signal).unwrap();

        let repaired_digest = {
            let mut buf = Vec::new();
-            file.rewind().unwrap();
-            file.read_to_end(&mut buf).unwrap();
+            pos_file.rewind().unwrap();
+            pos_file.read_to_end(&mut buf).unwrap();
            ring::digest::digest(&ring::digest::SHA256, &buf)
        };
        assert_eq!(repaired_digest.as_ref(), orig_digest.as_ref());

        // Intentionally update some data.
-        corrupt_byte(&mut file, 0);
+        corrupt_byte(&mut pos_file, 0);
        let mut fec_data_updated = fec_data.clone();
        let fec_data = fec.generate(&file, &cancel_signal).unwrap();
        fec.update(&file, &[0..1], &mut fec_data_updated, &cancel_signal)
@@ -948,11 +922,12 @@ mod tests {
    fn round_trip_image() {
        let cancel_signal = Arc::new(AtomicBool::new(false));

-        let mut file = SharedCursor::default();
+        let file = MutexFile::new(Cursor::new(Vec::new()));
+
        {
            let mut buf = [0u8; FEC_BLOCK_SIZE];
            rand::thread_rng().fill_bytes(&mut buf);
-            file.write_all(&buf).unwrap();
+            UserPosFile::new(&file).write_all(&buf).unwrap();
        }

        let image = FecImage::generate(&file, 2, &cancel_signal).unwrap();
@@ -3,7 +3,7 @@

 use std::{
    fmt,
-    io::{self, Cursor, Read, SeekFrom, Write},
+    io::{self, Cursor, Read, Seek, SeekFrom, Write},
    ops::Range,
    str,
    sync::atomic::AtomicBool,
@@ -24,7 +24,7 @@ use crate::{
        avb,
        padding::{self, ZeroPadding},
    },
-    stream::{self, FromReader, ReadFixedSizeExt, ReadSeekReopen, ToWriter},
+    stream::{self, FromReader, ReadAt, ReadFixedSizeExt, ToWriter, UserPosFile},
    util::{self, NumBytes, OutOfBoundsError},
 };

@@ -50,8 +50,8 @@ pub enum Error {
    IntOutOfBounds(&'static str, #[source] OutOfBoundsError),
    #[error("{0:?} overflowed integer bounds during calculations")]
    IntOverflow(&'static str),
-    #[error("Failed to reopen input file")]
-    InputReopen(#[source] io::Error),
+    #[error("Failed to get input file size")]
+    InputSize(#[source] io::Error),
    #[error("Failed to compute hash tree of input file")]
    InputDigest(#[source] io::Error),
    #[error("Failed to read hash tree data: {0}")]
@@ -189,7 +189,7 @@ impl HashTree {
    /// Hash one full level in parallel.
    fn hash_one_level_parallel(
        &self,
-        input: &(dyn ReadSeekReopen + Sync),
+        input: &(dyn ReadAt + Sync),
        size: u64,
        level_data: &mut [u8],
        cancel_signal: &AtomicBool,
@@ -207,26 +207,23 @@ impl HashTree {
        level_data
            .par_chunks_mut(digest_size * multiplier as usize)
            .enumerate()
-            .map(|(chunk, out_data)| -> io::Result<()> {
+            .try_for_each(|(chunk, out_data)| -> io::Result<()> {
                let digests = out_data.len() / digest_size;
                let in_start = (chunk as u64) * multiplier * u64::from(self.block_size);
                let in_size = ((digests as u64) * u64::from(self.block_size)).min(size - in_start);

-                let mut reader = input.reopen_boxed()?;
+                let mut reader = UserPosFile::new(input);
                reader.seek(SeekFrom::Start(in_start))?;

                self.hash_partial_level(reader, in_size, out_data, cancel_signal)
            })
-            .collect::<io::Result<()>>()?;
-
-        Ok(())
    }

    /// Update parts of the hash tree level corresponding to the specified
    /// blocks.
    fn hash_partial_level_parallel(
        &self,
-        input: &(dyn ReadSeekReopen + Sync),
+        input: &(dyn ReadAt + Sync),
        size: u64,
        block_ranges: &[Range<u64>],
        level_data: &mut [u8],
@@ -239,18 +236,15 @@ impl HashTree {
            .par_chunks_exact_mut(digest_size)
            .enumerate()
            .filter(|(chunk, _)| util::ranges_contains(block_ranges, &(*chunk as u64)))
-            .map(|(chunk, out_data)| -> io::Result<()> {
+            .try_for_each(|(chunk, out_data)| -> io::Result<()> {
                let in_start = (chunk as u64) * u64::from(self.block_size);
                let in_size = u64::from(self.block_size).min(size - in_start);

-                let mut reader = input.reopen_boxed()?;
+                let mut reader = UserPosFile::new(input);
                reader.seek(SeekFrom::Start(in_start))?;

                self.hash_partial_level(reader, in_size, out_data, cancel_signal)
            })
-            .collect::<io::Result<()>>()?;
-
-        Ok(())
    }

    /// Compute the hash tree and return the root digest. If `ranges` is
@@ -261,7 +255,7 @@ impl HashTree {
    /// offset of the leaf layer of the tree must equal `hash_tree_data`'s size.
    fn calculate(
        &self,
-        input: &(dyn ReadSeekReopen + Sync),
+        input: &(dyn ReadAt + Sync),
        image_size: u64,
        ranges: Option<&[Range<u64>]>,
        level_offsets: &[Range<usize>],
@@ -270,7 +264,7 @@ impl HashTree {
    ) -> Result<Vec<u8>> {
        // Small files are hashed directly.
        if image_size <= u64::from(self.block_size) {
-            let mut reader = input.reopen_boxed().map_err(Error::InputReopen)?;
+            let mut reader = UserPosFile::new(input);
            let buf = reader
                .read_vec_exact(image_size as usize)
                .map_err(Error::InputDigest)?;
@@ -334,7 +328,7 @@ impl HashTree {
    /// hash tree data.
    pub fn generate(
        &self,
-        input: &(dyn ReadSeekReopen + Sync),
+        input: &(dyn ReadAt + Sync),
        image_size: u64,
        cancel_signal: &AtomicBool,
    ) -> Result<(Vec<u8>, Vec<u8>)> {
@@ -358,7 +352,7 @@ impl HashTree {
    /// Returns the new root digest.
    pub fn update(
        &self,
-        input: &(dyn ReadSeekReopen + Sync),
+        input: &(dyn ReadAt + Sync),
        image_size: u64,
        ranges: &[Range<u64>],
        hash_tree_data: &mut [u8],
@@ -387,7 +381,7 @@ impl HashTree {
    /// Verify that the file contains no errors.
    pub fn verify(
        &self,
-        input: &(dyn ReadSeekReopen + Sync),
+        input: &(dyn ReadAt + Sync),
        image_size: u64,
        root_digest: &[u8],
        hash_tree_data: &[u8],
@@ -499,16 +493,13 @@ impl HashTreeImage {

    /// Generate hash tree data for a file.
    pub fn generate(
-        input: &(dyn ReadSeekReopen + Sync),
+        input: &(dyn ReadAt + Sync),
        block_size: u32,
        algorithm: &str,
        salt: &[u8],
        cancel_signal: &AtomicBool,
    ) -> Result<Self> {
-        let image_size = input
-            .reopen_boxed()
-            .and_then(|mut f| f.seek(SeekFrom::End(0)))
-            .map_err(Error::InputReopen)?;
+        let image_size = input.file_len().map_err(Error::InputSize)?;
        let digest_algorithm = Self::digest_algorithm(algorithm)?;
        let hash_tree = HashTree::new(block_size, digest_algorithm, salt);
        let (root_digest, hash_tree_data) = hash_tree.generate(input, image_size, cancel_signal)?;
@@ -526,7 +517,7 @@ impl HashTreeImage {
    /// Update hash tree data coreesponding to the specified file ranges.
    pub fn update(
        &mut self,
-        input: &(dyn ReadSeekReopen + Sync),
+        input: &(dyn ReadAt + Sync),
        ranges: &[Range<u64>],
        cancel_signal: &AtomicBool,
    ) -> Result<()> {
@@ -545,11 +536,7 @@ impl HashTreeImage {
    }

    /// Check that a file contains no errors.
-    pub fn verify(
-        &self,
-        input: &(dyn ReadSeekReopen + Sync),
-        cancel_signal: &AtomicBool,
-    ) -> Result<()> {
+    pub fn verify(&self, input: &(dyn ReadAt + Sync), cancel_signal: &AtomicBool) -> Result<()> {
        let digest_algorithm = Self::digest_algorithm(&self.algorithm)?;
        let hash_tree = HashTree::new(self.block_size, digest_algorithm, &self.salt);

@@ -656,7 +643,7 @@ mod tests {

    use assert_matches::assert_matches;

-    use crate::stream::SharedCursor;
+    use crate::stream::MutexFile;

    use super::*;

@@ -697,7 +684,8 @@ mod tests {
    fn generate_update_verify() {
        let cancel_signal = AtomicBool::new(false);
        let hash_tree = HashTree::new(64, &ring::digest::SHA256, b"Salt");
-        let mut input = SharedCursor::new();
+        let input = MutexFile::new(Cursor::new(Vec::new()));
+        let mut pos_input = UserPosFile::new(&input);

        // Try input smaller than one block.
        let (root_digest, hash_tree_data) = hash_tree.generate(&input, 0, &cancel_signal).unwrap();
@@ -714,7 +702,7 @@ mod tests {

        // Try larger input that spans multiple blocks are results in an actual
        // hash tree being created.
-        input.write_all(&b"Data".repeat(25)).unwrap();
+        pos_input.write_all(&b"Data".repeat(25)).unwrap();

        let (root_digest, mut hash_tree_data) =
            hash_tree.generate(&input, 100, &cancel_signal).unwrap();
@@ -738,8 +726,8 @@ mod tests {
        );

        // Change some data and update the hash tree.
-        input.rewind().unwrap();
-        input.write_all(b"Changed").unwrap();
+        pos_input.rewind().unwrap();
+        pos_input.write_all(b"Changed").unwrap();

        let root_digest = hash_tree
            .update(&input, 100, &[0..7], &mut hash_tree_data, &cancel_signal)
@@ -775,8 +763,8 @@ mod tests {
            .unwrap();

        // But not if the data is corrupted.
-        input.rewind().unwrap();
-        input.write_all(b"Bad").unwrap();
+        pos_input.rewind().unwrap();
+        pos_input.write_all(b"Bad").unwrap();

        hash_tree
            .verify(&input, 100, &root_digest, &hash_tree_data, &cancel_signal)
@@ -54,7 +54,7 @@ const PARTITION_RESERVED_BYTES: u32 = 4096;

 /// Maximum allowed size of [`RawGeometry::metadata_max_size`] to prevent the
 /// memory usage from blowing up.
-const METADATA_MAX_SIZE: u32 = 128 * 1024;
+const METADATA_MAX_SIZE: u32 = 512 * 1024;

 #[derive(Debug, Error)]
 pub enum Error {
@@ -118,8 +118,6 @@ pub enum Error {
    },
    #[error("Partition {name:?}: Extent indices too large")]
    PartitionExtentIndicesTooLarge { name: DebugString },
-    #[error("Partition {name:?}: Extent indices set on empty image")]
-    PartitionExtentIndicesEmptyImage { name: DebugString },
    #[error("Partition {name:?}: Extent index too large")]
    PartitionExtentIndexTooLarge { name: DebugString },
    #[error("Partition {name:?}: Extent count too large")]
@@ -674,7 +672,6 @@ impl RawPartition {
    /// [`RawPartitionGroup::validate`] do not.
    fn validate(
        &self,
-        image_type: ImageType,
        header: &RawHeader,
        extents: &[RawExtent],
        groups: &[RawPartitionGroup],
@@ -695,26 +692,15 @@ impl RawPartition {
            });
        }

-        match image_type {
-            ImageType::Normal => {
-                if self
-                    .first_extent_index
-                    .get()
-                    .checked_add(self.num_extents.get())
-                    .is_none_or(|n| n as usize > extents.len())
-                {
-                    return Err(Error::PartitionExtentIndicesTooLarge {
-                        name: DebugString::new(self.name),
-                    });
-                }
-            }
-            ImageType::Empty => {
-                if self.first_extent_index.get() != 0 || self.num_extents.get() != 0 {
-                    return Err(Error::PartitionExtentIndicesEmptyImage {
-                        name: DebugString::new(self.name),
-                    });
-                }
-            }
+        if self
+            .first_extent_index
+            .get()
+            .checked_add(self.num_extents.get())
+            .is_none_or(|n| n as usize > extents.len())
+        {
+            return Err(Error::PartitionExtentIndicesTooLarge {
+                name: DebugString::new(self.name),
+            });
        }

        if self.group_index.get() as usize >= groups.len() {
@@ -971,7 +957,7 @@ struct RawMetadataSlot {
 impl RawMetadataSlot {
    /// Ensure that all fields are semantically valid and can be used without
    /// further checks.
-    fn validate(&self, image_type: ImageType, geometry: &RawGeometry) -> Result<()> {
+    fn validate(&self, geometry: &RawGeometry) -> Result<()> {
        self.header.validate(geometry)?;

        for (len, descriptor, name) in [
@@ -1032,7 +1018,7 @@ impl RawMetadataSlot {
        }

        for partition in &self.partitions {
-            partition.validate(image_type, &self.header, &self.extents, &self.groups)?;
+            partition.validate(&self.header, &self.extents, &self.groups)?;
        }

        for (i, group) in self.groups.iter().enumerate() {
@@ -1111,11 +1097,7 @@ impl RawMetadata {
    /// Read a single [`RawMetadataSlot`], including the header and all tables.
    /// This does not read the extra padding between the end of the last table
    /// and [`RawGeometry::metadata_max_size`].
-    fn read_metadata(
-        mut reader: impl Read,
-        image_type: ImageType,
-        geometry: &RawGeometry,
-    ) -> Result<RawMetadataSlot> {
+    fn read_metadata(mut reader: impl Read, geometry: &RawGeometry) -> Result<RawMetadataSlot> {
        let mut header = RawHeader::new_zeroed();

        reader
@@ -1155,7 +1137,7 @@ impl RawMetadata {
            block_devices: block_devices.to_vec(),
        };

-        slot.validate(image_type, geometry)?;
+        slot.validate(geometry)?;

        Ok(slot)
    }
@@ -1194,7 +1176,7 @@ impl RawMetadata {
                }
            }

-            slot.validate(self.image_type, &self.geometry)?;
+            slot.validate(&self.geometry)?;
        }

        Ok(())
@@ -1229,7 +1211,7 @@ impl<R: Read> FromReader<R> for RawMetadata {
                        .stream_position()
                        .map_err(|e| Error::DataRead("orig_offset", e))?;

-                    match Self::read_metadata(&mut reader, image_type, &geometry) {
+                    match Self::read_metadata(&mut reader, &geometry) {
                        Ok(m) => *slot = Some(m),
                        Err(e @ Error::DataRead(_, _)) => return Err(e),
                        Err(e) => last_err = Some(e),
@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: GPL-3.0-only

 use std::{
+    borrow::Cow,
    cmp::Ordering,
    collections::BTreeMap,
    fmt::{self, Write as _},
@@ -17,16 +18,16 @@ use cms::signed_data::SignedData;
 use const_oid::{ObjectIdentifier, db::rfc5912};
 use memchr::memmem;
 use prost::Message;
+use rawzip::{CompressionMethod, RECOMMENDED_BUFFER_SIZE, ZipArchive, ZipArchiveWriter};
 use ring::digest::{Algorithm, Context};
 use thiserror::Error;
 use x509_cert::{Certificate, der::Encode};
-use zip::{CompressionMethod, DateTime, ZipArchive, result::ZipError, write::SimpleFileOptions};

 use crate::{
    crypto::{self, RsaPublicKeyExt, RsaSigningKey, SignatureAlgorithm},
    format::{
        payload::{self, PayloadHeader},
-        zip::ZipWriterWrapper,
+        zip::{self, ZipEntriesSafeExt, ZipFileHeaderRecordExt},
    },
    protobuf::build::tools::releasetools::{OtaMetadata, ota_metadata::OtaType},
    stream::{self, FromReader, HashingReader, HashingWriter, ReadFixedSizeExt},
@@ -91,17 +92,21 @@ pub enum Error {
    #[error("Failed to decode OTA metadata protobuf message")]
    MetadataDecode(#[source] prost::DecodeError),
    #[error("Failed to open zip file")]
-    ZipOpen(#[source] ZipError),
+    ZipOpen(#[source] rawzip::Error),
+    #[error("Failed to list zip entries")]
+    ZipEntryList(#[source] rawzip::Error),
+    #[error("Missing zip entry: {0:?}")]
+    ZipEntryMissing(Cow<'static, str>),
    #[error("Failed to open zip entry: {0:?}")]
-    ZipEntryOpen(&'static str, #[source] ZipError),
+    ZipEntryOpen(Cow<'static, str>, #[source] rawzip::Error),
    #[error("Failed to start new zip entry: {0:?}")]
-    ZipEntryStart(&'static str, #[source] ZipError),
+    ZipEntryStart(Cow<'static, str>, #[source] rawzip::Error),
    #[error("Failed to read zip entry: {0:?}")]
-    ZipEntryRead(&'static str, #[source] io::Error),
+    ZipEntryRead(Cow<'static, str>, #[source] io::Error),
    #[error("Failed to write zip entry: {0:?}")]
-    ZipEntryWrite(&'static str, #[source] io::Error),
-    #[error("Failed to open zip entry #{0}")]
-    ZipIndexOpen(usize, #[source] ZipError),
+    ZipEntryWrite(Cow<'static, str>, #[source] io::Error),
+    #[error("Failed to finalize zip entry: {0:?}")]
+    ZipEntryFinish(Cow<'static, str>, #[source] rawzip::Error),
    #[error("Failed to load OTA certificate")]
    OtaCertLoad(#[source] crypto::Error),
    #[error("Failed to extract public key from OTA certificate")]
@@ -120,6 +125,8 @@ pub enum Error {
    DataRead(&'static str, #[source] io::Error),
    #[error("Failed to write OTA data: {0}")]
    DataWrite(&'static str, #[source] io::Error),
+    #[error("Failed to convert to non-streaming zip")]
+    MakeNonStreaming(#[source] rawzip::Error),
 }

 type Result<T> = std::result::Result<T, Error>;
@@ -500,16 +507,36 @@ impl fmt::Display for ZipMode {
 /// directory would start.
 pub fn add_metadata(
    zip_entries: &[ZipEntry],
-    zip_writer: &mut ZipWriterWrapper<impl Write>,
+    zip_writer: &mut ZipArchiveWriter<impl Write>,
    next_offset: u64,
    metadata: &OtaMetadata,
    payload_metadata_size: u64,
-    zip_mode: ZipMode,
 ) -> Result<OtaMetadata> {
+    fn write_entry(
+        archive: &mut ZipArchiveWriter<impl Write>,
+        path: &'static str,
+        data: &[u8],
+    ) -> Result<(u64, u64)> {
+        let (entry_writer, data_config) = archive
+            .new_file(path)
+            .start()
+            .map_err(|e| Error::ZipEntryStart(path.into(), e))?;
+        let data_offset = entry_writer.stream_offset();
+        let mut data_writer = data_config.wrap(entry_writer);
+
+        data_writer
+            .write_all(data)
+            .map_err(|e| Error::ZipEntryWrite(path.into(), e))?;
+
+        let data_size = data_writer
+            .finish()
+            .and_then(|(w, d)| w.finish(d))
+            .map_err(|e| Error::ZipEntryFinish(path.into(), e))?;
+
+        Ok((data_offset, data_size))
+    }
+
    let mut metadata = metadata.clone();
-    let options = SimpleFileOptions::default()
-        .last_modified_time(DateTime::default())
-        .compression_method(CompressionMethod::Stored);

    let mut prop_entries = zip_entries.iter().map(PropEntry::from).collect();
    add_payload_metadata_entry(&mut prop_entries, payload_metadata_size)?;
@@ -528,34 +555,25 @@ pub fn add_metadata(
    let (temp_legacy_offset, temp_modern_offset) = {
        let (legacy_raw, modern_raw) = serialize_metadata(&metadata);
        let raw_writer = Cursor::new(Vec::new());
-        let mut writer = match zip_mode {
-            ZipMode::Streaming => ZipWriterWrapper::new_streaming(raw_writer),
-            ZipMode::Seekable => ZipWriterWrapper::new_seekable(raw_writer),
-        };
+        // Note that we don't need to worry about the offsets changing based on
+        // the zip writing mode (streaming vs. seekable). Currently, we always
+        // include data descriptors and do post-processing to copy the fields
+        // into the local header without shifting the data.
+        let mut writer = ZipArchiveWriter::new(raw_writer);

-        let legacy_offset = writer
-            .start_file(PATH_METADATA, options)
-            .map_err(|e| Error::ZipEntryStart(PATH_METADATA, e))?;
-        writer
-            .write_all(legacy_raw.as_bytes())
-            .map_err(|e| Error::ZipEntryWrite(PATH_METADATA, e))?;
-
-        let modern_offset = writer
-            .start_file(PATH_METADATA_PB, options)
-            .map_err(|e| Error::ZipEntryStart(PATH_METADATA_PB, e))?;
-        writer
-            .write_all(&modern_raw)
-            .map_err(|e| Error::ZipEntryWrite(PATH_METADATA_PB, e))?;
+        let (legacy_offset, legacy_size) =
+            write_entry(&mut writer, PATH_METADATA, legacy_raw.as_bytes())?;
+        let (modern_offset, modern_size) = write_entry(&mut writer, PATH_METADATA_PB, &modern_raw)?;

        prop_entries.push(PropEntry::new(
            PATH_METADATA,
            next_offset + legacy_offset,
-            legacy_raw.len() as u64,
+            legacy_size,
        ));
        prop_entries.push(PropEntry::new(
            PATH_METADATA_PB,
            next_offset + modern_offset,
-            modern_raw.len() as u64,
+            modern_size,
        ));

        (next_offset + legacy_offset, next_offset + modern_offset)
@@ -570,19 +588,8 @@ pub fn add_metadata(
    {
        let (legacy_raw, modern_raw) = serialize_metadata(&metadata);

-        let legacy_offset = zip_writer
-            .start_file(PATH_METADATA, options)
-            .map_err(|e| Error::ZipEntryStart(PATH_METADATA, e))?;
-        zip_writer
-            .write_all(legacy_raw.as_bytes())
-            .map_err(|e| Error::ZipEntryWrite(PATH_METADATA, e))?;
-
-        let modern_offset = zip_writer
-            .start_file(PATH_METADATA_PB, options)
-            .map_err(|e| Error::ZipEntryStart(PATH_METADATA_PB, e))?;
-        zip_writer
-            .write_all(&modern_raw)
-            .map_err(|e| Error::ZipEntryWrite(PATH_METADATA_PB, e))?;
+        let (legacy_offset, _) = write_entry(zip_writer, PATH_METADATA, legacy_raw.as_bytes())?;
+        let (modern_offset, _) = write_entry(zip_writer, PATH_METADATA_PB, &modern_raw)?;

        assert_eq!(legacy_offset, temp_legacy_offset);
        assert_eq!(modern_offset, temp_modern_offset);
@@ -597,23 +604,24 @@ pub fn verify_metadata(
    metadata: &OtaMetadata,
    payload_metadata_size: u64,
 ) -> Result<()> {
-    let mut zip_reader = ZipArchive::new(reader).map_err(Error::ZipOpen)?;
+    let mut buffer = vec![0u8; RECOMMENDED_BUFFER_SIZE];
+    let archive = ZipArchive::from_seekable(reader, &mut buffer).map_err(Error::ZipOpen)?;
    let mut zip_entries = vec![];

-    for i in 0..zip_reader.len() {
-        let entry = zip_reader
-            .by_index(i)
-            .map_err(|e| Error::ZipIndexOpen(i, e))?;
+    let mut entries = archive.entries_safe(&mut buffer);

-        if entry.compression() != CompressionMethod::Stored {
+    while let Some((cd_entry, entry)) = entries.next_entry().map_err(Error::ZipEntryList)? {
+        if cd_entry.compression_method() != CompressionMethod::Store {
            continue;
        }

-        zip_entries.push(PropEntry::new(
-            entry.name(),
-            entry.data_start(),
-            entry.size(),
-        ));
+        let Ok(path) = cd_entry.file_path_utf8() else {
+            continue;
+        };
+
+        let range = entry.compressed_data_range();
+
+        zip_entries.push(PropEntry::new(path, range.0, range.1 - range.0));
    }

    add_payload_metadata_entry(&mut zip_entries, payload_metadata_size)?;
@@ -808,7 +816,7 @@ fn parse_raw_ota_sig(mut reader: impl Read + Seek) -> Result<RawOtaSignature> {
        .map_err(|e| Error::DataRead("file_size", e))?;

    reader
-        .seek(SeekFrom::Current(-6))
+        .seek_relative(-6)
        .map_err(|e| Error::DataRead("footer", e))?;
    let footer = reader
        .read_array_exact::<6>()
@@ -870,54 +878,73 @@ pub fn parse_ota_sig(reader: impl Read + Seek) -> Result<OtaSignature> {
 pub fn parse_zip_ota_info(
    reader: impl Read + Seek,
 ) -> Result<(OtaMetadata, Certificate, PayloadHeader, String)> {
-    let mut zip = ZipArchive::new(reader).map_err(Error::ZipOpen)?;
+    let mut buffer = vec![0u8; RECOMMENDED_BUFFER_SIZE];
+    let archive = ZipArchive::from_seekable(reader, &mut buffer).map_err(Error::ZipOpen)?;

-    let metadata = match zip.by_name(PATH_METADATA_PB) {
-        Ok(mut entry) => {
+    let mut metadata_modern = None;
+    let mut metadata_legacy = None;
+    let mut certificate = None;
+    let mut header = None;
+    let mut properties = None;
+
+    let mut entries = archive.entries_safe(&mut buffer);
+
+    while let Some((cd_entry, entry)) = entries.next_entry().map_err(Error::ZipEntryList)? {
+        let path = cd_entry.file_path_utf8().map_err(Error::ZipEntryList)?;
+
+        if path == PATH_METADATA_PB {
+            let mut reader = zip::verifying_reader(&entry, cd_entry.compression_method())
+                .map_err(|e| Error::ZipEntryOpen(PATH_METADATA_PB.into(), e))?;
            let mut buf = Vec::new();
-            entry
+
+            reader
                .read_to_end(&mut buf)
-                .map_err(|e| Error::ZipEntryRead(PATH_METADATA_PB, e))?;
-            parse_protobuf_metadata(&buf)?
-        }
-        e @ Err(ZipError::FileNotFound) => {
-            drop(e);
-            let mut entry = zip
-                .by_name(PATH_METADATA)
-                .map_err(|e| Error::ZipEntryOpen(PATH_METADATA, e))?;
+                .map_err(|e| Error::ZipEntryRead(PATH_METADATA_PB.into(), e))?;
+
+            metadata_modern = Some(parse_protobuf_metadata(&buf)?);
+        } else if path == PATH_METADATA {
+            let mut reader = zip::verifying_reader(&entry, cd_entry.compression_method())
+                .map_err(|e| Error::ZipEntryOpen(PATH_METADATA.into(), e))?;
            let mut buf = String::new();
-            entry
+
+            reader
                .read_to_string(&mut buf)
-                .map_err(|e| Error::ZipEntryRead(PATH_METADATA, e))?;
-            parse_legacy_metadata(&buf)?
+                .map_err(|e| Error::ZipEntryRead(PATH_METADATA.into(), e))?;
+
+            metadata_legacy = Some(parse_legacy_metadata(&buf)?);
+        } else if path == PATH_OTACERT {
+            let reader = zip::verifying_reader(&entry, cd_entry.compression_method())
+                .map_err(|e| Error::ZipEntryOpen(PATH_OTACERT.into(), e))?;
+
+            certificate = Some(
+                crypto::read_pem_cert(Path::new(PATH_OTACERT), reader)
+                    .map_err(Error::OtaCertLoad)?,
+            );
+        } else if path == PATH_PAYLOAD {
+            // No CRC validation because we only read the header.
+            let reader = zip::compressed_reader(&entry, cd_entry.compression_method())
+                .map_err(|e| Error::ZipEntryOpen(PATH_PAYLOAD.into(), e))?;
+
+            header = Some(PayloadHeader::from_reader(reader).map_err(Error::PayloadLoad)?);
+        } else if path == PATH_PROPERTIES {
+            let mut reader = zip::verifying_reader(&entry, cd_entry.compression_method())
+                .map_err(|e| Error::ZipEntryOpen(PATH_PROPERTIES.into(), e))?;
+            let mut buf = String::new();
+
+            reader
+                .read_to_string(&mut buf)
+                .map_err(|e| Error::ZipEntryRead(PATH_PROPERTIES.into(), e))?;
+
+            properties = Some(buf);
        }
-        Err(e) => return Err(Error::ZipEntryOpen(PATH_METADATA_PB, e)),
-    };
+    }

-    let certificate = {
-        let entry = zip
-            .by_name(PATH_OTACERT)
-            .map_err(|e| Error::ZipEntryOpen(PATH_OTACERT, e))?;
-        crypto::read_pem_cert(Path::new(PATH_OTACERT), entry).map_err(Error::OtaCertLoad)?
-    };
-
-    let header = {
-        let entry = zip
-            .by_name(PATH_PAYLOAD)
-            .map_err(|e| Error::ZipEntryOpen(PATH_PAYLOAD, e))?;
-        PayloadHeader::from_reader(entry).map_err(Error::PayloadLoad)?
-    };
-
-    let properties = {
-        let mut entry = zip
-            .by_name(PATH_PROPERTIES)
-            .map_err(|e| Error::ZipEntryOpen(PATH_PROPERTIES, e))?;
-        let mut buf = String::new();
-        entry
-            .read_to_string(&mut buf)
-            .map_err(|e| Error::ZipEntryRead(PATH_PROPERTIES, e))?;
-        buf
-    };
+    let metadata = metadata_modern
+        .or(metadata_legacy)
+        .ok_or_else(|| Error::ZipEntryMissing(PATH_METADATA_PB.into()))?;
+    let certificate = certificate.ok_or_else(|| Error::ZipEntryMissing(PATH_OTACERT.into()))?;
+    let header = header.ok_or_else(|| Error::ZipEntryMissing(PATH_PAYLOAD.into()))?;
+    let properties = properties.ok_or_else(|| Error::ZipEntryMissing(PATH_PROPERTIES.into()))?;

    Ok((metadata, certificate, header, properties))
 }
@@ -1077,6 +1104,11 @@ impl<W: Read + Write + Seek> SeekableSigningWriter<W> {
        cert: &Certificate,
        cancel_signal: &AtomicBool,
    ) -> Result<W> {
+        // We always write a streaming zip because that is what rawzip supports.
+        // Convert it to not be streaming. This will leave the data descriptors
+        // behind, but that is fine.
+        zip::make_non_streaming(&mut self.inner).map_err(Error::MakeNonStreaming)?;
+
        let file_size = self
            .seek(SeekFrom::End(0))
            .map_err(|e| Error::DataRead("file_size", e))?;
@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: 2022-2025 Andrew Gunnerson
+// SPDX-FileCopyrightText: 2022-2026 Andrew Gunnerson
 // SPDX-License-Identifier: GPL-3.0-only

 use std::{
@@ -15,7 +15,7 @@ use base64::Engine;
 use base64::engine::general_purpose::STANDARD;
 use bzip2::write::BzDecoder;
 use flate2::{Compression, write::GzEncoder};
-use lzma_rust2::{CheckType, XZOptions, XZReader, XZWriter};
+use lzma_rust2::{CheckType, XzOptions, XzReader, XzWriter};
 use num_traits::CheckedAdd;
 use prost::Message;
 use rayon::{
@@ -36,8 +36,8 @@ use crate::{
        install_operation::Type, signatures::Signature,
    },
    stream::{
-        self, CountingReader, FromReader, HashingReader, HashingWriter, ReadDiscardExt,
-        ReadFixedSizeExt, ReadSeekReopen, WriteSeek, WriteSeekReopen,
+        self, CountingReader, FromReader, HashingReader, HashingWriter, ReadAt, ReadDiscardExt,
+        ReadFixedSizeExt, ReadSeek, UserPosFile, WriteAt, WriteSeek,
    },
    util::{self, OutOfBoundsError},
 };
@@ -45,7 +45,7 @@ use crate::{
 const PAYLOAD_MAGIC: &[u8; 4] = b"CrAU";
 const PAYLOAD_VERSION: u64 = 2;

-const MANIFEST_MAX_SIZE: usize = 4 * 1024 * 1024;
+const MANIFEST_MAX_SIZE: usize = 16 * 1024 * 1024;

 /// Size of each extent. This matches what AOSP's delta_generator does. We also
 /// require this to be a multiple of the block size and a multiple of the
@@ -126,12 +126,8 @@ pub enum Error {
        num_blocks: u64,
        source: io::Error,
    },
-    #[error("Failed to reopen payload")]
-    PayloadReopen(#[source] io::Error),
-    #[error("Failed to open input file for partition: {0}")]
-    InputOpen(String, #[source] io::Error),
-    #[error("Failed to open output file for partition: {0}")]
-    OutputOpen(String, #[source] io::Error),
+    #[error("Failed to get input file size for partition: {0}")]
+    InputSize(String, #[source] io::Error),
    #[error("Failed to GZ compress partition image chunk")]
    GzCompress(#[source] io::Error),
    #[error("Failed to initialize XZ encoder")]
@@ -440,11 +436,11 @@ impl<W: Write> PayloadWriter<W> {

    /// Finalize the payload. If this function is not called, the payload will
    /// be left in an incomplete state. Returns the original writer, the final
-    /// header, the contents that should be written for `payload_properties.txt`
-    /// and the length of the header + manifest + manifest signature sections
-    /// (for constructing the `payload_metadata.bin` OTA metadata property files
-    /// entry).
-    pub fn finish(mut self) -> Result<(W, PayloadHeader, String, u64)> {
+    /// header and the data that should be written for `payload_properties.txt`.
+    /// [`PayloadHeader::blob_offset`] indicates the length of the header +
+    /// manifest + manifest signature sections (for constructing the
+    /// `payload_metadata.bin` OTA metadata property files entry).
+    pub fn finish(mut self) -> Result<(W, PayloadHeader, String)> {
        // Append payload signature.
        let payload_partial_hash = self.h_partial.clone().finish();
        let payload_sig = sign_digest(payload_partial_hash.as_ref(), &self.key)?;
@@ -469,7 +465,9 @@ impl<W: Write> PayloadWriter<W> {
            self.metadata_size as u64,
        );

-        Ok((self.inner, self.header, properties, metadata_with_sig_size))
+        self.header.blob_offset = metadata_with_sig_size;
+
+        Ok((self.inner, self.header, properties))
    }

    /// Prepare for writing the next source data blob corresponding to an
@@ -592,12 +590,12 @@ impl<W: Write> Write for PayloadWriter<W> {
 /// Verify the payload signatures using the specified certificate and check that
 /// the digests in `payload_properties.txt` are correct.
 pub fn verify_payload(
-    mut reader: impl Read + Seek,
+    reader: &mut dyn ReadSeek,
    cert: &Certificate,
    properties_raw: &str,
    cancel_signal: &AtomicBool,
 ) -> Result<()> {
-    let header = PayloadHeader::from_reader(&mut reader)?;
+    let header = PayloadHeader::from_reader(&mut *reader)?;
    reader.rewind().map_err(|e| Error::DataRead("header", e))?;

    let payload_signatures_offset = header
@@ -617,7 +615,7 @@ pub fn verify_payload(
    // Read from the beginning to the metadata signature.
    let metadata_size = header.blob_offset - u64::from(header.metadata_signature_size);
    stream::copy_n_inspect(
-        &mut reader,
+        &mut *reader,
        io::sink(),
        metadata_size,
        |data| {
@@ -634,7 +632,7 @@ pub fn verify_payload(
        let mut writer = Cursor::new(Vec::new());

        stream::copy_n_inspect(
-            &mut reader,
+            &mut *reader,
            &mut writer,
            header.metadata_signature_size.into(),
            |data| h_full.update(data),
@@ -664,7 +662,7 @@ pub fn verify_payload(

    // Read (and discard) all the payload blobs.
    stream::copy_n_inspect(
-        &mut reader,
+        &mut *reader,
        io::sink(),
        payload_signatures_offset,
        |data| {
@@ -692,7 +690,7 @@ pub fn verify_payload(
        let mut writer = Cursor::new(Vec::new());

        stream::copy_n_inspect(
-            &mut reader,
+            &mut *reader,
            &mut writer,
            payload_signatures_size,
            |data| h_full.update(data),
@@ -737,8 +735,8 @@ pub fn verify_payload(

 /// Apply a partition operation from `reader` to `writer`.
 pub fn apply_operation(
-    mut reader: impl Read + Seek,
-    mut writer: impl Write + Seek,
+    reader: &mut dyn ReadSeek,
+    writer: &mut dyn WriteSeek,
    block_size: u32,
    blob_offset: u64,
    op: &InstallOperation,
@@ -774,7 +772,7 @@ pub fn apply_operation(
            Type::Zero | Type::Discard => {
                stream::copy_n_inspect(
                    io::repeat(0),
-                    &mut writer,
+                    &mut *writer,
                    out_data_length,
                    |data| hasher.update(data),
                    cancel_signal,
@@ -793,8 +791,8 @@ pub fn apply_operation(
                match other {
                    Type::Replace => {
                        stream::copy_n_inspect(
-                            &mut reader,
-                            &mut writer,
+                            &mut *reader,
+                            &mut *writer,
                            data_length,
                            |data| hasher.update(data),
                            cancel_signal,
@@ -802,9 +800,9 @@ pub fn apply_operation(
                        .map_err(error_fn)?;
                    }
                    Type::ReplaceBz => {
-                        let mut decoder = BzDecoder::new(&mut writer);
+                        let mut decoder = BzDecoder::new(&mut *writer);
                        stream::copy_n_inspect(
-                            &mut reader,
+                            &mut *reader,
                            &mut decoder,
                            data_length,
                            |data| hasher.update(data),
@@ -816,10 +814,11 @@ pub fn apply_operation(
                    Type::ReplaceXz => {
                        // lzma_rust2 does not have a Write API, so we limit the
                        // reader and read till EOF.
-                        let limited_reader = (&mut reader).take(data_length);
+                        let limited_reader = (&mut *reader).take(data_length);
                        let hashing_reader = HashingReader::new(limited_reader, hasher);
-                        let mut decoder = XZReader::new(hashing_reader, false);
-                        stream::copy(&mut decoder, &mut writer, cancel_signal).map_err(error_fn)?;
+                        let mut decoder = XzReader::new(hashing_reader, false);
+                        stream::copy(&mut decoder, &mut *writer, cancel_signal)
+                            .map_err(error_fn)?;

                        (_, hasher) = decoder.into_inner().finish();
                    }
@@ -843,11 +842,10 @@ pub fn apply_operation(
 }

 /// Extract the specified image from the payload. This is done multithreaded and
-/// uses rayon's global thread pool. Both the `payload` and `output` streams
-/// will be reopened from multiple threads.
+/// uses rayon's global thread pool.
 pub fn extract_image(
-    payload: &(dyn ReadSeekReopen + Sync),
-    output: &(dyn WriteSeekReopen + Sync),
+    payload: &(dyn ReadAt + Sync),
+    output: &(dyn WriteAt + Sync),
    header: &PayloadHeader,
    partition_name: &str,
    cancel_signal: &AtomicBool,
@@ -859,40 +857,28 @@ pub fn extract_image(
        .find(|p| p.partition_name == partition_name)
        .ok_or_else(|| Error::MissingPartition(partition_name.to_owned()))?;

-    partition
-        .operations
-        .par_iter()
-        .map(|op| -> Result<()> {
-            let reader = payload.reopen_boxed().map_err(Error::PayloadReopen)?;
-            let writer = output
-                .reopen_boxed()
-                .map_err(|e| Error::OutputOpen(partition_name.to_owned(), e))?;
-
-            apply_operation(
-                reader,
-                writer,
-                header.manifest.block_size(),
-                header.blob_offset,
-                op,
-                cancel_signal,
-            )?;
-
-            Ok(())
-        })
-        .collect::<Result<_>>()
+    partition.operations.par_iter().try_for_each(|op| {
+        apply_operation(
+            &mut UserPosFile::new(payload),
+            &mut UserPosFile::new(output),
+            header.manifest.block_size(),
+            header.blob_offset,
+            op,
+            cancel_signal,
+        )
+    })
 }

 /// Extract the specified partition images from the payload into writers. This
-/// is done multithreaded and uses rayon's global thread pool. `open_payload`
-/// and `open_output` will be called from multiple threads.
-pub fn extract_images<'a>(
-    payload: &(dyn ReadSeekReopen + Sync),
-    open_output: impl Fn(&str) -> io::Result<Box<dyn WriteSeek>> + Sync,
+/// is done multithreaded and uses rayon's global thread pool.
+pub fn extract_images<'name, 'file>(
+    payload: &(dyn ReadAt + Sync),
+    outputs: impl IntoIterator<Item = (&'name str, &'file (dyn WriteAt + Sync))>,
    header: &PayloadHeader,
-    partition_names: impl IntoIterator<Item = &'a str>,
    cancel_signal: &AtomicBool,
 ) -> Result<()> {
-    let mut remaining = partition_names.into_iter().collect::<HashSet<_>>();
+    let outputs = outputs.into_iter().collect::<HashMap<_, _>>();
+    let mut remaining = outputs.keys().copied().collect::<HashSet<_>>();
    // We parallelize at the operation level or else one thread might get stuck
    // processing a giant image.
    let mut operations = vec![];
@@ -912,22 +898,19 @@ pub fn extract_images<'a>(

    operations
        .into_par_iter()
-        .map(|(name, op)| -> Result<()> {
-            let reader = payload.reopen_boxed().map_err(Error::PayloadReopen)?;
-            let writer = open_output(name).map_err(|e| Error::OutputOpen(name.to_owned(), e))?;
+        .try_for_each(|(name, op)| -> Result<()> {
+            let mut reader = UserPosFile::new(payload);
+            let mut writer = UserPosFile::new(&outputs[name]);

            apply_operation(
-                reader,
-                writer,
+                &mut reader,
+                &mut writer,
                header.manifest.block_size(),
                header.blob_offset,
                op,
                cancel_signal,
-            )?;
-
-            Ok(())
+            )
        })
-        .collect()
 }

 /// Compress raw data into a chunk to be used with a [`Type::ReplaceXz`]
@@ -941,9 +924,9 @@ fn compress_chunk(raw_data: &[u8], cancel_signal: &AtomicBool) -> Result<(Vec<u8
    // decompression. Also, we intentionally pick the lowest compression level
    // since we primarily care about squishing zeros. The non-zero portions of
    // boot images are usually already-compressed kernels and ramdisks.
-    let mut options = XZOptions::with_preset(0);
+    let mut options = XzOptions::with_preset(0);
    options.set_check_sum_type(CheckType::None);
-    let mut xz_writer = XZWriter::new(hashing_writer, options).map_err(Error::XzInit)?;
+    let mut xz_writer = XzWriter::new(hashing_writer, options).map_err(Error::XzInit)?;

    stream::copy_n(reader, &mut xz_writer, raw_data.len() as u64, cancel_signal)
        .map_err(Error::XzCompress)?;
@@ -959,10 +942,20 @@ fn compress_chunk(raw_data: &[u8], cancel_signal: &AtomicBool) -> Result<(Vec<u8
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Deserialize, Serialize)]
 pub enum CowVersion {
    V2,
-    V3,
+    V3 {
+        /// The maximum number of bytes to compress at a time.
+        compression_factor: u32,
+    },
 }

 impl CowVersion {
+    fn compression_factor(self) -> Option<u32> {
+        match self {
+            Self::V2 => None,
+            Self::V3 { compression_factor } => Some(compression_factor),
+        }
+    }
+
    /// Compute the size overhead required to store the headers and footers
    /// needed for this version of the on-disk CoW format.
    fn size_overhead(self, cow_replace_ops: u64, payload_install_ops: u64) -> u64 {
@@ -1012,7 +1005,7 @@ impl CowVersion {
                // AOSP: CowWriterV2::GetCowSizeInfo()
                overhead += SIZEOF_COW_FOOTER_V2;
            }
-            Self::V3 => {
+            Self::V3 { .. } => {
                // AOSP: CowWriterV3::OpenForWrite() -> GetDataOffset()
                overhead += SIZEOF_COW_HEADER_V3;
                overhead += BUFFER_REGION_DEFAULT_SIZE;
@@ -1229,8 +1222,6 @@ pub struct VabcParams {
    pub version: CowVersion,
    /// CoW compression algorithm.
    pub algo: VabcAlgo,
-    /// The maximum number of bytes to compress at a time.
-    pub compression_factor: u32,
 }

 /// Ensure that the partition size is aligned to the block size and that the
@@ -1239,17 +1230,16 @@ fn validate_partition_size(
    partition_name: &str,
    file_size: u64,
    block_size: u32,
-    compression_factor: u32,
+    compression_factor: Option<u32>,
 ) -> Result<()> {
    if block_size == 0 || !block_size.is_power_of_two() || CHUNK_SIZE % u64::from(block_size) != 0 {
        return Err(Error::InvalidBlockSize(block_size));
    }

-    if compression_factor == 0
-        || !compression_factor.is_power_of_two()
-        || CHUNK_SIZE % u64::from(compression_factor) != 0
+    if let Some(factor) = compression_factor
+        && (factor == 0 || !factor.is_power_of_two() || CHUNK_SIZE % u64::from(factor) != 0)
    {
-        return Err(Error::InvalidMaxCompressionChunkSize(compression_factor));
+        return Err(Error::InvalidMaxCompressionChunkSize(factor));
    }

    if file_size % u64::from(block_size) != 0 {
@@ -1270,7 +1260,7 @@ fn validate_partition_size(
 /// [`PartitionUpdate::estimate_op_count_max`] or else update_engine may fail to
 /// flash the partition due to running out of space on the CoW block device.
 pub fn compute_cow_estimate(
-    input: &(dyn ReadSeekReopen + Sync),
+    input: &(dyn ReadAt + Sync),
    payload_install_ops: u64,
    partition_name: &str,
    block_size: u32,
@@ -1278,24 +1268,24 @@ pub fn compute_cow_estimate(
    cancel_signal: &AtomicBool,
 ) -> Result<CowEstimate> {
    let file_size = input
-        .reopen_boxed()
-        .and_then(|mut r| r.seek(SeekFrom::End(0)))
-        .map_err(|e| Error::InputOpen(partition_name.to_owned(), e))?;
+        .file_len()
+        .map_err(|e| Error::InputSize(partition_name.to_owned(), e))?;
    let final_chunk_different = file_size % CHUNK_SIZE != 0;

    validate_partition_size(
        partition_name,
        file_size,
        block_size,
-        vabc_params.compression_factor,
+        vabc_params.version.compression_factor(),
    )?;

    let chunking = ChunkingParams {
        block_size,
        method: match vabc_params.version {
            CowVersion::V2 => ChunkingMethod::Exact,
-            CowVersion::V3 => {
-                ChunkingMethod::MaxPowerOf2(vabc_params.compression_factor.try_into().unwrap())
+            CowVersion::V3 { compression_factor } => {
+                // validate_partition_size() already validated that it is not 0.
+                ChunkingMethod::MaxPowerOf2(compression_factor.try_into().unwrap())
            }
        },
    };
@@ -1306,7 +1296,7 @@ pub fn compute_cow_estimate(
        .into_par_iter()
        .map(|chunk| -> Result<CowEstimate> {
            let data = (|| {
-                let mut reader = input.reopen_boxed()?;
+                let mut reader = UserPosFile::new(input);
                reader.seek(SeekFrom::Start(chunk * CHUNK_SIZE))?;

                let chunk_size = if final_chunk_different && chunk == chunks_total - 1 {
@@ -1353,8 +1343,8 @@ pub fn compute_cow_estimate(
 /// This is more efficient than separately calling [`compute_cow_estimate`]
 /// since the input does not need to be read twice.
 pub fn compress_image(
-    input: &(dyn ReadSeekReopen + Sync),
-    output: &(dyn WriteSeekReopen + Sync),
+    input: &(dyn ReadAt + Sync),
+    output: &(dyn WriteAt + Sync),
    partition_name: &str,
    block_size: u32,
    vabc_params: Option<VabcParams>,
@@ -1363,18 +1353,21 @@ pub fn compress_image(
    const CHUNK_GROUP: u64 = 32;

    let file_size = input
-        .reopen_boxed()
-        .and_then(|mut r| r.seek(SeekFrom::End(0)))
-        .map_err(|e| Error::InputOpen(partition_name.to_owned(), e))?;
+        .file_len()
+        .map_err(|e| Error::InputSize(partition_name.to_owned(), e))?;
    let final_chunk_different = file_size % CHUNK_SIZE != 0;

-    let compression_factor = vabc_params.map_or(block_size, |p| p.compression_factor);
-    validate_partition_size(partition_name, file_size, block_size, compression_factor)?;
+    validate_partition_size(
+        partition_name,
+        file_size,
+        block_size,
+        vabc_params.and_then(|p| p.version.compression_factor()),
+    )?;

    let chunking = ChunkingParams {
        block_size,
        method: match vabc_params.map(|p| p.version) {
-            Some(CowVersion::V3) => {
+            Some(CowVersion::V3 { compression_factor }) => {
                ChunkingMethod::MaxPowerOf2(compression_factor.try_into().unwrap())
            }
            _ => ChunkingMethod::Exact,
@@ -1397,7 +1390,7 @@ pub fn compress_image(
        let uncompressed_data_group = (chunks_done..chunks_done + chunks_group)
            .into_par_iter()
            .map(|chunk| -> io::Result<(u64, Vec<u8>)> {
-                let mut reader = input.reopen_boxed()?;
+                let mut reader = UserPosFile::new(input);
                let offset = reader.seek(SeekFrom::Start(chunk * CHUNK_SIZE))?;

                let chunk_size = if final_chunk_different && chunk == chunks_total - 1 {
@@ -1457,7 +1450,7 @@ pub fn compress_image(
        let group_operations = compressed_data_group
            .into_par_iter()
            .map(|(data, operation, _)| -> io::Result<InstallOperation> {
-                let mut writer = output.reopen_boxed()?;
+                let mut writer = UserPosFile::new(output);
                writer.seek(SeekFrom::Start(operation.data_offset.unwrap()))?;
                writer.write_all(&data)?;

@@ -1526,8 +1519,8 @@ fn extents_sorted(operations: &[InstallOperation]) -> bool {
 ///
 /// Returns the ranges of indices of `operations` that were updated.
 pub fn compress_modified_image(
-    input: &(dyn ReadSeekReopen + Sync),
-    output: &(dyn WriteSeekReopen + Sync),
+    input: &(dyn ReadAt + Sync),
+    output: &(dyn WriteAt + Sync),
    block_size: u32,
    partition_info: &mut PartitionInfo,
    operations: &mut [InstallOperation],
@@ -1576,7 +1569,7 @@ pub fn compress_modified_image(
                let extents_size: usize = util::try_cast(extents_size)
                    .map_err(|e| Error::IntOutOfBounds("extents_size", e))?;

-                let mut reader = input.reopen_boxed().map_err(Error::ChunkRead)?;
+                let mut reader = UserPosFile::new(input);
                reader
                    .seek(SeekFrom::Start(extents_start))
                    .map_err(Error::ChunkRead)?;
@@ -1623,7 +1616,7 @@ pub fn compress_modified_image(
        let modified_group_operations = compressed_data_group
            .into_par_iter()
            .map(|(data, i, operation)| {
-                let mut writer = output.reopen_boxed()?;
+                let mut writer = UserPosFile::new(output);
                writer.seek(SeekFrom::Start(operation.data_offset.unwrap()))?;
                writer.write_all(&data)?;

@@ -3,7 +3,7 @@

 use std::{
    fmt,
-    io::{self, Read, Seek, SeekFrom, Write},
+    io::{self, Read, Seek, Write},
    mem,
    ops::Range,
 };
@@ -520,14 +520,14 @@ impl ChunkList {
        // Find the chunk to insert before. We save the last used index to
        // optimize for sequential insertion and avoid needing to search the
        // entire list every time.
-        let mut insert_before = self.chunks.front_index();
-
-        if let Some(last_used) = self.last_used
+        let mut insert_before = if let Some(last_used) = self.last_used
            && chunk.bounds.start >= self.chunks.get(last_used).unwrap().bounds.start
        {
            // The new chunk starts after the last used chunk.
-            insert_before = Some(last_used);
-        }
+            Some(last_used)
+        } else {
+            self.chunks.front_index()
+        };

        while let Some(index) = insert_before {
            if self.chunks.get(index).unwrap().bounds.start >= chunk.bounds.start {
@@ -672,7 +672,7 @@ fn hash_fill_chunk(
 /// A type for reading sparse files.
 pub struct SparseReader<R> {
    inner: R,
-    seek: Option<fn(&mut R, SeekFrom) -> io::Result<u64>>,
+    seek_relative: Option<fn(&mut R, i64) -> io::Result<()>>,
    header: RawHeader,
    /// Starting block for next chunk.
    block: u32,
@@ -689,7 +689,7 @@ impl<R: Read + Seek> SparseReader<R> {
    /// efficiently skipped without reading them.
    pub fn new_seekable(inner: R, crc_mode: CrcMode) -> Result<Self> {
        let mut result = Self::new(inner, crc_mode)?;
-        result.seek = Some(Seek::seek);
+        result.seek_relative = Some(Seek::seek_relative);
        Ok(result)
    }
 }
@@ -710,7 +710,7 @@ impl<R: Read> SparseReader<R> {

        Ok(Self {
            inner,
-            seek: None,
+            seek_relative: None,
            header,
            block: 0,
            chunk: 0,
@@ -744,12 +744,12 @@ impl<R: Read> SparseReader<R> {
    /// perform its own verification.
    pub fn next_chunk(&mut self) -> Result<Option<Chunk>> {
        if self.data_remain != 0 {
-            if let Some(seek) = self.seek {
+            if let Some(seek_relative) = self.seek_relative {
                if self.hasher.is_some() {
                    return Err(Error::Crc32RandomRead);
                }

-                seek(&mut self.inner, SeekFrom::Current(self.data_remain.into()))
+                seek_relative(&mut self.inner, self.data_remain.into())
                    .map_err(|e| Error::DataRead("data_remain", e))?;
                self.data_remain = 0;
            } else {
@@ -1026,7 +1026,7 @@ impl<W: Write> Write for SparseWriter<W> {

 #[cfg(test)]
 mod tests {
-    use super::{Chunk, ChunkBounds, ChunkData, ChunkList};
+    use super::*;

    #[test]
    fn chunk_list_merge() {
@@ -1,103 +1,501 @@
-// SPDX-FileCopyrightText: 2025 Andrew Gunnerson
+// SPDX-FileCopyrightText: 2025-2026 Andrew Gunnerson
 // SPDX-License-Identifier: GPL-3.0-only

-use std::io::{self, Seek, SeekFrom, Write};
-
-use zip::{
-    ZipWriter,
-    result::ZipResult,
-    write::{FileOptionExtension, FileOptions, StreamWriter},
+use std::{
+    cmp::Ordering,
+    io::{self, Cursor, Read, Seek, SeekFrom, Write},
 };

-/// A wrapper around a seekable writer. `W` must implement [`Seek`], but only
-/// during the creation of a new instance. The resulting type can be stored in a
-/// parent container where the generic type does not implement [`Seek`].
-pub struct SeekWriter<W: Write> {
-    inner: W,
-    seek_fn: fn(&mut W, SeekFrom) -> io::Result<u64>,
+use bstr::ByteSlice;
+use rawzip::{
+    CompressionMethod, RECOMMENDED_BUFFER_SIZE, ReaderAt, ZipArchive, ZipEntries, ZipEntry,
+    ZipFileHeaderRecord, ZipLocator, ZipReader, ZipSliceArchive, ZipSliceEntries, ZipSliceEntry,
+    ZipSliceVerifier, ZipVerifier,
+    extra_fields::{ExtraFieldId, ExtraFields},
+};
+use zerocopy::{FromZeros, IntoBytes, little_endian};
+use zerocopy_derive::{FromBytes, Immutable, IntoBytes, KnownLayout, Unaligned};
+
+use crate::{
+    format::compression::{self, CompressedFormat, CompressedReader, CompressedWriter},
+    stream::ReadAt,
+};
+
+pub trait ZipFileHeaderRecordExt<'a> {
+    fn file_path_utf8(&self) -> Result<&'a str, rawzip::Error>;
 }

-impl<W: Write> SeekWriter<W> {
-    pub fn into_inner(self) -> W {
-        self.inner
+impl<'a> ZipFileHeaderRecordExt<'a> for ZipFileHeaderRecord<'a> {
+    fn file_path_utf8(&self) -> Result<&'a str, rawzip::Error> {
+        str::from_utf8(self.file_path().as_bytes())
+            .map_err(|e| rawzip::ErrorKind::InvalidUtf8(e).into())
    }
 }

-impl<W: Write + Seek> SeekWriter<W> {
-    pub fn new(inner: W) -> Self {
-        Self {
-            inner,
-            seek_fn: W::seek,
+/// Validate that the current entry's compressed data range does not overlap
+/// previously visited entries' ranges. This approach is identical to what
+/// rawzip recommends in their examples.
+fn validate_and_add_range(
+    compressed_ranges: &mut Vec<(u64, u64)>,
+    current_range: (u64, u64),
+    path: &[u8],
+) -> Result<(), rawzip::Error> {
+    let (current_start, current_end) = current_range;
+
+    let insert_pos = compressed_ranges
+        .binary_search_by_key(&current_start, |&(start, _)| start)
+        .unwrap_or_else(|pos| pos);
+
+    if insert_pos > 0 {
+        let (prev_start, prev_end) = compressed_ranges[insert_pos - 1];
+        if prev_end > current_start {
+            return Err(rawzip::ErrorKind::InvalidInput {
+                msg: format!("{:?} ({current_start}..{current_end}) overlaps previous range ({prev_start}..{prev_end})", path.as_bstr()),
+            }.into());
        }
    }
-}

-impl<W: Write> Write for SeekWriter<W> {
-    fn write(&mut self, buf: &[u8]) -> io::Result<usize> {
-        self.inner.write(buf)
+    if insert_pos < compressed_ranges.len() {
+        let (next_start, next_end) = compressed_ranges[insert_pos];
+        if current_end > next_start {
+            return Err(rawzip::ErrorKind::InvalidInput {
+                msg: format!("{:?} ({current_start}..{current_end}) overlaps next range ({next_start}..{next_end})", path.as_bstr()),
+            }.into());
+        }
    }

-    fn flush(&mut self) -> io::Result<()> {
-        self.inner.flush()
-    }
+    compressed_ranges.insert(insert_pos, current_range);
+
+    Ok(())
 }

-impl<W: Write> Seek for SeekWriter<W> {
-    fn seek(&mut self, pos: SeekFrom) -> io::Result<u64> {
-        (self.seek_fn)(&mut self.inner, pos)
-    }
-}
-
-/// This is an ugly hack to have a single type represent both seekable and
-/// streaming [`ZipWriter`]s. `W` only needs to implement [`Seek`] when creating
-/// a seekable instance via [`Self::new_seekable`].
-pub enum ZipWriterWrapper<W: Write> {
-    Streaming(ZipWriter<StreamWriter<W>>),
-    Seekable(ZipWriter<SeekWriter<W>>),
-}
-
-impl<W: Write + Seek> ZipWriterWrapper<W> {
-    pub fn new_seekable(inner: W) -> Self {
-        Self::Seekable(ZipWriter::new(SeekWriter::new(inner)))
-    }
-}
-
-impl<W: Write> ZipWriterWrapper<W> {
-    pub fn new_streaming(inner: W) -> Self {
-        Self::Streaming(ZipWriter::new_stream(inner))
+/// Validate that the entry's compression ratio is not excessively large, based
+/// on a constant factor for [`CompressionMethod::Deflate`]. This approach is
+/// identical to what rawzip recommends in their examples.
+fn validate_compression_ratio(
+    compressed_size: u64,
+    uncompressed_size: u64,
+    path: &[u8],
+) -> Result<(), rawzip::Error> {
+    if compressed_size > 0 && uncompressed_size / compressed_size > 1032 {
+        #[allow(clippy::cast_precision_loss)]
+        return Err(rawzip::ErrorKind::InvalidInput {
+            msg: format!(
+                "{:?} has excessively large compression ratio: {})",
+                path.as_bstr(),
+                uncompressed_size as f64 / compressed_size as f64,
+            ),
+        }
+        .into());
    }

-    pub fn start_file(
+    Ok(())
+}
+
+#[derive(Debug)]
+pub struct ZipEntriesSafe<'archive, 'buf, R> {
+    archive: &'archive ZipArchive<R>,
+    entries: ZipEntries<'archive, 'buf, R>,
+    compressed_ranges: Vec<(u64, u64)>,
+}
+
+impl<R: ReaderAt> ZipEntriesSafe<'_, '_, R> {
+    #[inline]
+    pub fn next_entry(
        &mut self,
-        name: impl ToString,
-        options: FileOptions<impl FileOptionExtension>,
-    ) -> ZipResult<u64> {
-        match self {
-            Self::Streaming(z) => z.start_file(name, options),
-            Self::Seekable(z) => z.start_file(name, options),
-        }
-    }
+    ) -> Result<Option<(ZipFileHeaderRecord<'_>, ZipEntry<'_, R>)>, rawzip::Error> {
+        let cd_entry = self.entries.next_entry()?;
+        let Some(cd_entry) = cd_entry else {
+            return Ok(None);
+        };

-    pub fn finish(self) -> ZipResult<W> {
-        match self {
-            Self::Streaming(z) => Ok(z.finish()?.into_inner()),
-            Self::Seekable(z) => Ok(z.finish()?.into_inner()),
+        validate_compression_ratio(
+            cd_entry.compressed_size_hint(),
+            cd_entry.uncompressed_size_hint(),
+            cd_entry.file_path().as_ref(),
+        )?;
+
+        let entry = self.archive.get_entry(cd_entry.wayfinder())?;
+
+        validate_and_add_range(
+            &mut self.compressed_ranges,
+            entry.compressed_data_range(),
+            cd_entry.file_path().as_ref(),
+        )?;
+
+        Ok(Some((cd_entry, entry)))
+    }
+}
+
+pub trait ZipEntriesSafeExt<R> {
+    fn entries_safe<'archive, 'buf>(
+        &'archive self,
+        buffer: &'buf mut [u8],
+    ) -> ZipEntriesSafe<'archive, 'buf, R>;
+}
+
+impl<R> ZipEntriesSafeExt<R> for ZipArchive<R> {
+    fn entries_safe<'archive, 'buf>(
+        &'archive self,
+        buffer: &'buf mut [u8],
+    ) -> ZipEntriesSafe<'archive, 'buf, R> {
+        let entries = self.entries(buffer);
+
+        ZipEntriesSafe {
+            archive: self,
+            entries,
+            compressed_ranges: Vec::new(),
        }
    }
 }

-impl<W: Write> Write for ZipWriterWrapper<W> {
-    fn write(&mut self, buf: &[u8]) -> io::Result<usize> {
-        match self {
-            Self::Streaming(z) => z.write(buf),
-            Self::Seekable(z) => z.write(buf),
-        }
+impl<R, T: ZipEntriesSafeExt<R>> ZipEntriesSafeExt<R> for &T {
+    fn entries_safe<'archive, 'buf>(
+        &'archive self,
+        buffer: &'buf mut [u8],
+    ) -> ZipEntriesSafe<'archive, 'buf, R> {
+        (**self).entries_safe(buffer)
    }
+}

-    fn flush(&mut self) -> io::Result<()> {
-        match self {
-            Self::Streaming(z) => z.flush(),
-            Self::Seekable(z) => z.flush(),
+impl<R, T: ZipEntriesSafeExt<R>> ZipEntriesSafeExt<R> for &mut T {
+    fn entries_safe<'archive, 'buf>(
+        &'archive self,
+        buffer: &'buf mut [u8],
+    ) -> ZipEntriesSafe<'archive, 'buf, R> {
+        (**self).entries_safe(buffer)
+    }
+}
+
+#[derive(Debug)]
+pub struct ZipSliceEntriesSafe<'data, T: AsRef<[u8]>> {
+    archive: &'data ZipSliceArchive<T>,
+    entries: ZipSliceEntries<'data>,
+    compressed_ranges: Vec<(u64, u64)>,
+}
+
+impl<'data, T: AsRef<[u8]>> ZipSliceEntriesSafe<'data, T> {
+    #[inline]
+    pub fn next_entry(
+        &mut self,
+    ) -> Result<Option<(ZipFileHeaderRecord<'data>, ZipSliceEntry<'data>)>, rawzip::Error> {
+        let cd_entry = self.entries.next_entry()?;
+        let Some(cd_entry) = cd_entry else {
+            return Ok(None);
+        };
+
+        validate_compression_ratio(
+            cd_entry.compressed_size_hint(),
+            cd_entry.uncompressed_size_hint(),
+            cd_entry.file_path().as_ref(),
+        )?;
+
+        let entry = self.archive.get_entry(cd_entry.wayfinder())?;
+
+        validate_and_add_range(
+            &mut self.compressed_ranges,
+            entry.compressed_data_range(),
+            cd_entry.file_path().as_ref(),
+        )?;
+
+        Ok(Some((cd_entry, entry)))
+    }
+}
+
+pub trait ZipSliceEntriesSafeExt<T: AsRef<[u8]>> {
+    fn entries_safe(&self) -> ZipSliceEntriesSafe<'_, T>;
+}
+
+impl<T: AsRef<[u8]>> ZipSliceEntriesSafeExt<T> for ZipSliceArchive<T> {
+    fn entries_safe(&self) -> ZipSliceEntriesSafe<'_, T> {
+        let entries = self.entries();
+
+        ZipSliceEntriesSafe {
+            archive: self,
+            entries,
+            compressed_ranges: Vec::new(),
        }
    }
 }
+
+impl<T: AsRef<[u8]>, U: ZipSliceEntriesSafeExt<T>> ZipSliceEntriesSafeExt<T> for &U {
+    fn entries_safe(&self) -> ZipSliceEntriesSafe<'_, T> {
+        (**self).entries_safe()
+    }
+}
+
+impl<T: AsRef<[u8]>, U: ZipSliceEntriesSafeExt<T>> ZipSliceEntriesSafeExt<T> for &mut U {
+    fn entries_safe(&self) -> ZipSliceEntriesSafe<'_, T> {
+        (**self).entries_safe()
+    }
+}
+
+fn compression_method_to_format(
+    compression_method: CompressionMethod,
+) -> Result<CompressedFormat, rawzip::Error> {
+    match compression_method {
+        CompressionMethod::Store => Ok(CompressedFormat::None),
+        CompressionMethod::Deflate => Ok(CompressedFormat::Deflate),
+        c => Err(rawzip::ErrorKind::InvalidInput {
+            msg: format!("Unsupported compression method: {c:?}"),
+        }
+        .into()),
+    }
+}
+
+pub fn compressed_reader<'archive, R: ReaderAt>(
+    entry: &ZipEntry<'archive, R>,
+    compression_method: CompressionMethod,
+) -> Result<CompressedReader<ZipReader<&'archive R>>, rawzip::Error> {
+    let format = compression_method_to_format(compression_method)?;
+
+    CompressedReader::with_format(entry.reader(), format)
+        .map_err(|e| rawzip::ErrorKind::InvalidInput { msg: e.to_string() }.into())
+}
+
+pub fn compressed_slice_reader<'archive>(
+    entry: &ZipSliceEntry<'archive>,
+    compression_method: CompressionMethod,
+) -> Result<CompressedReader<Cursor<&'archive [u8]>>, rawzip::Error> {
+    let format = compression_method_to_format(compression_method)?;
+    let raw_reader = Cursor::new(entry.data());
+
+    CompressedReader::with_format(raw_reader, format)
+        .map_err(|e| rawzip::ErrorKind::InvalidInput { msg: e.to_string() }.into())
+}
+
+pub fn verifying_reader<'archive, R: ReaderAt>(
+    entry: &ZipEntry<'archive, R>,
+    compression_method: CompressionMethod,
+) -> Result<ZipVerifier<CompressedReader<ZipReader<&'archive R>>, &'archive R>, rawzip::Error> {
+    compressed_reader(entry, compression_method).map(|r| entry.verifying_reader(r))
+}
+
+pub fn verifying_slice_reader<'archive>(
+    entry: &ZipSliceEntry<'archive>,
+    compression_method: CompressionMethod,
+) -> Result<ZipSliceVerifier<CompressedReader<Cursor<&'archive [u8]>>>, rawzip::Error> {
+    compressed_slice_reader(entry, compression_method).map(|r| entry.verifying_reader(r))
+}
+
+pub fn compressed_writer<W: Write>(
+    writer: W,
+    compression_method: CompressionMethod,
+) -> Result<CompressedWriter<W>, rawzip::Error> {
+    use compression::Error;
+
+    let format = compression_method_to_format(compression_method)?;
+
+    match CompressedWriter::new(writer, format) {
+        Ok(w) => Ok(w),
+        Err(
+            Error::Lz4EncodeInit(e)
+            | Error::XzEncodeInit(e)
+            | Error::LzmaDecodeInit(e)
+            | Error::LzmaEncodeInit(e),
+        ) => Err(e.into()),
+        Err(Error::UnknownFormat | Error::AutoDetect(_)) => unreachable!(),
+    }
+}
+
+pub trait ZipArchiveReadAtExt {
+    fn from_read_at<R: ReadAt>(
+        file: R,
+        buffer: &mut [u8],
+    ) -> Result<ZipArchive<ReaderAtWrapper<R>>, rawzip::Error> {
+        let end_offset = file.file_len()?;
+
+        ZipLocator::new()
+            .locate_in_reader(ReaderAtWrapper(file), buffer, end_offset)
+            .map_err(|(_, e)| e)
+    }
+}
+
+impl ZipArchiveReadAtExt for ZipArchive<()> {}
+
+pub struct ReaderAtWrapper<R: ReadAt>(pub R);
+
+impl<R: ReadAt> ReaderAt for ReaderAtWrapper<R> {
+    fn read_at(&self, buf: &mut [u8], offset: u64) -> io::Result<usize> {
+        ReadAt::read_at(&self.0, buf, offset)
+    }
+}
+
+#[derive(Clone, Copy, FromBytes, IntoBytes, KnownLayout, Immutable, Unaligned)]
+#[repr(C, packed)]
+struct ZipLocalHeader {
+    signature: little_endian::U32,
+    version_needed: little_endian::U16,
+    flags: little_endian::U16,
+    compression_method: little_endian::U16,
+    last_mod_time: little_endian::U16,
+    last_mod_date: little_endian::U16,
+    crc32: little_endian::U32,
+    compressed_size: little_endian::U32,
+    uncompressed_size: little_endian::U32,
+    file_name_len: little_endian::U16,
+    extra_field_len: little_endian::U16,
+}
+
+/// Convert a streaming zip into a non-streaming one. If any entry uses ZIP64,
+/// the local header must contain an [`ExtraFieldId::ANDROID_ZIP_ALIGNMENT`]
+/// extra field with sufficient size (16 bytes to be safe). This is used as
+/// reserved space for creating a new [`ExtraFieldId::ZIP64`] extra field. Any
+/// leftover space must be at least 4 bytes so that a new extra field can
+/// consume the space. The existing data descriptor will remain in the gap
+/// between entries and data will not be shifted.
+pub fn make_non_streaming(file: impl Read + Write + Seek) -> Result<(), rawzip::Error> {
+    // rawzip currently does not expose the CRC32 value, so we'll have to read
+    // it ourselves.
+    struct EntryInfo {
+        local_header_offset: u64,
+        central_header_offset: u64,
+        crc32: u32,
+        compressed_size: u64,
+        uncompressed_size: u64,
+        local_extra_fields: Vec<u8>,
+    }
+
+    let mut to_update = vec![];
+
+    let mut central_buffer = vec![0u8; RECOMMENDED_BUFFER_SIZE];
+    let mut local_buffer = vec![0u8; RECOMMENDED_BUFFER_SIZE];
+    let archive = ZipArchive::from_seekable(file, &mut central_buffer)?;
+    let mut entries = archive.entries_safe(&mut central_buffer);
+
+    while let Some((cd_entry, entry)) = entries.next_entry()? {
+        let wf = cd_entry.wayfinder();
+
+        let local_header = entry.local_header(&mut local_buffer)?;
+
+        to_update.push(EntryInfo {
+            local_header_offset: cd_entry.local_header_offset(),
+            central_header_offset: cd_entry.central_directory_offset(),
+            crc32: cd_entry.crc32(),
+            compressed_size: wf.compressed_size_hint(),
+            uncompressed_size: wf.uncompressed_size_hint(),
+            local_extra_fields: local_header.extra_fields().remaining_bytes().to_vec(),
+        });
+    }
+
+    let mut file = archive.into_inner().into_inner();
+
+    for entry in to_update {
+        // Clear the central header's streaming flag.
+        let mut central_flags = little_endian::U16::new(0);
+        file.seek(SeekFrom::Start(entry.central_header_offset + 8))?;
+        file.read_exact(central_flags.as_mut_bytes())?;
+        central_flags &= !0x8;
+        file.seek_relative(-(central_flags.as_bytes().len() as i64))?;
+        file.write_all(central_flags.as_bytes())?;
+
+        file.seek(SeekFrom::Start(entry.local_header_offset))?;
+
+        let mut local_header = ZipLocalHeader::new_zeroed();
+        file.read_exact(local_header.as_mut_bytes())?;
+
+        // Clear the local header's streaming flag.
+        local_header.flags &= !0x8;
+
+        // Remove dependency on the data descriptor.
+        local_header.crc32.set(entry.crc32);
+
+        let compressed_is_zip64 = entry.compressed_size >= 0xffffffff;
+        let uncompressed_is_zip64 = entry.uncompressed_size >= 0xffffffff;
+
+        if compressed_is_zip64 {
+            local_header.compressed_size.set(0xffffffff);
+        } else {
+            local_header
+                .compressed_size
+                .set(entry.compressed_size as u32);
+        }
+
+        if uncompressed_is_zip64 {
+            local_header.uncompressed_size.set(0xffffffff);
+        } else {
+            local_header
+                .uncompressed_size
+                .set(entry.uncompressed_size as u32);
+        }
+
+        file.seek_relative(-(local_header.as_bytes().len() as i64))?;
+        file.write_all(local_header.as_bytes())?;
+
+        file.seek_relative(i64::from(local_header.file_name_len.get()))?;
+
+        if !compressed_is_zip64 && !uncompressed_is_zip64 {
+            continue;
+        }
+
+        let mut extra_fields = Vec::with_capacity(entry.local_extra_fields.len());
+        let mut patched_placeholder = false;
+
+        for (id, data) in ExtraFields::new(&entry.local_extra_fields) {
+            if id == ExtraFieldId::ANDROID_ZIP_ALIGNMENT {
+                let zip64_len =
+                    8 * (usize::from(compressed_is_zip64) + usize::from(uncompressed_is_zip64));
+
+                // Any unused space needs to be at least 4 bytes, so we can
+                // properly write a new extra field for padding.
+                let have_needed_space = match data.len().cmp(&zip64_len) {
+                    Ordering::Less => false,
+                    Ordering::Equal => true,
+                    Ordering::Greater => data.len() - zip64_len >= 4,
+                };
+                if !have_needed_space {
+                    return Err(rawzip::ErrorKind::InvalidInput {
+                        msg: format!(
+                            "Invalid reserved ZIP64 local extra field size: {}",
+                            data.len()
+                        ),
+                    }
+                    .into());
+                }
+
+                // The order is indeed backwards compared to the header
+                // fields (APPNOTE 4.5.3).
+                extra_fields.extend_from_slice(&ExtraFieldId::ZIP64.as_u16().to_le_bytes());
+                extra_fields.extend_from_slice(&(zip64_len as u16).to_le_bytes());
+                if uncompressed_is_zip64 {
+                    extra_fields.extend_from_slice(&entry.uncompressed_size.to_le_bytes());
+                }
+                if compressed_is_zip64 {
+                    extra_fields.extend_from_slice(&entry.compressed_size.to_le_bytes());
+                }
+
+                // Keep using ANDROID_ZIP_ALIGNMENT for padding.
+                if data.len() > zip64_len {
+                    let padding_len = data.len() - zip64_len - 4;
+                    extra_fields.extend_from_slice(&id.as_u16().to_le_bytes());
+                    extra_fields.extend_from_slice(&(padding_len as u16).to_le_bytes());
+                    extra_fields.resize(extra_fields.len() + padding_len, 0);
+                }
+
+                patched_placeholder = true;
+            } else if id == ExtraFieldId::ZIP64 {
+                return Err(rawzip::ErrorKind::InvalidInput {
+                    msg: "Unexpected ZIP64 extra field present".to_owned(),
+                }
+                .into());
+            } else {
+                extra_fields.extend_from_slice(&id.as_u16().to_le_bytes());
+                extra_fields.extend_from_slice(&(data.len() as u16).to_le_bytes());
+                extra_fields.extend_from_slice(data);
+            }
+        }
+
+        assert_eq!(extra_fields.len(), entry.local_extra_fields.len());
+
+        if !patched_placeholder {
+            return Err(rawzip::ErrorKind::InvalidInput {
+                msg: "ZIP64 required, but no placeholder extra field found".to_owned(),
+            }
+            .into());
+        }
+
+        file.write_all(&extra_fields)?;
+    }
+
+    Ok(())
+}
@@ -1,7 +1,7 @@
 // SPDX-FileCopyrightText: 2023 Andrew Gunnerson
 // SPDX-License-Identifier: GPL-3.0-only

-//! Hack to format an integer as an octal string because toml_edit can't output
+//! Hack to format an integer as an octal string because toml can't output
 //! octal-formatted integers and many other toml parsers can't parse it either.

 use std::{
@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: GPL-3.0-only

 use std::{
+    borrow::Cow,
    cmp::Ordering,
    collections::{HashMap, HashSet},
    fmt::Write,
@@ -15,7 +16,8 @@ use std::{
 };

 use bstr::ByteSlice;
-use lzma_rust2::{CheckType, XZOptions, XZWriter};
+use lzma_rust2::{CheckType, XzOptions, XzWriter};
+use rawzip::{RECOMMENDED_BUFFER_SIZE, ZipArchive};
 use rayon::iter::{IntoParallelRefIterator, IntoParallelRefMutIterator, ParallelIterator};
 use regex::bytes::Regex;
 use ring::digest::Context;
@@ -23,7 +25,6 @@ use rsa::RsaPublicKey;
 use thiserror::Error;
 use tracing::{Span, debug, debug_span, trace, warn};
 use x509_cert::Certificate;
-use zip::{ZipArchive, result::ZipError};

 use crate::{
    crypto::{self, RsaSigningKey},
@@ -32,6 +33,7 @@ use crate::{
        bootimage::{self, BootImage, BootImageExt, RamdiskMeta},
        compression::{self, CompressedFormat, CompressedReader, CompressedWriter},
        cpio::{self, CpioEntry, CpioEntryData},
+        zip::{self, ZipEntriesSafeExt, ZipFileHeaderRecordExt, ZipSliceEntriesSafeExt},
    },
    patch::otacert::{self, OtaCertBuildFlags},
    stream::{self, FromReader, HashingWriter, ReadSeek, SectionReader, ToWriter, WriteSeek},
@@ -85,13 +87,15 @@ pub enum Error {
    #[error("Failed to XZ compress entry: {:?}", .0.as_bstr())]
    XzCompress(Vec<u8>, #[source] io::Error),
    #[error("Failed to open zip file: {0:?}")]
-    ZipOpen(PathBuf, #[source] ZipError),
+    ZipOpen(PathBuf, #[source] rawzip::Error),
+    #[error("Failed to list zip entries")]
+    ZipEntryList(#[source] rawzip::Error),
+    #[error("Missing zip entry: {0:?}")]
+    ZipEntryMissing(Cow<'static, str>),
    #[error("Failed to open zip entry: {0:?}")]
-    ZipEntryOpen(&'static str, #[source] ZipError),
+    ZipEntryOpen(Cow<'static, str>, #[source] rawzip::Error),
    #[error("Failed to read zip entry: {0:?}")]
-    ZipEntryRead(&'static str, #[source] io::Error),
-    #[error("Failed to open zip entry #{0}")]
-    ZipIndexOpen(usize, #[source] ZipError),
+    ZipEntryRead(Cow<'static, str>, #[source] io::Error),
    #[error("Failed to open file: {0:?}")]
    FileOpen(PathBuf, #[source] io::Error),
 }
@@ -135,10 +139,13 @@ fn load_ramdisk(
 }

 fn save_ramdisk(
-    entries: &[CpioEntry],
+    entries: &mut [CpioEntry],
    format: CompressedFormat,
    cancel_signal: &AtomicBool,
 ) -> Result<Vec<u8>> {
+    cpio::sort(entries);
+    cpio::assign_inodes(entries, false).map_err(Error::RamdiskSaveCpio)?;
+
    let raw_writer = Cursor::new(vec![]);
    let mut writer =
        CompressedWriter::new(raw_writer, format).map_err(Error::RamdiskSaveCompression)?;
@@ -152,6 +159,12 @@ fn save_ramdisk(
    Ok(raw_writer.into_inner())
 }

+#[derive(Clone, Copy, Eq, PartialEq)]
+pub struct BootLayoutInfo {
+    pub has_recovery: bool,
+}
+
+#[derive(Clone, Eq, PartialEq)]
 pub struct BootImageInfo {
    pub header: Header,
    pub footer: Footer,
@@ -167,11 +180,17 @@ pub trait BootImagePatch {
    /// can be inspected, but during patching, only the boot image is available.
    fn find_targets<'a>(
        &self,
+        layout: BootLayoutInfo,
        boot_images: &HashMap<&'a str, BootImageInfo>,
        cancel_signal: &AtomicBool,
    ) -> TargetsResult<Vec<&'a str>>;

-    fn patch(&self, boot_image: &mut BootImage, cancel_signal: &AtomicBool) -> Result<()>;
+    fn patch(
+        &self,
+        layout: BootLayoutInfo,
+        boot_image: &mut BootImage,
+        cancel_signal: &AtomicBool,
+    ) -> Result<()>;
 }

 /// Root a boot image with Magisk.
@@ -192,11 +211,12 @@ impl MagiskRootPatcher {
    //   replaced by PREINITDEVICE
    // - Versions newer than the latest supported version are assumed to support
    //   the same features as the latest version
-    const VERS_SUPPORTED: &'static [Range<u32>] = &[25102..25207, 25211..30300];
+    const VERS_SUPPORTED: &'static [Range<u32>] = &[25102..25207, 25211..30800];
    const VER_PREINIT_DEVICE: RangeFrom<u32> = 25211..;
    const VER_RANDOM_SEED: Range<u32> = 25211..26103;
    const VER_PATCH_VBMETA: Range<u32> = Self::VERS_SUPPORTED[0].start..26202;
    const VER_XZ_BACKUP: RangeFrom<u32> = 26403..;
+    const VER_VENDOR_BOOT: RangeFrom<u32> = 30300..;

    const ZIP_INIT_LD: &'static str = "lib/arm64-v8a/libinit-ld.so";
    const ZIP_LIBMAGISK: &'static str = "lib/arm64-v8a/libmagisk.so";
@@ -254,43 +274,54 @@ impl MagiskRootPatcher {
        })
    }

-    fn get_version(path: &Path) -> Result<u32> {
-        let reader = File::open(path)
-            .map(BufReader::new)
-            .map_err(|e| Error::FileOpen(path.to_owned(), e))?;
-        let mut zip = ZipArchive::new(reader).map_err(|e| Error::ZipOpen(path.to_owned(), e))?;
-        let entry = zip
-            .by_name(Self::ZIP_UTIL_FUNCTIONS)
-            .map_err(|e| Error::ZipEntryOpen(Self::ZIP_UTIL_FUNCTIONS, e))?;
-        let mut entry = BufReader::new(entry);
-        let mut line = String::new();
+    fn get_version(apk_path: &Path) -> Result<u32> {
+        let file = File::open(apk_path).map_err(|e| Error::FileOpen(apk_path.to_owned(), e))?;
+        let mut buffer = vec![0u8; RECOMMENDED_BUFFER_SIZE];
+        let archive = ZipArchive::from_file(file, &mut buffer)
+            .map_err(|e| Error::ZipOpen(apk_path.to_owned(), e))?;
+        let mut entries = archive.entries_safe(&mut buffer);

-        loop {
-            line.clear();
-            let n = entry
-                .read_line(&mut line)
-                .map_err(|e| Error::ZipEntryRead(Self::ZIP_UTIL_FUNCTIONS, e))?;
-            if n == 0 {
-                return Err(Error::FindMagiskVersion(path.to_owned()));
+        while let Some((cd_entry, entry)) = entries.next_entry().map_err(Error::ZipEntryList)? {
+            let path = cd_entry.file_path_utf8().map_err(Error::ZipEntryList)?;
+
+            if path != Self::ZIP_UTIL_FUNCTIONS {
+                continue;
            }

-            if let Some(suffix) = line.trim_end().strip_prefix("MAGISK_VER_CODE=") {
-                trace!("Magisk version code line: {line:?}");
+            let mut reader = zip::verifying_reader(&entry, cd_entry.compression_method())
+                .map(BufReader::new)
+                .map_err(|e| Error::ZipEntryOpen(Self::ZIP_UTIL_FUNCTIONS.into(), e))?;
+            let mut line = String::new();

-                let version = suffix
-                    .parse()
-                    .map_err(|e| Error::ParseMagiskVersion(suffix.to_owned(), e))?;
-                return Ok(version);
+            loop {
+                line.clear();
+                let n = reader
+                    .read_line(&mut line)
+                    .map_err(|e| Error::ZipEntryRead(Self::ZIP_UTIL_FUNCTIONS.into(), e))?;
+                if n == 0 {
+                    return Err(Error::FindMagiskVersion(apk_path.to_owned()));
+                }
+
+                if let Some(suffix) = line.trim_end().strip_prefix("MAGISK_VER_CODE=") {
+                    trace!("Magisk version code line: {line:?}");
+
+                    let version = suffix
+                        .parse()
+                        .map_err(|e| Error::ParseMagiskVersion(suffix.to_owned(), e))?;
+                    return Ok(version);
+                }
            }
        }
+
+        Err(Error::ZipEntryMissing(Self::ZIP_UTIL_FUNCTIONS.into()))
    }

    fn xz_compress(name: &[u8], reader: impl Read, cancel_signal: &AtomicBool) -> Result<Vec<u8>> {
-        let mut options = XZOptions::with_preset(9);
+        let mut options = XzOptions::with_preset(9);
        options.set_check_sum_type(CheckType::None);

        let raw_writer = Cursor::new(Vec::new());
-        let mut writer = XZWriter::new(raw_writer, options).map_err(Error::XzInit)?;
+        let mut writer = XzWriter::new(raw_writer, options).map_err(Error::XzInit)?;

        let raw_writer = stream::copy(reader, &mut writer, cancel_signal)
            .and_then(|_| writer.finish())
@@ -376,15 +407,15 @@ impl MagiskRootPatcher {
            let mut new_path = b".backup/".to_vec();
            new_path.extend(&old_entry.path);

-            let mut new_data = None;
-
-            if xz_compress && let CpioEntryData::Data(data) = &old_entry.data {
+            let new_data = if xz_compress && let CpioEntryData::Data(data) = &old_entry.data {
                new_path.extend(b".xz");

                let reader = Cursor::new(data);
                let buf = Self::xz_compress(&new_path, reader, cancel_signal)?;
-                new_data = Some(CpioEntryData::Data(buf));
-            }
+                Some(CpioEntryData::Data(buf))
+            } else {
+                None
+            };

            new_entries.push(CpioEntry {
                path: new_path,
@@ -421,6 +452,7 @@ impl BootImagePatch for MagiskRootPatcher {

    fn find_targets<'a>(
        &self,
+        _layout: BootLayoutInfo,
        boot_images: &HashMap<&'a str, BootImageInfo>,
        _cancel_signal: &AtomicBool,
    ) -> TargetsResult<Vec<&'a str>> {
@@ -435,13 +467,12 @@ impl BootImagePatch for MagiskRootPatcher {
        Ok(targets)
    }

-    fn patch(&self, boot_image: &mut BootImage, cancel_signal: &AtomicBool) -> Result<()> {
-        let zip_reader = File::open(&self.apk_path)
-            .map(BufReader::new)
-            .map_err(|e| Error::FileOpen(self.apk_path.clone(), e))?;
-        let mut zip =
-            ZipArchive::new(zip_reader).map_err(|e| Error::ZipOpen(self.apk_path.clone(), e))?;
-
+    fn patch(
+        &self,
+        _layout: BootLayoutInfo,
+        boot_image: &mut BootImage,
+        cancel_signal: &AtomicBool,
+    ) -> Result<()> {
        // Load the first ramdisk. If it doesn't exist, we have to generate one
        // from scratch.
        let ramdisk = match boot_image {
@@ -467,60 +498,95 @@ impl BootImagePatch for MagiskRootPatcher {
        // Delete the original init.
        entries.retain(|e| e.path != b"init");

-        // Add magiskinit.
-        {
-            let mut zip_entry = zip
-                .by_name(Self::ZIP_MAGISKINIT)
-                .map_err(|e| Error::ZipEntryOpen(Self::ZIP_MAGISKINIT, e))?;
-            let mut data = vec![];
-            zip_entry
-                .read_to_end(&mut data)
-                .map_err(|e| Error::ZipEntryRead(Self::ZIP_MAGISKINIT, e))?;
+        let file =
+            File::open(&self.apk_path).map_err(|e| Error::FileOpen(self.apk_path.clone(), e))?;
+        let mut buffer = vec![0u8; RECOMMENDED_BUFFER_SIZE];
+        let archive = ZipArchive::from_file(file, &mut buffer)
+            .map_err(|e| Error::ZipOpen(self.apk_path.clone(), e))?;
+
+        let mut zip_entries = archive.entries_safe(&mut buffer);
+        let mut found_magiskinit = false;
+        let mut found_libmagisk = false;
+
+        while let Some((cd_entry, entry)) = zip_entries.next_entry().map_err(Error::ZipEntryList)? {
+            let path = cd_entry.file_path_utf8().map_err(Error::ZipEntryList)?;
+
+            // magiskinit is the only entry that is not xz-compressed.
+            if path == Self::ZIP_MAGISKINIT {
+                let mut reader = zip::verifying_reader(&entry, cd_entry.compression_method())
+                    .map_err(|e| Error::ZipEntryOpen(Self::ZIP_MAGISKINIT.into(), e))?;
+                let mut data = vec![];
+
+                reader
+                    .read_to_end(&mut data)
+                    .map_err(|e| Error::ZipEntryRead(Self::ZIP_MAGISKINIT.into(), e))?;
+
+                entries.push(CpioEntry::new_file(
+                    b"init",
+                    0o750,
+                    CpioEntryData::Data(data),
+                ));
+
+                found_magiskinit = true;
+                continue;
+            }
+
+            // Keep a 'static version of the zip path.
+            let (path, cpio_path): (_, &[u8]) = match path {
+                // Newer Magisk versions only include a single binary for the
+                // target ABI in the ramdisk. This was introduced in commit
+                // fb5ee86615ed3df830e8538f8b39b1b133caea34.
+                p if p == Self::ZIP_LIBMAGISK => {
+                    debug!("Single libmagisk");
+                    found_libmagisk = true;
+                    (Self::ZIP_LIBMAGISK, b"overlay.d/sbin/magisk.xz")
+                }
+                // Older Magisk versions include the 64-bit binary and,
+                // optionally, the 32-bit binary if the device supports it. We
+                // unconditionally include the magisk32 because the boot image
+                // itself doesn't have sufficient information to determine if a
+                // device is 64-bit only.
+                p if p == Self::ZIP_LIBMAGISK32 => {
+                    debug!("Split libmagisk32");
+                    found_libmagisk = true;
+                    (Self::ZIP_LIBMAGISK32, b"overlay.d/sbin/magisk32.xz")
+                }
+                p if p == Self::ZIP_LIBMAGISK64 => {
+                    debug!("Split libmagisk64");
+                    found_libmagisk = true;
+                    (Self::ZIP_LIBMAGISK64, b"overlay.d/sbin/magisk64.xz")
+                }
+                // The stub apk was introduced in commit
+                // ad0e6511e11ebec65aa9b5b916e1397342850319.
+                p if p == Self::ZIP_STUB => {
+                    debug!("Magisk stub found");
+                    (Self::ZIP_STUB, b"overlay.d/sbin/stub.xz")
+                }
+                // init-ld was introduced in commit
+                // 33aebb59763b6ec27209563035303700e998633d.
+                p if p == Self::ZIP_INIT_LD => {
+                    debug!("Magisk init-ld found");
+                    (Self::ZIP_INIT_LD, b"overlay.d/sbin/init-ld.xz")
+                }
+                _ => continue,
+            };
+
+            let reader = zip::verifying_reader(&entry, cd_entry.compression_method())
+                .map_err(|e| Error::ZipEntryOpen(path.into(), e))?;
+
+            let buf = Self::xz_compress(path.as_bytes(), reader, cancel_signal)?;

            entries.push(CpioEntry::new_file(
-                b"init",
-                0o750,
-                CpioEntryData::Data(data),
+                cpio_path,
+                0o644,
+                CpioEntryData::Data(buf),
            ));
        }

-        let mut xz_files = HashMap::<&str, &[u8]>::new();
-        if zip.file_names().any(|n| n == Self::ZIP_LIBMAGISK) {
-            // Newer Magisk versions only include a single binary for the target
-            // ABI in the ramdisk. fb5ee86615ed3df830e8538f8b39b1b133caea34.
-            debug!("Single libmagisk");
-            xz_files.insert(Self::ZIP_LIBMAGISK, b"overlay.d/sbin/magisk.xz");
-        } else {
-            // Older Magisk versions include the 64-bit binary and, optionally,
-            // the 32-bit binary if the device supports it. We unconditionally
-            // include the magisk32 because the boot image itself doesn't have
-            // sufficient information to determine if a device is 64-bit only.
-            debug!("Split libmagisk32/libmagisk64");
-            xz_files.insert(Self::ZIP_LIBMAGISK32, b"overlay.d/sbin/magisk32.xz");
-            xz_files.insert(Self::ZIP_LIBMAGISK64, b"overlay.d/sbin/magisk64.xz");
-        }
-
-        // Add stub apk, which only exists after Magisk commit
-        // ad0e6511e11ebec65aa9b5b916e1397342850319.
-        if zip.file_names().any(|n| n == Self::ZIP_STUB) {
-            debug!("Magisk stub found");
-            xz_files.insert(Self::ZIP_STUB, b"overlay.d/sbin/stub.xz");
-        }
-
-        // Add init-ld, which only exists after Magisk commit
-        // 33aebb59763b6ec27209563035303700e998633d
-        if zip.file_names().any(|n| n == Self::ZIP_INIT_LD) {
-            debug!("Magisk init-ld found");
-            xz_files.insert(Self::ZIP_INIT_LD, b"overlay.d/sbin/init-ld.xz");
-        }
-
-        for (source, target) in xz_files {
-            let reader = zip
-                .by_name(source)
-                .map_err(|e| Error::ZipEntryOpen(source, e))?;
-            let buf = Self::xz_compress(source.as_bytes(), reader, cancel_signal)?;
-
-            entries.push(CpioEntry::new_file(target, 0o644, CpioEntryData::Data(buf)));
+        if !found_magiskinit {
+            return Err(Error::ZipEntryMissing(Self::ZIP_MAGISKINIT.into()));
+        } else if !found_libmagisk {
+            return Err(Error::ZipEntryMissing(Self::ZIP_LIBMAGISK.into()));
        }

        // Create Magisk .backup directory structure.
@@ -542,6 +608,13 @@ impl BootImagePatch for MagiskRootPatcher {

        magisk_config.push_str("RECOVERYMODE=false\n");

+        // We never install Magisk into the init_boot.cpio within the
+        // vendor_boot ramdisk. This config option was introduced in commit
+        // 742913ebcb10cf819a54699497359535047874f7.
+        if Self::VER_VENDOR_BOOT.contains(&self.version) {
+            magisk_config.push_str("VENDORBOOT=false\n");
+        }
+
        if Self::VER_PREINIT_DEVICE.contains(&self.version)
            && let Some(device) = &self.preinit_device
        {
@@ -567,9 +640,7 @@ impl BootImagePatch for MagiskRootPatcher {
        ));

        // Repack ramdisk.
-        cpio::sort(&mut entries);
-        cpio::assign_inodes(&mut entries, false).map_err(Error::RamdiskSaveCpio)?;
-        let new_ramdisk = save_ramdisk(&entries, ramdisk_format, cancel_signal)?;
+        let new_ramdisk = save_ramdisk(&mut entries, ramdisk_format, cancel_signal)?;

        match boot_image {
            BootImage::V0Through2(b) => b.ramdisk = new_ramdisk,
@@ -602,7 +673,7 @@ pub struct OtaCertPatcher {
 }

 impl OtaCertPatcher {
-    const OTACERTS_PATH: &'static [u8] = b"system/etc/security/otacerts.zip";
+    const OTACERTS_PATH: &'static str = "system/etc/security/otacerts.zip";

    pub fn new(cert: Certificate) -> Self {
        Self { cert }
@@ -628,29 +699,33 @@ impl OtaCertPatcher {
            }

            let (entries, _) = load_ramdisk(ramdisk, cancel_signal)?;
-            let Some(entry) = entries.iter().find(|e| e.path == Self::OTACERTS_PATH) else {
+            let Some(entry) = entries
+                .iter()
+                .find(|e| e.path == Self::OTACERTS_PATH.as_bytes())
+            else {
                continue;
            };
            let CpioEntryData::Data(data) = &entry.data else {
                continue;
            };

-            let mut zip = ZipArchive::new(Cursor::new(&data)).map_err(|e| {
-                Error::ZipOpen(str::from_utf8(Self::OTACERTS_PATH).unwrap().into(), e)
-            })?;
+            let archive = ZipArchive::from_slice(data)
+                .map_err(|e| Error::ZipOpen(Self::OTACERTS_PATH.into(), e))?;
+            let mut entries = archive.entries_safe();

-            for index in 0..zip.len() {
-                let zip_entry = zip
-                    .by_index(index)
-                    .map_err(|e| Error::ZipIndexOpen(index, e))?;
-                if !zip_entry.name().ends_with(".x509.pem") {
-                    debug!("Skipping invalid entry path: {}", zip_entry.name());
+            while let Some((cd_entry, entry)) = entries.next_entry().map_err(Error::ZipEntryList)? {
+                let path = cd_entry.file_path_utf8().map_err(Error::ZipEntryList)?;
+
+                if !path.ends_with(".x509.pem") {
+                    debug!("Skipping invalid entry path: {path:?}");
                    continue;
                }

-                let path = PathBuf::from(zip_entry.name());
+                let reader = zip::verifying_slice_reader(&entry, cd_entry.compression_method())
+                    .map_err(|e| Error::ZipEntryOpen(path.to_owned().into(), e))?;
+
                let certificate =
-                    crypto::read_pem_cert(&path, zip_entry).map_err(Error::OtaCertLoad)?;
+                    crypto::read_pem_cert(Path::new(path), reader).map_err(Error::OtaCertLoad)?;
                certificates.push(certificate);
            }
        }
@@ -664,7 +739,10 @@ impl OtaCertPatcher {
        cancel_signal: &AtomicBool,
    ) -> Result<bool> {
        let (mut entries, ramdisk_format) = load_ramdisk(ramdisk, cancel_signal)?;
-        let Some(entry) = entries.iter_mut().find(|e| e.path == Self::OTACERTS_PATH) else {
+        let Some(entry) = entries
+            .iter_mut()
+            .find(|e| e.path == Self::OTACERTS_PATH.as_bytes())
+        else {
            return Ok(false);
        };

@@ -673,7 +751,7 @@ impl OtaCertPatcher {
        entry.data = CpioEntryData::Data(zip.to_vec());

        // Repack ramdisk.
-        *ramdisk = save_ramdisk(&entries, ramdisk_format, cancel_signal)?;
+        *ramdisk = save_ramdisk(&mut entries, ramdisk_format, cancel_signal)?;

        Ok(true)
    }
@@ -686,6 +764,7 @@ impl BootImagePatch for OtaCertPatcher {

    fn find_targets<'a>(
        &self,
+        _layout: BootLayoutInfo,
        boot_images: &HashMap<&'a str, BootImageInfo>,
        cancel_signal: &AtomicBool,
    ) -> TargetsResult<Vec<&'a str>> {
@@ -705,7 +784,10 @@ impl BootImagePatch for OtaCertPatcher {

                let (entries, _) = load_ramdisk(ramdisk, cancel_signal)
                    .map_err(|e| TargetsError::Load(name.to_owned(), e))?;
-                if entries.iter().any(|e| e.path == Self::OTACERTS_PATH) {
+                if entries
+                    .iter()
+                    .any(|e| e.path == Self::OTACERTS_PATH.as_bytes())
+                {
                    targets.push(name);
                    continue 'outer;
                }
@@ -715,7 +797,12 @@ impl BootImagePatch for OtaCertPatcher {
        Ok(targets)
    }

-    fn patch(&self, boot_image: &mut BootImage, cancel_signal: &AtomicBool) -> Result<()> {
+    fn patch(
+        &self,
+        _layout: BootLayoutInfo,
+        boot_image: &mut BootImage,
+        cancel_signal: &AtomicBool,
+    ) -> Result<()> {
        let ramdisks = match boot_image {
            BootImage::V0Through2(b) => slice::from_mut(&mut b.ramdisk),
            BootImage::V3Through4(b) => slice::from_mut(&mut b.ramdisk),
@@ -740,7 +827,7 @@ impl BootImagePatch for OtaCertPatcher {
        // out of future updates if the OTA certificate mechanism has changed.
        Err(Error::Validation(format!(
            "No ramdisk contains {:?}",
-            Self::OTACERTS_PATH.as_bstr(),
+            Self::OTACERTS_PATH,
        )))
    }
 }
@@ -754,34 +841,49 @@ impl DsuPubKeyPatcher {
    const FIRST_STAGE_PATH: &'static [u8] = b"first_stage_ramdisk";
    const DSU_KEYS_PATH: &'static [u8] = b"first_stage_ramdisk/avb";
    const AVBROOT_KEY_PATH: &'static [u8] = b"first_stage_ramdisk/avb/avbroot.avbpubkey";
+    const RECOVERY_DSU_KEYS_PATH: &'static [u8] = b"avb";
+    const RECOVERY_AVBROOT_KEY_PATH: &'static [u8] = b"avb/avbroot.avbpubkey";

    pub fn new(key: RsaPublicKey) -> Self {
        Self { key }
    }

-    fn patch_ramdisk(&self, ramdisk: &mut Vec<u8>, cancel_signal: &AtomicBool) -> Result<bool> {
+    fn patch_ramdisk(
+        &self,
+        layout: BootLayoutInfo,
+        ramdisk: &mut Vec<u8>,
+        cancel_signal: &AtomicBool,
+    ) -> Result<bool> {
        let (mut entries, ramdisk_format) = load_ramdisk(ramdisk, cancel_signal)?;
        if !entries.iter_mut().any(|e| e.path == Self::FIRST_STAGE_PATH) {
            return Ok(false);
        }

-        if !entries.iter().any(|e| e.path == Self::DSU_KEYS_PATH) {
-            entries.push(CpioEntry::new_directory(Self::DSU_KEYS_PATH, 0o755));
+        let (dsu_keys_path, avbroot_key_path) = if layout.has_recovery {
+            (
+                Self::RECOVERY_DSU_KEYS_PATH,
+                Self::RECOVERY_AVBROOT_KEY_PATH,
+            )
+        } else {
+            (Self::DSU_KEYS_PATH, Self::AVBROOT_KEY_PATH)
+        };
+
+        debug!("DSU key path: {:?}", avbroot_key_path.as_bstr());
+
+        if !entries.iter().any(|e| e.path == dsu_keys_path) {
+            entries.push(CpioEntry::new_directory(dsu_keys_path, 0o755));
        }

        let binary_key = avb::encode_public_key(&self.key).map_err(Error::AvbEncodeKey)?;
        let data = CpioEntryData::Data(binary_key);

-        if let Some(e) = entries
-            .iter_mut()
-            .find(|e| e.path == Self::AVBROOT_KEY_PATH)
-        {
+        if let Some(e) = entries.iter_mut().find(|e| e.path == avbroot_key_path) {
            e.data = data;
        } else {
-            entries.push(CpioEntry::new_file(Self::AVBROOT_KEY_PATH, 0o644, data));
+            entries.push(CpioEntry::new_file(avbroot_key_path, 0o644, data));
        }

-        *ramdisk = save_ramdisk(&entries, ramdisk_format, cancel_signal)?;
+        *ramdisk = save_ramdisk(&mut entries, ramdisk_format, cancel_signal)?;

        Ok(true)
    }
@@ -794,6 +896,7 @@ impl BootImagePatch for DsuPubKeyPatcher {

    fn find_targets<'a>(
        &self,
+        layout: BootLayoutInfo,
        boot_images: &HashMap<&'a str, BootImageInfo>,
        cancel_signal: &AtomicBool,
    ) -> TargetsResult<Vec<&'a str>> {
@@ -807,6 +910,12 @@ impl BootImagePatch for DsuPubKeyPatcher {
                BootImage::VendorV3Through4(b) => &b.ramdisks,
            };

+            let dsu_keys_path = if layout.has_recovery {
+                Self::RECOVERY_DSU_KEYS_PATH
+            } else {
+                Self::DSU_KEYS_PATH
+            };
+
            for ramdisk in ramdisks {
                if ramdisk.is_empty() {
                    continue;
@@ -817,10 +926,12 @@ impl BootImagePatch for DsuPubKeyPatcher {
                let mut found = false;

                for entry in entries {
-                    if entry.path == Self::DSU_KEYS_PATH {
+                    if entry.path == dsu_keys_path {
                        dsu_keys_targets.push(name);
                        found = true;
                    } else if entry.path == Self::FIRST_STAGE_PATH {
+                        // This exists even on devices with recovery partitions.
+                        // init just doesn't switch root to it.
                        first_stage_targets.push(name);
                        found = true;
                    }
@@ -854,7 +965,12 @@ impl BootImagePatch for DsuPubKeyPatcher {
        }
    }

-    fn patch(&self, boot_image: &mut BootImage, cancel_signal: &AtomicBool) -> Result<()> {
+    fn patch(
+        &self,
+        layout: BootLayoutInfo,
+        boot_image: &mut BootImage,
+        cancel_signal: &AtomicBool,
+    ) -> Result<()> {
        let ramdisks = match boot_image {
            BootImage::V0Through2(b) => slice::from_mut(&mut b.ramdisk),
            BootImage::V3Through4(b) => slice::from_mut(&mut b.ramdisk),
@@ -866,7 +982,7 @@ impl BootImagePatch for DsuPubKeyPatcher {
                continue;
            }

-            if self.patch_ramdisk(ramdisk, cancel_signal)? {
+            if self.patch_ramdisk(layout, ramdisk, cancel_signal)? {
                return Ok(());
            }
        }
@@ -951,6 +1067,7 @@ impl BootImagePatch for PrepatchedImagePatcher {

    fn find_targets<'a>(
        &self,
+        _layout: BootLayoutInfo,
        boot_images: &HashMap<&'a str, BootImageInfo>,
        _cancel_signal: &AtomicBool,
    ) -> TargetsResult<Vec<&'a str>> {
@@ -975,7 +1092,12 @@ impl BootImagePatch for PrepatchedImagePatcher {
        Ok(targets)
    }

-    fn patch(&self, boot_image: &mut BootImage, _cancel_signal: &AtomicBool) -> Result<()> {
+    fn patch(
+        &self,
+        _layout: BootLayoutInfo,
+        boot_image: &mut BootImage,
+        _cancel_signal: &AtomicBool,
+    ) -> Result<()> {
        let prepatched_image = self.load_prepatched_image()?;

        // Level 0: Warnings that don't affect booting
@@ -1210,25 +1332,43 @@ fn save_boot_image(
    Ok(())
 }

+pub trait BootImageOpener {
+    fn open_original(&self, name: &str) -> io::Result<Box<dyn ReadSeek + Sync>>;
+
+    fn open_replacement(&self, name: &str) -> io::Result<Box<dyn WriteSeek + Sync>> {
+        Err(io::Error::new(
+            io::ErrorKind::NotFound,
+            format!("{name} boot image not found"),
+        ))
+    }
+}
+
 pub fn load_boot_images<'a>(
    names: &[&'a str],
-    open_input: impl Fn(&str) -> io::Result<Box<dyn ReadSeek>> + Sync,
-) -> TargetsResult<HashMap<&'a str, BootImageInfo>> {
+    opener: &(dyn BootImageOpener + Sync),
+) -> TargetsResult<(HashMap<&'a str, BootImageInfo>, BootLayoutInfo)> {
    let parent_span = Span::current();

-    names
+    let images = names
        .par_iter()
        .map(|&name| {
            let _span = debug_span!(parent: &parent_span, "image", name).entered();
-            let mut reader =
-                open_input(name).map_err(|e| TargetsError::Open(name.to_owned(), e))?;
+            let mut reader = opener
+                .open_original(name)
+                .map_err(|e| TargetsError::Open(name.to_owned(), e))?;

            let info =
                load_boot_image(&mut reader).map_err(|e| TargetsError::Load(name.to_owned(), e))?;

            Ok((name, info))
        })
-        .collect()
+        .collect::<TargetsResult<HashMap<_, _>>>()?;
+
+    let layout = BootLayoutInfo {
+        has_recovery: images.contains_key("recovery"),
+    };
+
+    Ok((images, layout))
 }

 /// Apply applicable patches to the list of specified boot images. For each
@@ -1238,8 +1378,7 @@ pub fn load_boot_images<'a>(
 /// be opened from multiple threads, but at most once each.
 pub fn patch_boot_images<'a>(
    names: &[&'a str],
-    open_input: impl Fn(&str) -> io::Result<Box<dyn ReadSeek>> + Sync,
-    open_output: impl Fn(&str) -> io::Result<Box<dyn WriteSeek>> + Sync,
+    opener: &(dyn BootImageOpener + Sync),
    key: &RsaSigningKey,
    patchers: &[Box<dyn BootImagePatch + Sync>],
    cancel_signal: &AtomicBool,
@@ -1252,7 +1391,7 @@ pub fn patch_boot_images<'a>(
    }

    // Preparse all images. Some patchers need to inspect every candidate.
-    let mut images = load_boot_images(names, open_input)?;
+    let (mut images, layout) = load_boot_images(names, opener)?;

    // Find the targets that each patcher wants to patch.
    let all_targets = patchers
@@ -1260,14 +1399,15 @@ pub fn patch_boot_images<'a>(
        .map(|p| {
            let _span =
                debug_span!(parent: &parent_span, "patcher", name = p.patcher_name()).entered();
-            p.find_targets(&images, cancel_signal).and_then(|targets| {
-                if targets.is_empty() {
-                    Err(TargetsError::NoTargets(p.patcher_name()))
-                } else {
-                    debug!("Found patcher targets: {targets:?}");
-                    Ok(targets)
-                }
-            })
+            p.find_targets(layout, &images, cancel_signal)
+                .and_then(|targets| {
+                    if targets.is_empty() {
+                        Err(TargetsError::NoTargets(p.patcher_name()))
+                    } else {
+                        debug!("Found patcher targets: {targets:?}");
+                        Ok(targets)
+                    }
+                })
        })
        .collect::<TargetsResult<Vec<_>>>()?;

@@ -1294,8 +1434,8 @@ pub fn patch_boot_images<'a>(
        .try_for_each(|(&name, (info, patchers))| -> TargetsResult<()> {
            patchers.iter().try_for_each(|p| {
                let _span =
-                    debug_span!(parent: &parent_span, "patcher", name = p.patcher_name()).entered();
-                p.patch(&mut info.boot_image, cancel_signal)
+                    debug_span!(parent: &parent_span, "patcher", name = p.patcher_name(), image = name).entered();
+                p.patch(layout, &mut info.boot_image, cancel_signal)
                    .map_err(|e| TargetsError::Patch(name.to_owned(), e))
            })
        })?;
@@ -1303,7 +1443,9 @@ pub fn patch_boot_images<'a>(
    // Resign and write new images.
    groups.par_iter_mut().try_for_each(|(&name, (info, _))| {
        let _span = debug_span!(parent: &parent_span, "image", name).entered();
-        let mut writer = open_output(name).map_err(|e| TargetsError::Open(name.to_owned(), e))?;
+        let mut writer = opener
+            .open_replacement(name)
+            .map_err(|e| TargetsError::Open(name.to_owned(), e))?;

        save_boot_image(&mut writer, info, key).map_err(|e| TargetsError::Save(name.to_owned(), e))
    })?;
@@ -1,15 +1,18 @@
-// SPDX-FileCopyrightText: 2023-2024 Andrew Gunnerson
+// SPDX-FileCopyrightText: 2023-2025 Andrew Gunnerson
 // SPDX-License-Identifier: GPL-3.0-only

 use std::{borrow::Cow, cmp::Ordering, io::Cursor, path::Path};

 use bitflags::bitflags;
+use rawzip::{CompressionMethod, ZipArchiveWriter};
 use thiserror::Error;
 use tracing::trace;
 use x509_cert::{Certificate, der::asn1::BitString};
-use zip::{CompressionMethod, DateTime, ZipWriter, result::ZipError, write::SimpleFileOptions};

-use crate::{crypto, format::ota};
+use crate::{
+    crypto,
+    format::{ota, zip},
+};

 #[derive(Debug, Error)]
 pub enum Error {
@@ -18,7 +21,7 @@ pub enum Error {
    #[error("New otacerts.zip is too large to fit in {0} bytes")]
    ZipTooLarge(usize),
    #[error("Failed to write otacerts zip")]
-    ZipWrite(#[source] ZipError),
+    ZipWrite(#[source] rawzip::Error),
    #[error("Failed to write certificate to otacerts zip")]
    CertWrite(#[source] crypto::Error),
 }
@@ -71,19 +74,23 @@ bitflags! {
 /// Create an `otacerts.zip` file containing the specified certificate.
 pub fn create_zip(cert: &Certificate, flags: OtaCertBuildFlags) -> Result<Vec<u8>> {
    let raw_writer = Cursor::new(Vec::new());
-    let mut writer = ZipWriter::new(raw_writer);
+    let mut writer = ZipArchiveWriter::new(raw_writer);

    let compression_method = if flags.contains(OtaCertBuildFlags::COMPRESS_DEFLATE) {
-        CompressionMethod::Deflated
+        CompressionMethod::Deflate
    } else {
-        CompressionMethod::Stored
+        CompressionMethod::Store
    };

-    let options = SimpleFileOptions::default()
-        .last_modified_time(DateTime::default())
-        .compression_method(compression_method);
    let name = "ota.x509.pem";
-    writer.start_file(name, options).map_err(Error::ZipWrite)?;
+    let (entry_writer, data_config) = writer
+        .new_file(name)
+        .compression_method(compression_method)
+        .start()
+        .map_err(Error::ZipWrite)?;
+    let compressed_writer =
+        zip::compressed_writer(entry_writer, compression_method).map_err(Error::ZipWrite)?;
+    let mut data_writer = data_config.wrap(compressed_writer);

    let cert = if flags.is_empty() {
        Cow::Borrowed(cert)
@@ -112,9 +119,16 @@ pub fn create_zip(cert: &Certificate, flags: OtaCertBuildFlags) -> Result<Vec<u8
        Cow::Owned(modified)
    };

-    crypto::write_pem_cert(Path::new(name), &mut writer, &cert).map_err(Error::CertWrite)?;
+    crypto::write_pem_cert(Path::new(name), &mut data_writer, &cert).map_err(Error::CertWrite)?;

-    let raw_writer = writer.finish().map_err(Error::ZipWrite)?;
+    data_writer
+        .finish()
+        .and_then(|(w, d)| w.finish()?.finish(d))
+        .map_err(Error::ZipWrite)?;
+
+    let mut raw_writer = writer.finish().map_err(Error::ZipWrite)?;
+
+    zip::make_non_streaming(&mut raw_writer).map_err(Error::ZipWrite)?;

    Ok(raw_writer.into_inner())
 }
@@ -1,27 +1,28 @@
-// SPDX-FileCopyrightText: 2023-2024 Andrew Gunnerson
+// SPDX-FileCopyrightText: 2023-2025 Andrew Gunnerson
 // SPDX-License-Identifier: GPL-3.0-only

 use std::{
-    io::{self, Cursor, SeekFrom},
+    io::{self, Seek, SeekFrom, Write},
    ops::Range,
    sync::atomic::AtomicBool,
 };

 use memchr::memmem;
+use rawzip::ZipArchive;
 use rayon::iter::{IntoParallelIterator, ParallelIterator};
 use thiserror::Error;
 use tracing::{Span, debug, debug_span, trace};
 use x509_cert::Certificate;
-use zip::ZipArchive;

 use crate::{
    crypto::RsaSigningKey,
    format::{
        avb::{self, AppendedDescriptorMut, Footer},
        ota,
+        zip::{ZipFileHeaderRecordExt, ZipSliceEntriesSafeExt},
    },
    patch::otacert,
-    stream::{self, ReadFixedSizeExt, ReadSeekReopen, SectionReader, WriteSeekReopen},
+    stream::{self, ReadFixedSizeExt, ReadWriteAt, UserPosFile},
    util,
 };

@@ -68,25 +69,28 @@ fn find_zip_bounds(data: &[u8], eocd_offset: usize) -> Option<Range<usize>> {

    trace!("Found zip bounds: {:?}", start..end);

-    let reader = SectionReader::new(Cursor::new(data), start as u64, (end - start) as u64).ok()?;
-    let mut zip_reader = ZipArchive::new(reader).ok()?;
+    let archive = ZipArchive::from_slice(&data[start..end]).ok()?;
+    let mut entries = archive.entries_safe();
+    let mut matches = 0;

-    if zip_reader.is_empty() {
+    while let Some((cd_entry, _)) = entries.next_entry().ok()? {
+        let path = cd_entry.file_path_utf8().ok()?;
+
+        if !path.ends_with(".x509.pem") {
+            // otacerts.zip files only contain files named this way.
+            trace!("Excluded due to invalid name: {path:?}");
+            return None;
+        }
+
+        matches += 1;
+    }
+
+    if matches == 0 {
        // otacerts.zip files contain at least one cert.
        trace!("Zip is empty");
        return None;
    }

-    for index in 0..zip_reader.len() {
-        let entry = zip_reader.by_index_raw(index).ok()?;
-
-        if !entry.name().ends_with(".x509.pem") {
-            // otacerts.zip files only contain files named this way.
-            trace!("Excluded due to invalid name: {:?}", entry.name());
-            return None;
-        }
-    }
-
    debug!("Found otacerts.zip candidate");

    // There's one or more entries and every one is named *.x509.pem.
@@ -96,8 +100,7 @@ fn find_zip_bounds(data: &[u8], eocd_offset: usize) -> Option<Range<usize>> {
 /// Replace `otacerts.zip` with a new one containing the new certificate, but
 /// padded to the same size. If the new zip is too large, the certificate will
 /// be modified to remove unnecessary components until it fits. All operations
-/// run in parallel where possible. The input and output must refer to the same
-/// file and will be reopened from multiple threads.
+/// run in parallel where possible.
 ///
 /// Returns two sorted and non-overlapping lists of byte ranges that were
 /// modified. The first list are the byte regions within the filesystem data
@@ -108,8 +111,7 @@ fn find_zip_bounds(data: &[u8], eocd_offset: usize) -> Option<Range<usize>> {
 /// modified.
 #[allow(clippy::type_complexity)]
 pub fn patch_system_image(
-    input: &(dyn ReadSeekReopen + Sync),
-    output: &(dyn WriteSeekReopen + Sync),
+    raw_file: &(dyn ReadWriteAt + Sync),
    certificate: &Certificate,
    key: &RsaSigningKey,
    cancel_signal: &AtomicBool,
@@ -122,8 +124,7 @@ pub fn patch_system_image(
    let parent_span = Span::current();

    let (mut header, footer, image_size) =
-        avb::load_image(input.reopen_boxed().map_err(Error::ReadData)?)
-            .map_err(Error::AvbUpdate)?;
+        avb::load_image(UserPosFile::new(raw_file)).map_err(Error::AvbUpdate)?;
    let Some(mut footer) = footer else {
        return Err(Error::NoFooter);
    };
@@ -144,15 +145,13 @@ pub fn patch_system_image(
            let offset = chunk * CHUNK_SIZE;
            let size = CHUNK_SIZE.min(footer.original_image_size - offset);

-            let mut reader = input.reopen_boxed().map_err(Error::ReadData)?;
-            reader
-                .seek(SeekFrom::Start(offset))
+            let mut file = UserPosFile::new(raw_file);
+            file.seek(SeekFrom::Start(offset))
                .map_err(Error::ReadData)?;
-            let buf = reader
+            let buf = file
                .read_vec_exact(size as usize)
                .map_err(Error::ReadData)?;

-            let mut writer = output.reopen_boxed().map_err(Error::WriteData)?;
            let mut ranges = Vec::<Range<u64>>::new();

            for eocd_offset_rel in memmem::find_iter(&buf, ota::ZIP_EOCD_MAGIC) {
@@ -171,10 +170,9 @@ pub fn patch_system_image(

                stream::check_cancel(cancel_signal).map_err(Error::WriteData)?;

-                writer
-                    .seek(SeekFrom::Start(bounds.start))
+                file.seek(SeekFrom::Start(bounds.start))
                    .map_err(Error::WriteData)?;
-                writer.write_all(&new_zip).map_err(Error::WriteData)?;
+                file.write_all(&new_zip).map_err(Error::WriteData)?;

                ranges.push(bounds);
            }
@@ -195,7 +193,7 @@ pub fn patch_system_image(
    let update_ranges = Some(modified_ranges.as_slice());

    descriptor
-        .update(input, output, update_ranges, cancel_signal)
+        .update(raw_file, update_ranges, cancel_signal)
        .map_err(Error::AvbUpdate)?;

    if !header.public_key.is_empty() {
@@ -204,8 +202,8 @@ pub fn patch_system_image(
        header.sign(key).map_err(Error::AvbUpdate)?;
    }

-    let writer = output.reopen_boxed().map_err(Error::WriteData)?;
-    avb::write_appended_image(writer, &header, &mut footer, Some(image_size))
+    let file = UserPosFile::new(raw_file);
+    avb::write_appended_image(file, &header, &mut footer, Some(image_size))
        .map_err(Error::AvbUpdate)?;

    let AppendedDescriptorMut::HashTree(descriptor) =
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: 2026 Andrew Gunnerson
+// SPDX-License-Identifier: GPL-3.0-only
+
 #![allow(clippy::all)]
 #![allow(clippy::nursery)]
 #![allow(clippy::pedantic)]
@@ -13,3 +16,82 @@ pub mod build {
 pub mod chromeos_update_engine {
    include!(concat!(env!("OUT_DIR"), "/chromeos_update_engine.rs"));
 }
+
+/// Implement [`serde::Serialize`] and [`serde::Deserialize`] for prost enum
+/// type and create a bridge to use with `#[serde(with = "...")]` since enum
+/// fields are stored as their underlying repr. `$type` must be a fully
+/// qualified type.
+macro_rules! serde_derive_prost_enum {
+    ($type:ty, $module:ident $(,)?) => {
+        impl serde::Serialize for $type {
+            fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+            where
+                S: serde::Serializer,
+            {
+                self.as_str_name().serialize(serializer)
+            }
+        }
+
+        impl<'de> serde::Deserialize<'de> for $type {
+            fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+            where
+                D: serde::Deserializer<'de>,
+            {
+                struct EnumVisitor;
+
+                impl serde::de::Visitor<'_> for EnumVisitor {
+                    type Value = $type;
+
+                    fn expecting(&self, formatter: &mut std::fmt::Formatter) -> std::fmt::Result {
+                        write!(formatter, "a string containing a valid enum variant")
+                    }
+
+                    fn visit_str<R>(self, v: &str) -> Result<Self::Value, R>
+                    where
+                        R: serde::de::Error,
+                    {
+                        match <$type>::from_str_name(v) {
+                            Some(e) => Ok(e),
+                            None => Err(serde::de::Error::custom(format!(
+                                "invalid enum variant: {v}",
+                            ))),
+                        }
+                    }
+                }
+
+                deserializer.deserialize_any(EnumVisitor)
+            }
+        }
+
+        mod $module {
+            pub fn serialize<S, T>(data: &T, serializer: S) -> Result<S::Ok, S::Error>
+            where
+                S: serde::Serializer,
+                T: Copy + std::fmt::Display,
+                $type: TryFrom<T>,
+                <$type as TryFrom<T>>::Error: std::fmt::Display,
+            {
+                let value = <$type>::try_from(*data).map_err(|e| {
+                    serde::ser::Error::custom(format!("invalid enum value: {data}: {e}"))
+                })?;
+
+                serde::Serialize::serialize(&value, serializer)
+            }
+
+            pub fn deserialize<'de, D, T>(deserializer: D) -> Result<T, D::Error>
+            where
+                D: serde::Deserializer<'de>,
+                T: From<$type>,
+            {
+                let value: $type = serde::Deserialize::deserialize(deserializer)?;
+
+                Ok(value.into())
+            }
+        }
+    };
+}
+
+serde_derive_prost_enum!(
+    crate::protobuf::build::tools::releasetools::ota_metadata::OtaType,
+    ota_type,
+);
@@ -3,9 +3,9 @@

 use std::{
    fs::File,
-    io::{self, BufReader, BufWriter, Cursor, Read, Seek, SeekFrom, Write},
+    io::{self, Read, Seek, SeekFrom, Write},
    sync::{
-        Arc, Mutex, RwLock,
+        Arc, Mutex,
        atomic::{AtomicBool, Ordering},
    },
 };
@@ -15,39 +15,32 @@ use ring::digest::Context;

 use crate::util;

-/// A trait for seekable readers. This is only needed because `dyn Read + Seek`
-/// is not a valid construct in Rust yet.
-pub trait ReadSeek: Read + Seek {}
+/// This is only needed because `dyn Read + Seek` is not a valid construct in
+/// Rust yet.
+pub trait ReadSeek: Read + Seek {
+    // https://github.com/rust-lang/rust/issues/145752
+    fn issue_145752(&self) {}
+}

 impl<R: Read + Seek> ReadSeek for R {}

-/// A trait for seekable writers. This is only needed because `dyn Write + Seek`
-/// is not a valid construct in Rust yet.
-pub trait WriteSeek: Write + Seek {}
+/// This is only needed because `dyn Write + Seek` is not a valid construct in
+/// Rust yet.
+pub trait WriteSeek: Write + Seek {
+    // https://github.com/rust-lang/rust/issues/145752
+    fn issue_145752(&self) {}
+}

 impl<W: Write + Seek> WriteSeek for W {}

-/// A trait for seekable and reopenable readers.
-pub trait ReadSeekReopen: ReadSeek {
-    fn reopen_boxed(&self) -> io::Result<Box<dyn ReadSeek>>;
+/// This is only needed because `dyn Read + Write + Seek` is not a valid
+/// construct in Rust yet.
+pub trait ReadWriteSeek: ReadSeek + WriteSeek {
+    // https://github.com/rust-lang/rust/issues/145752
+    fn issue_145752(&self) {}
 }

-impl<R: ReadSeek + Reopen + 'static> ReadSeekReopen for R {
-    fn reopen_boxed(&self) -> io::Result<Box<dyn ReadSeek>> {
-        Ok(Box::new(self.reopen()?))
-    }
-}
-
-/// A trait for seekable and reopenable writers.
-pub trait WriteSeekReopen: WriteSeek {
-    fn reopen_boxed(&self) -> io::Result<Box<dyn WriteSeek>>;
-}
-
-impl<W: WriteSeek + Reopen + 'static> WriteSeekReopen for W {
-    fn reopen_boxed(&self) -> io::Result<Box<dyn WriteSeek>> {
-        Ok(Box::new(self.reopen()?))
-    }
-}
+impl<W: ReadSeek + WriteSeek> ReadWriteSeek for W {}

 /// Common function for reading a structure from a reader.
 pub trait FromReader<R: Read>: Sized {
@@ -144,25 +137,121 @@ impl<R: Read> ReadFixedSizeExt for R {
    }
 }

-/// Extensions for file-like types to reopen themselves.
-pub trait Reopen: Sized {
-    /// Open a new handle to the same file. The new handle is independently
-    /// seekable and the file offset is initially set to 0.
-    fn reopen(&self) -> io::Result<Self>;
+/// Extensions for file-like types to query the file size. No guarantees are
+/// made about the state of the underlying file position after performing any
+/// operation.
+pub trait FileLen {
+    fn file_len(&self) -> io::Result<u64>;
 }

-impl<R: Read + Reopen> Reopen for BufReader<R> {
-    fn reopen(&self) -> io::Result<Self> {
-        Ok(Self::new(self.get_ref().reopen()?))
+macro_rules! file_len_blanket_impl {
+    ($type:ty) => {
+        impl<F: ?Sized + FileLen> FileLen for $type {
+            fn file_len(&self) -> io::Result<u64> {
+                (**self).file_len()
+            }
+        }
+    };
+}
+
+file_len_blanket_impl!(&F);
+file_len_blanket_impl!(Arc<F>);
+file_len_blanket_impl!(Box<F>);
+
+/// Extensions for file-like types that support multi-threaded reads at specific
+/// offsets. No guarantees are made about the state of underlying file position
+/// after performing any operation.
+pub trait ReadAt: FileLen {
+    fn read_at(&self, buf: &mut [u8], offset: u64) -> io::Result<usize>;
+
+    fn read_exact_at(&self, buf: &mut [u8], offset: u64) -> io::Result<()> {
+        let n = self.read_at(buf, offset)?;
+        if n != buf.len() {
+            return Err(io::Error::new(
+                io::ErrorKind::UnexpectedEof,
+                format!(
+                    "Expected to read {} bytes at {offset}, but reached EOF after {n} bytes",
+                    buf.len(),
+                ),
+            ));
+        }
+        Ok(())
    }
 }

-impl<W: Write + Reopen> Reopen for BufWriter<W> {
-    fn reopen(&self) -> io::Result<Self> {
-        Ok(Self::new(self.get_ref().reopen()?))
-    }
+macro_rules! read_at_blanket_impl {
+    ($type:ty) => {
+        impl<R: ?Sized + ReadAt> ReadAt for $type {
+            fn read_at(&self, buf: &mut [u8], offset: u64) -> io::Result<usize> {
+                (**self).read_at(buf, offset)
+            }
+
+            fn read_exact_at(&self, buf: &mut [u8], offset: u64) -> io::Result<()> {
+                (**self).read_exact_at(buf, offset)
+            }
+        }
+    };
 }

+read_at_blanket_impl!(&R);
+read_at_blanket_impl!(Arc<R>);
+read_at_blanket_impl!(Box<R>);
+
+/// Extensions for file-like types that support multi-threaded writes at
+/// specific offsets. The behavior is unspecified if writes would overlap. No
+/// guarantees are made about the state of the underlying file position after
+/// performing any operation.
+pub trait WriteAt: FileLen {
+    fn write_at(&self, buf: &[u8], offset: u64) -> io::Result<usize>;
+
+    fn write_all_at(&self, buf: &[u8], offset: u64) -> io::Result<()> {
+        let n = self.write_at(buf, offset)?;
+        if n != buf.len() {
+            return Err(io::Error::new(
+                io::ErrorKind::UnexpectedEof,
+                format!(
+                    "Expected to write {} bytes at {offset}, but reached EOF after {n} bytes",
+                    buf.len(),
+                ),
+            ));
+        }
+        Ok(())
+    }
+
+    fn file_flush(&self) -> io::Result<()>;
+}
+
+macro_rules! write_at_blanket_impl {
+    ($type:ty) => {
+        impl<W: ?Sized + WriteAt> WriteAt for $type {
+            fn write_at(&self, buf: &[u8], offset: u64) -> io::Result<usize> {
+                (**self).write_at(buf, offset)
+            }
+
+            fn write_all_at(&self, buf: &[u8], offset: u64) -> io::Result<()> {
+                (**self).write_all_at(buf, offset)
+            }
+
+            fn file_flush(&self) -> io::Result<()> {
+                (**self).file_flush()
+            }
+        }
+    };
+}
+
+write_at_blanket_impl!(&W);
+write_at_blanket_impl!(Arc<W>);
+write_at_blanket_impl!(Box<W>);
+
+/// This is only needed because `dyn ReadAt + WriteAt` is not a valid construct
+/// in Rust yet.
+pub trait ReadWriteAt: ReadAt + WriteAt {
+    // https://github.com/rust-lang/rust/issues/145752
+    fn issue_145752(&self) {}
+}
+
+impl<F: ReadAt + WriteAt> ReadWriteAt for F {}
+
 /// A reader wrapper that implements [`Seek`], but only for reporting the
 /// current file position.
 pub struct CountingReader<R> {
@@ -320,14 +409,6 @@ impl<R: Read + Seek> SectionReader<R> {
    }
 }

-impl<R: Read + Seek + Reopen> Reopen for SectionReader<R> {
-    fn reopen(&self) -> io::Result<Self> {
-        let inner = self.inner.reopen()?;
-
-        Self::new(inner, self.start, self.size)
-    }
-}
-
 impl<R: Read + Seek> Read for SectionReader<R> {
    fn read(&mut self, buf: &mut [u8]) -> io::Result<usize> {
        let to_read = self.size.saturating_sub(self.pos).min(buf.len() as u64) as usize;
@@ -370,93 +451,179 @@ impl<R: Read + Seek> Seek for SectionReader<R> {
    }
 }

-/// A file wrapper that uses a userspace file offset. A reopened instance uses
-/// the same underlying kernel file descriptor, but a new userspace file offset,
-/// initially set to 0.
-#[derive(Debug)]
-pub struct PSeekFile {
-    // The lock is needed because flush() takes a `&mut self`.
-    file: Arc<RwLock<File>>,
-    offset: u64,
+/// A reader wrapper that only allows reading a specific section of a file.
+pub struct SectionReaderAt<R> {
+    inner: R,
+    start: u64,
+    size: u64,
 }

-impl PSeekFile {
-    pub fn new(file: File) -> Self {
-        Self {
-            file: Arc::new(RwLock::new(file)),
-            offset: 0,
-        }
+impl<R: ReadAt> SectionReaderAt<R> {
+    pub fn new(inner: R, start: u64, size: u64) -> io::Result<Self> {
+        Ok(Self { inner, start, size })
    }

-    pub fn set_len(&self, size: u64) -> io::Result<()> {
-        let file_locked = self.file.read().unwrap();
-        file_locked.set_len(size)
+    pub fn into_inner(self) -> R {
+        self.inner
    }
+}

+impl<R> FileLen for SectionReaderAt<R> {
+    fn file_len(&self) -> io::Result<u64> {
+        Ok(self.size)
+    }
+}
+
+impl<R: ReadAt> ReadAt for SectionReaderAt<R> {
+    fn read_at(&self, buf: &mut [u8], offset: u64) -> io::Result<usize> {
+        let to_read = self.size.saturating_sub(offset).min(buf.len() as u64) as usize;
+
+        self.inner.read_at(&mut buf[..to_read], self.start + offset)
+    }
+}
+
+/// Regular files support parallel reads.
+impl ReadAt for File {
    /// Read data from offset. The kernel's file position *will* be changed.
    #[cfg(windows)]
-    fn read_at(&self, buf: &mut [u8]) -> io::Result<usize> {
+    fn read_at(&self, buf: &mut [u8], offset: u64) -> io::Result<usize> {
        use std::os::windows::fs::FileExt;
-        self.file.read().unwrap().seek_read(buf, self.offset)
+        FileExt::seek_read(self, buf, offset)
    }

    /// Read data from offset. The kernel's file position will *not* be changed.
    #[cfg(unix)]
-    fn read_at(&self, buf: &mut [u8]) -> io::Result<usize> {
+    fn read_at(&self, buf: &mut [u8], offset: u64) -> io::Result<usize> {
        use std::os::unix::fs::FileExt;
-        self.file.read().unwrap().read_at(buf, self.offset)
+        FileExt::read_at(self, buf, offset)
    }
+}

+/// Regular files support parallel writes.
+impl WriteAt for File {
    /// Write data to offset. The kernel's file position *will* be changed.
    #[cfg(windows)]
-    fn write_at(&self, buf: &[u8]) -> io::Result<usize> {
+    fn write_at(&self, buf: &[u8], offset: u64) -> io::Result<usize> {
        use std::os::windows::fs::FileExt;
-        self.file.read().unwrap().seek_write(buf, self.offset)
+        FileExt::seek_write(self, buf, offset)
    }

    /// Write data to offset. The kernel's file position will *not* be changed.
    #[cfg(unix)]
-    fn write_at(&self, buf: &[u8]) -> io::Result<usize> {
+    fn write_at(&self, buf: &[u8], offset: u64) -> io::Result<usize> {
        use std::os::unix::fs::FileExt;
-        self.file.read().unwrap().write_at(buf, self.offset)
+        FileExt::write_at(self, buf, offset)
+    }
+
+    fn file_flush(&self) -> io::Result<()> {
+        (&*self).flush()
    }
 }

-impl Reopen for PSeekFile {
-    fn reopen(&self) -> io::Result<Self> {
-        Ok(Self {
-            file: self.file.clone(),
-            offset: 0,
-        })
+impl FileLen for File {
+    fn file_len(&self) -> io::Result<u64> {
+        (&*self).seek(SeekFrom::End(0))
    }
 }

-impl Read for PSeekFile {
+/// A file wrapper that implements [`ReadAt`] and [`WriteAt`] on top of
+/// [`Read`], [`Write`], and [`Seek`] via a mutex that makes operations
+/// single-threaded. This is the inverse of [`UserPosFile`].
+pub struct MutexFile<F>(Mutex<F>);
+
+impl<F> MutexFile<F> {
+    pub fn new(file: F) -> Self {
+        Self(Mutex::new(file))
+    }
+
+    pub fn into_inner(self) -> F {
+        self.0.into_inner().unwrap()
+    }
+}
+
+impl<F: Seek> FileLen for MutexFile<F> {
+    fn file_len(&self) -> io::Result<u64> {
+        let mut inner = self.0.lock().unwrap();
+        inner.seek(SeekFrom::End(0))
+    }
+}
+
+impl<F: Read + Seek> ReadAt for MutexFile<F> {
+    fn read_at(&self, buf: &mut [u8], offset: u64) -> io::Result<usize> {
+        let mut inner = self.0.lock().unwrap();
+        let pos = inner.stream_position()?;
+
+        inner.seek(SeekFrom::Start(offset))?;
+
+        let result = inner.read(buf);
+
+        inner.seek(SeekFrom::Start(pos))?;
+
+        result
+    }
+}
+
+impl<F: Write + Seek> WriteAt for MutexFile<F> {
+    fn write_at(&self, buf: &[u8], offset: u64) -> io::Result<usize> {
+        let mut inner = self.0.lock().unwrap();
+        let pos = inner.stream_position()?;
+
+        inner.seek(SeekFrom::Start(offset))?;
+
+        let result = inner.write(buf);
+
+        inner.seek(SeekFrom::Start(pos))?;
+
+        result
+    }
+
+    fn file_flush(&self) -> io::Result<()> {
+        let mut inner = self.0.lock().unwrap();
+        inner.flush()
+    }
+}
+
+/// A file wrapper than implements the standard [`Read`], [`Write`], and
+/// [`Seek`] traits on top of [`ReadAt`] and [`WriteAt`]. The file position is
+/// unique for every instance, even if the underlying file is shared. This is
+/// the inverse of [`MutexFile`].
+pub struct UserPosFile<F> {
+    file: F,
+    offset: u64,
+}
+
+impl<F> UserPosFile<F> {
+    pub fn new(file: F) -> Self {
+        Self { file, offset: 0 }
+    }
+}
+
+impl<F: ReadAt> Read for UserPosFile<F> {
    fn read(&mut self, buf: &mut [u8]) -> io::Result<usize> {
-        let n = self.read_at(buf)?;
+        let n = self.file.read_at(buf, self.offset)?;
        self.offset += n as u64;
        Ok(n)
    }
 }

-impl Write for PSeekFile {
+impl<F: WriteAt> Write for UserPosFile<F> {
    fn write(&mut self, buf: &[u8]) -> io::Result<usize> {
-        let n = self.write_at(buf)?;
+        let n = self.file.write_at(buf, self.offset)?;
        self.offset += n as u64;
        Ok(n)
    }

    fn flush(&mut self) -> io::Result<()> {
-        self.file.write().unwrap().flush()
+        self.file.file_flush()
    }
 }

-impl Seek for PSeekFile {
+impl<F: FileLen> Seek for UserPosFile<F> {
    fn seek(&mut self, pos: SeekFrom) -> io::Result<u64> {
        self.offset = match pos {
            SeekFrom::Start(o) => o,
            SeekFrom::End(o) => {
-                let file_size = self.file.read().unwrap().metadata()?.len();
+                let file_size = self.file.file_len()?;
                file_size
                    .to_i64()
                    .and_then(|s| s.checked_add(o))
@@ -485,70 +652,6 @@ impl Seek for PSeekFile {
    }
 }

-/// A small wrapper around a [`Cursor`] that allows multiple instances to share
-/// the same underlying file. All reads, writes, and seeks are single-threaded.
-/// This is useful for scenarios where data needs to be copied from multiple
-/// readers into different parts of the same [`SharedCursor`] writer and the
-/// read operation is significantly more expensive than the write operation (eg.
-/// due to decompression).
-#[derive(Default)]
-pub struct SharedCursor {
-    inner: Arc<Mutex<Cursor<Vec<u8>>>>,
-    offset: u64,
-}
-
-impl SharedCursor {
-    pub fn new() -> Self {
-        Self::default()
-    }
-}
-
-impl Reopen for SharedCursor {
-    fn reopen(&self) -> io::Result<Self> {
-        Ok(Self {
-            inner: self.inner.clone(),
-            offset: 0,
-        })
-    }
-}
-
-impl Read for SharedCursor {
-    fn read(&mut self, buf: &mut [u8]) -> io::Result<usize> {
-        let mut inner = self.inner.lock().unwrap();
-        inner.seek(SeekFrom::Start(self.offset))?;
-
-        let n = inner.read(buf)?;
-        self.offset += n as u64;
-
-        Ok(n)
-    }
-}
-
-impl Write for SharedCursor {
-    fn write(&mut self, buf: &[u8]) -> io::Result<usize> {
-        let mut inner = self.inner.lock().unwrap();
-        inner.seek(SeekFrom::Start(self.offset))?;
-
-        let n = inner.write(buf)?;
-        self.offset += n as u64;
-
-        Ok(n)
-    }
-
-    fn flush(&mut self) -> io::Result<()> {
-        let mut inner = self.inner.lock().unwrap();
-        inner.flush()
-    }
-}
-
-impl Seek for SharedCursor {
-    fn seek(&mut self, pos: SeekFrom) -> io::Result<u64> {
-        let mut inner = self.inner.lock().unwrap();
-        self.offset = inner.seek(pos)?;
-        Ok(self.offset)
-    }
-}
-
 /// Returns an I/O error with the [`io::ErrorKind::Interrupted`] type if
 /// `cancel_signal` is true. This should be called frequently in I/O loops for
 /// cancellation to be responsive.
@@ -648,10 +751,9 @@ mod tests {

    use ring::digest::Context;

-    use super::{
-        CountingReader, CountingWriter, HashingReader, HashingWriter, PSeekFile, ReadDiscardExt,
-        Reopen, SectionReader, SharedCursor, WriteZerosExt,
-    };
+    use crate::stream::FileLen;
+
+    use super::*;

    const FOOBAR_SHA256: [u8; 32] = [
        0xc3, 0xab, 0x8f, 0xf1, 0x37, 0x20, 0xe8, 0xad, 0x90, 0x47, 0xdd, 0x39, 0x46, 0x6b, 0x3c,
@@ -776,7 +878,7 @@ mod tests {
        assert_eq!(&buf[..4], b"nner");

        buf = *b"\0\0\0\0\0";
-        reader.seek(SeekFrom::Current(-5)).unwrap();
+        reader.seek_relative(-5).unwrap();
        reader.read_exact(&mut buf[..3]).unwrap();
        assert_eq!(&buf[..3], b"inn");

@@ -785,91 +887,98 @@ mod tests {
    }

    #[test]
-    fn pseek_file() {
-        let raw_file = tempfile::tempfile().unwrap();
-        let mut a = PSeekFile::new(raw_file);
-        let mut b = a.reopen().unwrap();
-        let mut c = b.reopen().unwrap();
+    fn section_reader_at() {
+        let raw_reader = MutexFile::new(Cursor::new(b"fooinnerbar"));
+        let reader = SectionReaderAt::new(raw_reader, 3, 5).unwrap();

-        b.write_all(b"foobar").unwrap();
-        c.write_all(b"hello").unwrap();
-        b.write_all(b"world").unwrap();
-        c.seek(SeekFrom::Start(0)).unwrap();
-        c.write_all(b"hi").unwrap();
+        let mut buf = [0u8; 5];
+        reader.read_exact_at(&mut buf[3..5], 3).unwrap();
+        reader.read_exact_at(&mut buf[..3], 0).unwrap();
+        assert_eq!(&buf, b"inner");

-        let mut buf = [0u8; 11];
-        a.read_exact(&mut buf).unwrap();
-        assert_eq!(&buf, b"hillorworld");
-
-        let n = a.read_discard(1).unwrap();
+        let n = reader.read_at(&mut buf, 5).unwrap();
        assert_eq!(n, 0);
    }

    #[test]
-    fn shared_cursor() {
-        let mut a = SharedCursor::default();
-        let mut b = a.reopen().unwrap();
-        let mut c = b.reopen().unwrap();
+    fn mutex_file() {
+        let file = MutexFile::new(Cursor::new(Vec::new()));
+        assert_eq!(file.file_len().unwrap(), 0);

-        b.write_all(b"foobar").unwrap();
-        c.write_all(b"hello").unwrap();
-        b.write_all(b"world").unwrap();
-        c.seek(SeekFrom::Start(0)).unwrap();
-        c.write_all(b"hi").unwrap();
+        file.write_all_at(b"bar", 3).unwrap();
+        assert_eq!(file.file_len().unwrap(), 6);

-        let mut buf = [0u8; 11];
-        a.read_exact(&mut buf).unwrap();
-        assert_eq!(&buf, b"hillorworld");
+        file.write_all_at(b"foo", 0).unwrap();
+        assert_eq!(file.file_len().unwrap(), 6);

-        let n = a.read_discard(1).unwrap();
-        assert_eq!(n, 0);
+        let data = file.into_inner().into_inner();
+        assert_eq!(data, b"foobar");
    }

    #[test]
-    fn copy() {
+    fn user_pos_file() {
+        let mut raw_file = tempfile::tempfile().unwrap();
+        raw_file.write_all(b"foobar").unwrap();
+
+        let mut file = UserPosFile::new(raw_file);
+        let mut buf = [0u8; 3];
+
+        file.rewind().unwrap();
+        file.read_exact(&mut buf).unwrap();
+        assert_eq!(&buf, b"foo");
+
+        let pos = file.seek(SeekFrom::End(-3)).unwrap();
+        assert_eq!(pos, 3);
+
+        file.read_exact(&mut buf).unwrap();
+        assert_eq!(&buf, b"bar");
+    }
+
+    #[test]
+    fn copy_functions() {
        let cancel_signal = AtomicBool::new(false);
        let mut reader = Cursor::new(b"foobar");
        let mut writer = Cursor::new([0u8; 6]);

-        super::copy_n(&mut reader, &mut writer, 6, &cancel_signal).unwrap();
+        copy_n(&mut reader, &mut writer, 6, &cancel_signal).unwrap();
        assert_eq!(writer.get_ref(), b"foobar");

        // Reader early EOF.
        reader.seek(SeekFrom::Start(3)).unwrap();
        writer.rewind().unwrap();
-        let err = super::copy_n(&mut reader, &mut writer, 6, &cancel_signal).unwrap_err();
+        let err = copy_n(&mut reader, &mut writer, 6, &cancel_signal).unwrap_err();
        assert_eq!(err.kind(), io::ErrorKind::UnexpectedEof);

        // Writer early EOF.
        reader.rewind().unwrap();
        writer.seek(SeekFrom::Start(3)).unwrap();
-        let err = super::copy_n(&mut reader, &mut writer, 6, &cancel_signal).unwrap_err();
+        let err = copy_n(&mut reader, &mut writer, 6, &cancel_signal).unwrap_err();
        assert_eq!(err.kind(), io::ErrorKind::WriteZero);

        reader.rewind().unwrap();
        writer.rewind().unwrap();
-        let n = super::copy(&mut reader, &mut writer, &cancel_signal).unwrap();
+        let n = copy(&mut reader, &mut writer, &cancel_signal).unwrap();
        assert_eq!(n, 6);
        assert_eq!(writer.get_ref(), b"foobar");

        // Reader early EOF.
        reader.seek(SeekFrom::Start(3)).unwrap();
        writer.rewind().unwrap();
-        let n = super::copy(&mut reader, &mut writer, &cancel_signal).unwrap();
+        let n = copy(&mut reader, &mut writer, &cancel_signal).unwrap();
        assert_eq!(n, 3);

        // Writer early EOF.
        reader.rewind().unwrap();
        writer.seek(SeekFrom::Start(3)).unwrap();
-        let err = super::copy(&mut reader, &mut writer, &cancel_signal).unwrap_err();
+        let err = copy(&mut reader, &mut writer, &cancel_signal).unwrap_err();
        assert_eq!(err.kind(), io::ErrorKind::WriteZero);

        reader.rewind().unwrap();
        writer.rewind().unwrap();
        cancel_signal.store(true, Ordering::SeqCst);
-        let err = super::copy_n(&mut reader, &mut writer, 6, &cancel_signal).unwrap_err();
+        let err = copy_n(&mut reader, &mut writer, 6, &cancel_signal).unwrap_err();
        assert_eq!(err.kind(), io::ErrorKind::Interrupted);
-        let err = super::copy(&mut reader, &mut writer, &cancel_signal).unwrap_err();
+        let err = copy(&mut reader, &mut writer, &cancel_signal).unwrap_err();
        assert_eq!(err.kind(), io::ErrorKind::Interrupted);
    }
 }
@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: 2023-2024 Andrew Gunnerson
+// SPDX-FileCopyrightText: 2023-2025 Andrew Gunnerson
 // SPDX-License-Identifier: GPL-3.0-only

 use std::{
@@ -18,7 +18,7 @@ use avbroot::{
        ChainPartitionDescriptor, Descriptor, Footer, HashDescriptor, HashTreeDescriptor, Header,
        KernelCmdlineDescriptor, PropertyDescriptor,
    },
-    stream::SharedCursor,
+    stream::{MutexFile, UserPosFile},
 };

 fn get_test_key() -> RsaSigningKey {
@@ -306,16 +306,17 @@ fn round_trip_appended_hash_tree_image_fixed_size() {
        reserved: repeat_array(&[0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef]),
    };

-    let mut writer = SharedCursor::default();
+    let writer = MutexFile::new(Cursor::new(Vec::new()));
+    let mut pos_writer = UserPosFile::new(&writer);
    let cancel_signal = AtomicBool::new(false);

    // Write the raw partition data.
-    writer.write_all(&raw_data).unwrap();
+    pos_writer.write_all(&raw_data).unwrap();

    // Generate and write the hash tree and FEC data.
    match header.appended_descriptor_mut().unwrap() {
        AppendedDescriptorMut::HashTree(d) => {
-            d.update(&writer, &writer, None, &cancel_signal).unwrap();
+            d.update(&writer, None, &cancel_signal).unwrap();
        }
        AppendedDescriptorMut::Hash(_) => panic!("Expected hash tree descriptor"),
    }
@@ -334,10 +335,10 @@ fn round_trip_appended_hash_tree_image_fixed_size() {
    assert_eq!(header.verify().unwrap().unwrap(), key.to_public_key());

    // Write vbmeta structures.
-    avb::write_appended_image(&mut writer, &header, &mut footer, Some(image_size)).unwrap();
+    avb::write_appended_image(&mut pos_writer, &header, &mut footer, Some(image_size)).unwrap();
    let mut data = Vec::new();
-    writer.rewind().unwrap();
-    writer.read_to_end(&mut data).unwrap();
+    pos_writer.rewind().unwrap();
+    pos_writer.read_to_end(&mut data).unwrap();

    // Verify checksum of the output.
    assert_eq!(
@@ -413,16 +414,17 @@ fn round_trip_appended_hash_tree_image_minimum_size() {
        reserved: repeat_array(&[0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef]),
    };

-    let mut writer = SharedCursor::default();
+    let writer = MutexFile::new(Cursor::new(Vec::new()));
+    let mut pos_writer = UserPosFile::new(&writer);
    let cancel_signal = AtomicBool::new(false);

    // Write the raw partition data.
-    writer.write_all(&raw_data).unwrap();
+    pos_writer.write_all(&raw_data).unwrap();

    // Generate and write the hash tree and FEC data.
    match header.appended_descriptor_mut().unwrap() {
        AppendedDescriptorMut::HashTree(d) => {
-            d.update(&writer, &writer, None, &cancel_signal).unwrap();
+            d.update(&writer, None, &cancel_signal).unwrap();
        }
        AppendedDescriptorMut::Hash(_) => panic!("Expected hash tree descriptor"),
    }
@@ -441,10 +443,10 @@ fn round_trip_appended_hash_tree_image_minimum_size() {
    assert_eq!(header.verify().unwrap().unwrap(), key.to_public_key());

    // Write vbmeta structures.
-    avb::write_appended_image(&mut writer, &header, &mut footer, None).unwrap();
+    avb::write_appended_image(&mut pos_writer, &header, &mut footer, None).unwrap();
    let mut data = Vec::new();
-    writer.rewind().unwrap();
-    writer.read_to_end(&mut data).unwrap();
+    pos_writer.rewind().unwrap();
+    pos_writer.read_to_end(&mut data).unwrap();

    // Verify checksum of the output.
    assert_eq!(
@@ -34,20 +34,13 @@ allow = [
    "Apache-2.0 WITH LLVM-exception",
    "BSD-3-Clause",
    "bzip2-1.0.6",
-    "GPL-3.0",
+    "GPL-3.0-only",
    "ISC",
    "MIT",
    "Unicode-3.0",
    "Zlib",
 ]

-[[licenses.clarify]]
-name = "ring"
-expression = "MIT AND ISC AND OpenSSL"
-license-files = [
-    { path = "LICENSE", hash = 0xbd0eed23 },
-]
-
 [bans]
 multiple-versions = "warn"
 multiple-versions-include-dev = true
@@ -61,8 +54,11 @@ executables = "deny"
 include-dependencies = true
 include-workspace = true
 bypass = [
-    # Copies of unmodified crashwrangler objects for old macOS versions.
-    { name = "honggfuzz", allow-globs = ["honggfuzz/third_party/mac/CrashReport_*.o"] },
+    # honggfuzz/third_party/mac/CrashReport_*.o are copies of unmodified
+    # crashwrangler objects for old macOS versions. Unfortunately, when running
+    # cargo hfuzz, the compiled hongfuzz binary and corresponding object files
+    # are written to the source directory too.
+    { name = "honggfuzz", allow-globs = ["honggfuzz/*.o", "honggfuzz/honggfuzz"] },
    # Only used in tests.
    { name = "libloading", allow-globs = ["tests/nagisa*.dll"] },
 ]
@@ -72,5 +68,4 @@ unknown-registry = "deny"
 unknown-git = "deny"
 allow-git = [
    "https://github.com/chenxiaolong/system-properties",
-    "https://github.com/chenxiaolong/zip2",
 ]
@@ -4,7 +4,8 @@ version.workspace = true
 license.workspace = true
 edition.workspace = true
 repository.workspace = true
-publish = false
+publish.workspace = true
+rust-version.workspace = true

 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

@@ -14,23 +15,16 @@ avbroot = { path = "../avbroot" }
 clap = { version = "4.4.1", features = ["derive"] }
 ctrlc = "3.4.0"
 hex = { version = "0.4.3", features = ["serde"] }
+rawzip = "0.4.0"
 ring = "0.17.14"
 rsa = { version = "0.9.6", features = ["hazmat"] }
 serde = { version = "1.0.188", features = ["derive"] }
 tempfile = "3.8.0"
-toml_edit = { version = "0.23.3", features = ["serde"] }
+toml = { version = "1.0.1", features = ["serde"] }
 topological-sort = "0.2.2"
 tracing = "0.1.40"
 tracing-subscriber = "0.3.18"
 x509-cert = "0.2.5"

-# https://github.com/zip-rs/zip2/pull/367
-# https://github.com/zip-rs/zip2/pull/368
-# For getting the data offset when writing new zip entries.
-[dependencies.zip]
-git = "https://github.com/chenxiaolong/zip2"
-rev = "59685f4dadbfee8cb3ea74c8fbb402b60d8137e8"
-default-features = false
-
 [lints]
 workspace = true
@@ -14,8 +14,9 @@ security_patch_level = "2024-01-01"

 [profile.pixel_v4_gki.vabc]
 # CoW v3 is used starting with the Google Pixel 9a.
-version = "V3"
+version = { V3 = { compression_factor = 65536 } }
 algo = { kind = "Lz4" }
+force_compression_factor = false

 [profile.pixel_v4_gki.partitions.boot]
 avb.signed = true
@@ -51,12 +52,12 @@ data.version = "vendor_v4"
 data.ramdisks = [["otacerts", "first_stage", "dsu_key_dir"]]

 [profile.pixel_v4_gki.hashes_streaming]
-original = "4e283ad1e3450795a32f46445bf626f6af983f52bd0a3484b49f8740c1029653"
-patched = "837861bf64e9387380e02d740b21c94e60c41bba4161d85ab44fc5ce86f19631"
+original = "ea96196191e3a4133db4aff45d47aa3468514e29e0a724faac8081cbf4adf808"
+patched = "c073cbb271099aaf338a8c70f3565ec70db47a87b4c9bb3efffd96ccee1a0c27"

 [profile.pixel_v4_gki.hashes_seekable]
-original = "0ab2403a2634f00063c44f9a477a672205922ede189442e18850dd8efceb5d6f"
-patched = "2d94841c3be6cc1739f4c7ad5d9db048301b3f93f8ccd510e2c825bf13ecff90"
+original = "f6615ae355eba38689d24aa535981d09175d4832e7c65c04cdd89aa95d21f09d"
+patched = "65ce91a95574a308ffc5279696efe7f6f7e4e847795dc9ae43d9ffd012a7ce3f"

 # Google Pixel 6a
 # What's unique: boot (boot v4, no ramdisk) + vendor_boot (vendor v4, 2 ramdisks)
@@ -64,6 +65,8 @@ patched = "2d94841c3be6cc1739f4c7ad5d9db048301b3f93f8ccd510e2c825bf13ecff90"
 [profile.pixel_v4_non_gki.vabc]
 version = "V2"
 algo = { kind = "Lz4" }
+# delta_generator sets it for v2, even though it's not used.
+force_compression_factor = true

 [profile.pixel_v4_non_gki.partitions.boot]
 avb.signed = true
@@ -93,12 +96,12 @@ data.version = "vendor_v4"
 data.ramdisks = [["init", "otacerts", "first_stage", "dsu_key_dir"], ["dlkm"]]

 [profile.pixel_v4_non_gki.hashes_streaming]
-original = "c3a978b7225632875d3b1e87e852494b1a69019f5ba4099cf3981503623facca"
-patched = "cf0ef7429c4657875018d10d7302aaca371b21c5968af234aabd941304f0035b"
+original = "cb2a2e406d2b4c68c8a38f819256a10ada0ed5a4732822bec35bdf7bcdc458eb"
+patched = "45cbe96e01b8b2e3ba5e4a2c990e7ff08bee285316a4a7a314aab3ffddf27d0d"

 [profile.pixel_v4_non_gki.hashes_seekable]
-original = "cc11ee5a5be66bf34dcb6834a9a635016fa9f82dd0d9a2fb1029aa4f218d1d2e"
-patched = "e2fb7d3ce2c697372fb342ae5cd7bb606cd764f06a2aa8a2d6d7bd2c88456780"
+original = "9450c212c34fe55453b52345c7cc22f72397dc80d9ddc792eafc20b461c2afc9"
+patched = "111fdfae91977d80cd141f6c3dc69f3af45bb7fcdf3e2e442bc3f0ad5fa77faa"

 # Google Pixel 4a 5G
 # What's unique: boot (boot v3) + vendor_boot (vendor v3)
@@ -106,6 +109,7 @@ patched = "e2fb7d3ce2c697372fb342ae5cd7bb606cd764f06a2aa8a2d6d7bd2c88456780"
 [profile.pixel_v3.vabc]
 version = "V2"
 algo = { kind = "Gz" }
+force_compression_factor = false

 [profile.pixel_v3.partitions.boot]
 avb.signed = true
@@ -136,12 +140,12 @@ data.version = "vendor_v3"
 data.ramdisks = [["otacerts", "first_stage", "dsu_key_dir"]]

 [profile.pixel_v3.hashes_streaming]
-original = "d12d92c051bcc832cc9ceef1d46c415af80a09808a984db4c42a88d65d644a8b"
-patched = "408496eb2cca51c0563eceaa3a9def95a5c42acff938850a8577aaa047331284"
+original = "4b864b906a13ec98b1d6c3440a5eca7404ec63d073080e80a3b84afabcbd2fa2"
+patched = "da3b9a4d6a58bb5aaadfc63006cb36b7af9c1c5945e81b38587c245bd5ad1f5a"

 [profile.pixel_v3.hashes_seekable]
-original = "63505cfd7c2c9d948a5ee150cf53f448f11c83cdce3919fd43231640bf002812"
-patched = "b246497de1588d41b919ba002b37dff13cb565682aa3e086e543b25ead7d7aaf"
+original = "e0e93ee11de56992f3a5f543858c1d11858b4deb76a91a4caf4fb0f3f34be855"
+patched = "71682a4f31a5920784a0e2e38a6ee5fe3c65213436c7bf1ce347b121cd01a367"

 # Google Pixel 4a
 # What's unique: boot (boot v2)
@@ -169,9 +173,9 @@ data.type = "vbmeta"
 data.deps = ["system"]

 [profile.pixel_v2.hashes_streaming]
-original = "c303728f4ee9c42ef990bb576bd0688635b263a67127d2a986caf574c9eedd63"
-patched = "e907db408767f81223e3ae53dd8a44c6f59f4702a016093cd6983499c9391ff0"
+original = "abc0ad7f80020018101437c2494d6564a877df663d208a123267fc100734c175"
+patched = "132fb4d90e3c19a7a5ee0da2082767228255228ea5fb66811df1ccd5ff600bb5"

 [profile.pixel_v2.hashes_seekable]
-original = "951b1f70bef7736b9e06f3215357fcebf8a4925872cd31691198fdda9d7c04ce"
-patched = "2b1bfe46f41942be88e09b40000745c68ed133900d7970f57d15019683a1ba87"
+original = "57d4ac5ab7d362a593f3c02f3d2044b5400c10db0f732741a2d18e025d4231ec"
+patched = "b365eb32f463ac4ba13f7bed4e6535a68483379640dc6e842c591f194db042c2"
@@ -6,7 +6,6 @@ use std::{collections::BTreeMap, fs, path::Path};
 use anyhow::{Context, Result};
 use avbroot::format::payload::{CowVersion, VabcAlgo};
 use serde::{Deserialize, Serialize};
-use toml_edit::DocumentMut;

 #[derive(Clone, Copy, Serialize, Deserialize)]
 pub struct Sha256Hash(
@@ -110,6 +109,7 @@ pub struct Partition {
 pub struct VabcSettings {
    pub version: CowVersion,
    pub algo: VabcAlgo,
+    pub force_compression_factor: bool,
 }

 #[derive(Clone, Serialize, Deserialize)]
@@ -129,12 +129,8 @@ pub struct Config {
    pub profile: BTreeMap<String, Profile>,
 }

-pub fn load_config(path: &Path) -> Result<(Config, DocumentMut)> {
+pub fn load_config(path: &Path) -> Result<Config> {
    let contents =
        fs::read_to_string(path).with_context(|| format!("Failed to read config: {path:?}"))?;
-    let config: Config = toml_edit::de::from_str(&contents)
-        .with_context(|| format!("Failed to parse config: {path:?}"))?;
-    let document: DocumentMut = contents.parse().unwrap();
-
-    Ok((config, document))
+    toml::de::from_str(&contents).with_context(|| format!("Failed to parse config: {path:?}"))
 }
@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: 2023-2025 Andrew Gunnerson
+// SPDX-FileCopyrightText: 2023-2026 Andrew Gunnerson
 // SPDX-FileCopyrightText: 2023 Pascal Roeleven
 // SPDX-License-Identifier: GPL-3.0-only

@@ -37,7 +37,7 @@ use avbroot::{
        ota::{self, SigningWriter, ZipEntry, ZipMode},
        padding,
        payload::{self, CowVersion, PayloadHeader, PayloadWriter, VabcParams},
-        zip::ZipWriterWrapper,
+        zip,
    },
    patch::otacert::{self, OtaCertBuildFlags},
    protobuf::{
@@ -46,16 +46,16 @@ use avbroot::{
            DeltaArchiveManifest, DynamicPartitionGroup, DynamicPartitionMetadata, PartitionUpdate,
        },
    },
-    stream::{self, CountingWriter, FromReader, HashingReader, PSeekFile, Reopen, ToWriter},
+    stream::{self, FromReader, HashingReader, ToWriter},
    util,
 };
 use clap::Parser;
+use rawzip::{CompressionMethod, ZipArchiveWriter};
 use rsa::{BigUint, rand_core::OsRng, traits::PublicKeyParts};
 use tempfile::TempDir;
 use topological_sort::TopologicalSort;
 use tracing::{info, info_span};
 use x509_cert::Certificate;
-use zip::{CompressionMethod, DateTime, ZipWriter, write::SimpleFileOptions};

 use crate::{
    cli::{Cli, Command, HelperCli, ListCli, PassSource, ProfileGroup, TestCli},
@@ -68,11 +68,11 @@ use crate::{
 fn hash_file(path: &Path, cancel_signal: &AtomicBool) -> Result<[u8; 32]> {
    info!("Calculating hash: {path:?}");

-    let raw_reader =
-        File::open(path).with_context(|| format!("Failed to open for reading: {path:?}"))?;
-    let buf_reader = BufReader::new(raw_reader);
+    let raw_reader = File::open(path)
+        .map(BufReader::new)
+        .with_context(|| format!("Failed to open for reading: {path:?}"))?;
    let context = ring::digest::Context::new(&ring::digest::SHA256);
-    let mut hashing_reader = HashingReader::new(buf_reader, context);
+    let mut hashing_reader = HashingReader::new(raw_reader, context);

    stream::copy(&mut hashing_reader, io::sink(), cancel_signal)?;

@@ -97,7 +97,7 @@ fn verify_hash(path: &Path, sha256: &[u8; 32], cancel_signal: &AtomicBool) -> Re
 }

 fn append_avb(
-    file: &mut PSeekFile,
+    file: &File,
    name: &str,
    avb: Avb,
    hash_tree: bool,
@@ -105,7 +105,7 @@ fn append_avb(
    key_avb: &RsaSigningKey,
    cancel_signal: &AtomicBool,
 ) -> Result<()> {
-    let image_size = file.seek(SeekFrom::End(0))?;
+    let image_size = (&*file).seek(SeekFrom::End(0))?;
    let salt = ring::digest::digest(&ring::digest::SHA256, b"avbroot");
    let descriptors = vec![
        if hash_tree {
@@ -127,7 +127,7 @@ fn append_avb(
                reserved: [0u8; 60],
            };

-            descriptor.update(file, file, None, cancel_signal)?;
+            descriptor.update(file, None, cancel_signal)?;

            Descriptor::HashTree(descriptor)
        } else {
@@ -141,8 +141,8 @@ fn append_avb(
                reserved: [0u8; 60],
            };

-            file.rewind()?;
-            descriptor.update(&mut *file, cancel_signal)?;
+            (&*file).rewind()?;
+            descriptor.update(file, cancel_signal)?;

            Descriptor::Hash(descriptor)
        },
@@ -190,7 +190,7 @@ fn append_avb(
        reserved: Default::default(),
    };

-    let eof_size = file.seek(SeekFrom::End(0))?;
+    let eof_size = (&*file).seek(SeekFrom::End(0))?;
    let full_image_size = eof_size
        .checked_add(8192)
        .and_then(|s| padding::round(s, 4096))
@@ -295,7 +295,7 @@ fn create_ramdisk(

 #[allow(clippy::too_many_arguments)]
 fn create_boot_image(
-    file: &mut PSeekFile,
+    file: &File,
    name: &str,
    avb: Avb,
    boot_data: &BootData,
@@ -412,7 +412,7 @@ fn create_boot_image(
        }
    };

-    boot_image.to_writer(&mut *file)?;
+    boot_image.to_writer(file)?;

    append_avb(file, name, avb, false, ota_info, key_avb, cancel_signal)
        .with_context(|| format!("Failed to append AVB metadata for {name}"))?;
@@ -422,7 +422,7 @@ fn create_boot_image(

 #[allow(clippy::too_many_arguments)]
 fn create_dm_verity_image(
-    file: &mut PSeekFile,
+    file: &File,
    name: &str,
    avb: Avb,
    dm_verity_data: DmVerityData,
@@ -433,16 +433,16 @@ fn create_dm_verity_image(
 ) -> Result<()> {
    match dm_verity_data.content {
        DmVerityContent::SystemOtacerts => {
-            file.write_all(b"arbitrary_prefix")?;
+            (&*file).write_all(b"arbitrary_prefix")?;

            let data = otacert::create_zip(cert_ota, OtaCertBuildFlags::empty())?;
-            file.write_all(&data)?;
+            (&*file).write_all(&data)?;

-            file.write_all(b"arbitrary_suffix")?;
+            (&*file).write_all(b"arbitrary_suffix")?;
        }
    }

-    padding::write_zeros(&mut *file, 4096)?;
+    padding::write_zeros(file, 4096)?;

    append_avb(file, name, avb, true, ota_info, key_avb, cancel_signal)
        .with_context(|| format!("Failed to append AVB metadata for {name}"))?;
@@ -451,19 +451,18 @@ fn create_dm_verity_image(
 }

 fn create_vbmeta_image(
-    file: &mut PSeekFile,
+    file: &File,
    name: &str,
    avb: Avb,
    vbmeta_data: &VbmetaData,
-    inputs: &BTreeMap<String, PSeekFile>,
+    inputs: &BTreeMap<String, File>,
    key: &RsaSigningKey,
 ) -> Result<()> {
    let mut descriptors = Vec::new();

    for dep in &vbmeta_data.deps {
-        let reader = inputs[dep].reopen()?;
-        let (child_header, _, _) =
-            avb::load_image(reader).with_context(|| format!("Failed to parse AVB image: {dep}"))?;
+        let (child_header, _, _) = avb::load_image(&inputs[dep])
+            .with_context(|| format!("Failed to parse AVB image: {dep}"))?;

        if child_header.public_key.is_empty() {
            descriptors.extend(child_header.descriptors);
@@ -511,7 +510,7 @@ fn create_partition_images(
    key_avb: &RsaSigningKey,
    cert_ota: &Certificate,
    cancel_signal: &AtomicBool,
-) -> Result<BTreeMap<String, PSeekFile>> {
+) -> Result<BTreeMap<String, File>> {
    let mut topo = TopologicalSort::<&String>::new();

    for (name, partition) in partitions {
@@ -530,14 +529,13 @@ fn create_partition_images(
        };
        let partition = &partitions[name];

-        let mut file = tempfile::tempfile()
-            .map(PSeekFile::new)
+        let file = tempfile::tempfile()
            .with_context(|| format!("Failed to create temp file for {name}"))?;

        match &partition.data {
            Data::Boot(data) => {
                create_boot_image(
-                    &mut file,
+                    &file,
                    name,
                    partition.avb,
                    data,
@@ -550,7 +548,7 @@ fn create_partition_images(
            }
            Data::DmVerity(data) => {
                create_dm_verity_image(
-                    &mut file,
+                    &file,
                    name,
                    partition.avb,
                    *data,
@@ -562,7 +560,7 @@ fn create_partition_images(
                .with_context(|| format!("Failed to create dm-verity image: {name}"))?;
            }
            Data::Vbmeta(data) => {
-                create_vbmeta_image(&mut file, name, partition.avb, data, &files, key_avb)
+                create_vbmeta_image(&file, name, partition.avb, data, &files, key_avb)
                    .with_context(|| format!("Failed to create vbmeta image: {name}"))?;
            }
        }
@@ -576,14 +574,12 @@ fn create_partition_images(
 fn create_payload(
    writer: impl Write,
    partitions: &BTreeMap<String, Partition>,
-    inputs: &BTreeMap<String, PSeekFile>,
+    inputs: &BTreeMap<String, File>,
    ota_info: &OtaInfo,
    profile: &Profile,
    key_ota: &RsaSigningKey,
    cancel_signal: &AtomicBool,
 ) -> Result<(String, u64)> {
-    const COMPRESSION_FACTOR: u32 = 64 * 1024;
-
    let dynamic_partitions_names = partitions
        .iter()
        .filter(|(_, p)| matches!(&p.data, Data::DmVerity(_)))
@@ -591,18 +587,16 @@ fn create_payload(
        .collect::<Vec<_>>();

    let mut payload_partitions = vec![];
-    let mut compressed = BTreeMap::<&String, PSeekFile>::new();
+    let mut compressed = BTreeMap::<&String, File>::new();

    for (name, file) in inputs {
        let writer = tempfile::tempfile()
-            .map(PSeekFile::new)
            .with_context(|| format!("Failed to create temp file for: {name}"))?;

        let vabc_params = if dynamic_partitions_names.contains(name) {
            profile.vabc.map(|v| VabcParams {
                version: v.version,
                algo: v.algo,
-                compression_factor: COMPRESSION_FACTOR,
            })
        } else {
            None
@@ -613,7 +607,9 @@ fn create_payload(

        compressed.insert(name, writer);

-        let is_v3 = profile.vabc.is_some_and(|e| e.version == CowVersion::V3);
+        let is_v3 = profile
+            .vabc
+            .is_some_and(|e| matches!(e.version, CowVersion::V3 { .. }));

        payload_partitions.push(PartitionUpdate {
            partition_name: name.clone(),
@@ -661,10 +657,13 @@ fn create_payload(
                vabc_compression_param: profile.vabc.map(|v| v.algo.to_string()),
                cow_version: profile.vabc.map(|v| match v.version {
                    CowVersion::V2 => 2,
-                    CowVersion::V3 => 3,
+                    CowVersion::V3 { .. } => 3,
                }),
                vabc_feature_set: None,
-                compression_factor: profile.vabc.map(|_| COMPRESSION_FACTOR.into()),
+                compression_factor: profile.vabc.and_then(|v| match v.version {
+                    CowVersion::V2 => v.force_compression_factor.then_some(64 * 1024),
+                    CowVersion::V3 { compression_factor } => Some(compression_factor.into()),
+                }),
            }),
            partial_update: None,
            apex_info: vec![],
@@ -705,11 +704,11 @@ fn create_payload(
            .with_context(|| format!("Failed to copy from image: {name}"))?;
    }

-    let (_, _, properties, metadata_size) = payload_writer
+    let (_, header, properties) = payload_writer
        .finish()
        .context("Failed to finalize payload")?;

-    Ok((properties, metadata_size))
+    Ok((properties, header.blob_offset))
 }

 #[allow(clippy::too_many_arguments)]
@@ -740,40 +739,32 @@ fn create_ota(
        .truncate(true)
        .open(output)
        .with_context(|| format!("Failed to open for writing: {output:?}"))?;
-    let mut zip_writer = match zip_mode {
-        ZipMode::Streaming => {
-            let signing_writer = SigningWriter::new_streaming(raw_writer);
-            ZipWriterWrapper::new_streaming(signing_writer)
-        }
-        ZipMode::Seekable => {
-            let signing_writer = SigningWriter::new_seekable(raw_writer);
-            ZipWriterWrapper::new_seekable(signing_writer)
-        }
+    let signing_writer = match zip_mode {
+        ZipMode::Streaming => SigningWriter::new_streaming(raw_writer),
+        ZipMode::Seekable => SigningWriter::new_seekable(raw_writer),
    };
-    let options = SimpleFileOptions::default()
-        .last_modified_time(DateTime::default())
-        .compression_method(CompressionMethod::Stored)
-        .large_file(false);
+    let mut zip_writer = ZipArchiveWriter::new(signing_writer);

    let mut entries = vec![];
    let mut properties = None;
    let mut payload_metadata_size = None;

    for path in [ota::PATH_OTACERT, ota::PATH_PAYLOAD, ota::PATH_PROPERTIES] {
-        // All remaining entries are written immediately.
-        let offset = zip_writer
-            .start_file(path, options)
+        let (entry_writer, data_config) = zip_writer
+            .new_file(path)
+            .start()
            .with_context(|| format!("Failed to begin new zip entry: {path}"))?;
-        let mut writer = CountingWriter::new(&mut zip_writer);
+        let offset = entry_writer.stream_offset();
+        let mut data_writer = data_config.wrap(entry_writer);

        match path {
            ota::PATH_OTACERT => {
-                crypto::write_pem_cert(Path::new(path), &mut writer, cert_ota)
+                crypto::write_pem_cert(Path::new(path), &mut data_writer, cert_ota)
                    .with_context(|| format!("Failed to write entry: {path}"))?;
            }
            ota::PATH_PAYLOAD => {
                let (p, m) = create_payload(
-                    &mut writer,
+                    &mut data_writer,
                    &profile.partitions,
                    &inputs,
                    ota_info,
@@ -787,15 +778,17 @@ fn create_ota(
                payload_metadata_size = Some(m);
            }
            ota::PATH_PROPERTIES => {
-                writer
+                data_writer
                    .write_all(properties.as_ref().unwrap().as_bytes())
                    .with_context(|| format!("Failed to write payload properties: {path}"))?;
            }
            _ => unreachable!(),
        }

-        // Cannot fail.
-        let size = writer.stream_position()?;
+        let size = data_writer
+            .finish()
+            .and_then(|(w, d)| w.finish(d))
+            .with_context(|| format!("Failed to finalize zip entry: {path}"))?;

        entries.push(ZipEntry {
            path: path.to_owned(),
@@ -832,18 +825,15 @@ fn create_ota(
        spl_downgrade: false,
    };

-    let data_descriptor_size = match zip_mode {
-        ZipMode::Streaming => 16,
-        ZipMode::Seekable => 0,
-    };
+    let next_offset = zip_writer.stream_offset();
+
    ota::add_metadata(
        &entries,
        &mut zip_writer,
        // Offset where next entry would begin.
-        entries.last().map(|e| e.offset + e.size).unwrap() + data_descriptor_size,
+        next_offset,
        &metadata,
        payload_metadata_size.unwrap(),
-        zip_mode,
    )
    .context("Failed to write new OTA metadata")?;

@@ -861,13 +851,19 @@ fn create_ota(
 }

 fn create_fake_magisk(output: &Path) -> Result<()> {
-    let raw_writer =
-        File::create(output).with_context(|| format!("Failed to open for writing: {output:?}"))?;
-    let mut zip_writer = ZipWriter::new(raw_writer);
-    let options = SimpleFileOptions::default().last_modified_time(DateTime::default());
+    let raw_writer = OpenOptions::new()
+        .read(true)
+        .write(true)
+        .create(true)
+        .truncate(true)
+        .open(output)
+        .with_context(|| format!("Failed to open for writing: {output:?}"))?;
+    let mut zip_writer = ZipArchiveWriter::new(raw_writer);
+    let compression_method = CompressionMethod::Deflate;

    for path in [
        "assets/stub.apk",
+        "assets/util_functions.sh",
        "lib/arm64-v8a/libinit-ld.so",
        "lib/arm64-v8a/libmagisk64.so",
        "lib/arm64-v8a/libmagiskinit.so",
@@ -881,13 +877,31 @@ fn create_fake_magisk(output: &Path) -> Result<()> {
        "lib/x86_64/libmagisk64.so",
        "lib/x86_64/libmagiskinit.so",
    ] {
-        zip_writer.start_file(path, options)?;
-        write!(zip_writer, "dummy contents for {path}")?;
+        let (entry_writer, data_config) = zip_writer
+            .new_file(path)
+            .compression_method(compression_method)
+            .start()
+            .with_context(|| format!("Failed to begin new zip entry: {path}"))?;
+        let compressed_writer = zip::compressed_writer(entry_writer, compression_method)
+            .with_context(|| format!("Failed to begin new zip entry: {path}"))?;
+        let mut data_writer = data_config.wrap(compressed_writer);
+
+        if path == "assets/util_functions.sh" {
+            // avbroot looks for the version number in this file.
+            data_writer.write_all(b"MAGISK_VER_CODE=27000\n")?;
+        } else {
+            write!(data_writer, "dummy contents for {path}")?;
+        }
+
+        data_writer
+            .finish()
+            .and_then(|(w, d)| w.finish()?.finish(d))?;
    }

-    // avbroot looks for the version number in this file.
-    zip_writer.start_file("assets/util_functions.sh", options)?;
-    zip_writer.write_all(b"MAGISK_VER_CODE=27000\n")?;
+    let raw_writer = zip_writer.finish()?;
+
+    zip::make_non_streaming(raw_writer)
+        .with_context(|| format!("Failed to convert to non-streaming zip: {output:?}"))?;

    Ok(())
 }
@@ -1053,6 +1067,8 @@ fn patch_image(
        OsStr::new("--replace"),
        OsStr::new("system"),
        system_image_file.as_os_str(),
+        OsStr::new("--re-sign"),
+        OsStr::new("boot"),
        OsStr::new("--key-avb"),
        avb_key_file.as_os_str(),
        OsStr::new("--pass-avb-file"),
@@ -1141,7 +1157,7 @@ fn clean_boot_image_certs(path: &Path, cancel_signal: &AtomicBool) -> Result<()>
        .iter_mut()
        .find(|e| e.path == b"system/etc/security/otacerts.zip")
    {
-        let zip_writer = ZipWriter::new(Cursor::new(Vec::new()));
+        let zip_writer = ZipArchiveWriter::new(Cursor::new(Vec::new()));
        let empty_zip = zip_writer.finish()?.into_inner();

        entry.data = CpioEntryData::Data(empty_zip);
@@ -1189,7 +1205,7 @@ fn filter_profiles<'a>(config: &'a Config, cli: &'a ProfileGroup) -> Result<BTre
 }

 fn test_subcommand(cli: &TestCli, cancel_signal: &AtomicBool) -> Result<()> {
-    let (config, _) = config::load_config(&cli.config.config)?;
+    let config = config::load_config(&cli.config.config)?;
    let profiles = filter_profiles(&config, &cli.profile)?;

    if profiles.is_empty() {
@@ -1322,7 +1338,7 @@ fn test_subcommand(cli: &TestCli, cancel_signal: &AtomicBool) -> Result<()> {
 }

 fn list_subcommand(cli: &ListCli) -> Result<()> {
-    let (config, _) = config::load_config(&cli.config.config)?;
+    let config = config::load_config(&cli.config.config)?;

    for profile in config.profile.keys() {
        println!("{profile}");
@@ -1,4 +1,5 @@
 /hfuzz_target/
+/hfuzz_workspace/
 HONGGFUZZ.REPORT.TXT
 *.honggfuzz.cov
 *.fuzz
@@ -4,7 +4,8 @@ version.workspace = true
 license.workspace = true
 edition.workspace = true
 repository.workspace = true
-publish = false
+publish.workspace = true
+rust-version.workspace = true

 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

@@ -10,7 +10,13 @@ While avbroot's parsers are all memory-safe, it is still possible for panics or
    cargo install honggfuzz
    ```

-2. Pick a fuzz target to run. A fuzz target is the name of the source file in [`src/bin/`](./src/bin) without the `.rs` extension.
+2. [Optional] Generate sample files to use as the initial fuzzing corpus.
+
+    ```bash
+    cargo xtask fuzz-corpus
+    ```
+
+3. Pick a fuzz target to run. A fuzz target is the name of the source file in [`src/bin/`](./src/bin) without the `.rs` extension.

    The list of targets can be queried programmatically with:

@@ -18,7 +24,7 @@ While avbroot's parsers are all memory-safe, it is still possible for panics or
    cargo read-manifest | jq -r '.targets[].name'
    ```

-3. Run the fuzzer.
+4. Run the fuzzer.

    ```bash
    cargo hfuzz run <fuzz target>
@@ -41,7 +47,7 @@ While avbroot's parsers are all memory-safe, it is still possible for panics or

    When a crash occurs, the `Crashes` counter will increment and the input data that triggered the crash will be written to `hfuzz_workspace/<fuzz target>/*.fuzz`. New files are only written for unique crashes.

-4. If a crash occurs, run the following command to trigger the crash in a debugger.
+5. If a crash occurs, run the following command to trigger the crash in a debugger.

    ```bash
    cargo hfuzz run-debug <fuzz target> \
@@ -0,0 +1,38 @@
+image_size = 12288
+
+[header]
+required_libavb_version_major = 1
+required_libavb_version_minor = 0
+algorithm_type = "Sha256Rsa4096"
+hash = "3035539ec16eb6e6645a9022dd62379bf448cc53178b91fb68507eb6565b5478"
+signature = "25f59424238d43e8e247583f276d45caeed1396e5d6298c4f4f5db4bdb74453ece1783143900157b35bdd99fe29123fe98f0876663b1c985a1426bdfbdf0b31b710ebe54cbb759d4eb1aa6ecc6964c5bccd364f1a9359e53d79797ec0bdc8e453a9a6c559e95ab4d8309422ad182bdc210b3d815b277b2fc8c827ff5849997ca9cf4fcb9fae69902ba865478401c2a4976f07499f27e8f8e3e609679dd32b495c27dfe9dae4de6eb7e9a86abe30da6f0e5454f85cf170eb3ea75250d697770d0028c78c0be12280b7599019ac03a05612384f81263821b8d3cbd902e4c2b6442afed2fb7800dfc4be999f77274afa4d97512147b8ccf791e59a91e75deebd4469538d71bc9272e4c7fbbc657f3d269ec269a617314a8ceb4a4920f9654fd549c8def8a3d5a54c38871cb822af8733a575f69a187717debca30884872206f04cb98aade78c765007e2d9b024185f153ec769de1684e98b0ce41fd0dbefd9aca814887ee0917f067708c66f1e5586c578f3a4f4148f71e5ce7dd84f150b99b1547e3ca6c041fafd085bb987f16a6056a4c28875d151872bda5e316b08bb43cfb2db78759b50e4cf016f0b0b0118e03ee25508da5ce9eee77f97fdeab0831a55c43760d1ba0b4cd0c8570840549f356f32c0abf8666daf478a4cad9b84cda52430137ad12ee15425a0bf948e362c6f2da0f4ff3c57683e0b8760a014e1dbd936c11"
+public_key = "0000100080af29ebacee1fc0a795d91674aaeb4f55f4d36ba6f899ddb543be5d1cc878d45d776fe6211a330c0843322334b690dbbb9dc13fa47642abc75889dbba79c82a9dba19c64d4c099f36240775834e9d86013f433a1aaab0bed1f2212dc53cf2d967ded53209c1e5eb5b563d00d307c021b9d2d084e80cdd20a695225ce31e7fb407ccebdec5cda2eb44ed079df3edf31751e77ce43ae9681bc7f6cc4e58945366bb655550e07dd215eb516815e9457feef9301b772f92291fd5758782f20734b9ac75e7469f42ffd4055ae43a8301a37e56dfda4ede5e639fec57ab7268d8787190268952a27e6b8e3ffc503759af317da4a076fd36fe6499f15de27d81dca566f500838d13a442b01ecd1ffdb655ea2ef779bab13cd8eab649402cc1a3f81444ed24717a7c3fa65ac2b8d3625450aae15b75d3dc37e962f516799cb555063eeb262bb51f9af465fc992e07f3aa66917ce086abd9a60716f04fe155efe7901e4132a4dcdcdcf7db23e4eade6b3664bee87a7fd4c6b3247beeb0553263845d6547efda705f58cab911d9a98fb7cdd807bfdbf3dbf1f81ac3e837ba75ea5512be7246bfe768aa1edf23c469db87df980bbb939fd1f28948340882350e4c58f0450329f8088da6b908b4c4c78689eb18b3c06b683b12e518bde5cd57e7fb43792df94c38f643675e5c92b1c0a95f45256969a4bc6ea1db6682745d423cc676f97f57cf2d493d850bfba9362a858faa355e2bd0c9b1a46f6581c9c0751399788bd37fc5e597a402a3bc05bb5959677a48ce4aa9fa6ed5add36a7e11117152610b0e8f86692669825206eb5d297d7f77d114bc867736b6d6eb4309329569d78dfb910cb66132c5a3f415bd1ededfb61fd58c958db4c7a2c17578f537d24b5405e545d1618ae58be3525c9659d6baf2634255e7ca26fcfde1cbc4401e8ca062babede5f5b3f2ad5cbecd3d9332098f402666a9ef85643e3f4ab214a67a5ca91f31f810eab89df57d2f9ef35e9a5f46a99228af059cdd1f0685f1b9405beb0e44fe7f590b50feea1554e8bdaf7be7fd22e6f050a7751731cd7f8737b5acb92378da9d59068106da25b30882abad4629dff6ca9c4c0cf5337bf2d2a9e8c6182dcd6d7c681da01df6c11d0b335cf1f982156393c4e572df540cee2c53a2c146dec9644be4e81cce20df4cb136b3a08fad9a186be892d6653330d11cac1e96d308fd0d2896c8a141edfbdcac827cdf97ac581f493721c9aa1305667df312277c8ab6700c3a978e6f9d00b389faaeaa99b5e023b72c5f5ce885fa2ba816ffc735599fad1e3876d91a501efbbf1315f42a503ddd7a26a784a3f290a86f43dd580c03fc4125716d6b534e35daf1156fcaec37ac8bc9e881d5ec1715632ff82b4dc4e3aabf48c5db6f3608ce2b8bb48bceae621b07f231254dd6f1f7b4584e7102969f523252a6839dca065"
+public_key_metadata = "000102030405060708090a0b0c0d0e0f"
+rollback_index = 1677974400
+flags = 0
+rollback_index_location = 0
+release_string = "MaxLengthMaxLengthMaxLengthMaxLengthMaxLengthMa"
+reserved = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+
+[[header.descriptors]]
+type = "Property"
+key = "foobar"
+value = 'Invalid\x20UTF-8:\x20\xFF'
+
+[[header.descriptors]]
+type = "Hash"
+image_size = 6
+hash_algorithm = "sha256"
+partition_name = "vbmeta_appended_hash"
+salt = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+root_digest = "2454ef9d58f39d544eb2d92294131c0b3b1473a276418d0b1362693fdafa685b"
+flags = 0
+reserved = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef01234567"
+
+[footer]
+version_major = 1
+version_minor = 0
+original_image_size = 6
+vbmeta_offset = 4096
+vbmeta_size = 2176
+reserved = "0123456789abcdef0123456789abcdef0123456789abcdef01234567"
@@ -0,0 +1 @@
+foobar
@@ -0,0 +1,46 @@
+image_size = 28672
+
+[header]
+required_libavb_version_major = 1
+required_libavb_version_minor = 0
+algorithm_type = "Sha256Rsa4096"
+hash = "2bf01b15b31a729ca8053bc1303b0a4a638ee4819cc3106fd36ff996b703e249"
+signature = "8c4f1daf4174f4347e623b57e314d4ac7717014c7476aa2f54ab3a71f3143fb366398dd2a165e092085ce34ed1412a7bf9ce8008f2061164edc3e42ef8b7f2a7e38ebc1f05059b0b829fa82cceef91aad67ffb843c79a9c6944f0f08d7523111a8c25dbfeab9aedb0cbd682f906d33a044be072fa22657024d4d056823310f38b65cad5e293b26142798a3a49c880eb4646bfbf612294f90792b652532d5e9bb5ca79699f968ec811a3aeb038d6033ac82a571f098659294db36666da4380c8a74eb7af8dfe32e5136301dad0e49d71e726d15c0cf659850eaa878133302835fcbe624122aee63b72a960d1c1432561afa55f07a9e57c6791c813131a7c0f6a0e1036036bc613e38cff14a1353b496416f06b1a3c224d8cb51218d251c8720624c936541519167e150dc2ac92091110fae8a08bac660b6ea4ef12f0c710bc7deada678a4e8d00b4803980e40c1899e9a5208b55d06bc519004e2bbfb15c9bec614c496de1f7fe103d9173067084f0170b9f6837f179689c3a4aa11b94e54aa3a49c76838ed5d31fece91a95fc089af72833e453c64c58a8270ec868ae7a4154717f3c98a940e51a197c9ebed4188ff1969faf4d9e59618713af785b538c4f41568dd4ba9b6dff68ab18222b4195938c1e500640218d1d4f6ef014c76deab8e18782e5fff6988ef6e630ff38dcc6709de7548cc1f56d817a0dbfe5df95e6a0f53"
+public_key = "0000100080af29ebacee1fc0a795d91674aaeb4f55f4d36ba6f899ddb543be5d1cc878d45d776fe6211a330c0843322334b690dbbb9dc13fa47642abc75889dbba79c82a9dba19c64d4c099f36240775834e9d86013f433a1aaab0bed1f2212dc53cf2d967ded53209c1e5eb5b563d00d307c021b9d2d084e80cdd20a695225ce31e7fb407ccebdec5cda2eb44ed079df3edf31751e77ce43ae9681bc7f6cc4e58945366bb655550e07dd215eb516815e9457feef9301b772f92291fd5758782f20734b9ac75e7469f42ffd4055ae43a8301a37e56dfda4ede5e639fec57ab7268d8787190268952a27e6b8e3ffc503759af317da4a076fd36fe6499f15de27d81dca566f500838d13a442b01ecd1ffdb655ea2ef779bab13cd8eab649402cc1a3f81444ed24717a7c3fa65ac2b8d3625450aae15b75d3dc37e962f516799cb555063eeb262bb51f9af465fc992e07f3aa66917ce086abd9a60716f04fe155efe7901e4132a4dcdcdcf7db23e4eade6b3664bee87a7fd4c6b3247beeb0553263845d6547efda705f58cab911d9a98fb7cdd807bfdbf3dbf1f81ac3e837ba75ea5512be7246bfe768aa1edf23c469db87df980bbb939fd1f28948340882350e4c58f0450329f8088da6b908b4c4c78689eb18b3c06b683b12e518bde5cd57e7fb43792df94c38f643675e5c92b1c0a95f45256969a4bc6ea1db6682745d423cc676f97f57cf2d493d850bfba9362a858faa355e2bd0c9b1a46f6581c9c0751399788bd37fc5e597a402a3bc05bb5959677a48ce4aa9fa6ed5add36a7e11117152610b0e8f86692669825206eb5d297d7f77d114bc867736b6d6eb4309329569d78dfb910cb66132c5a3f415bd1ededfb61fd58c958db4c7a2c17578f537d24b5405e545d1618ae58be3525c9659d6baf2634255e7ca26fcfde1cbc4401e8ca062babede5f5b3f2ad5cbecd3d9332098f402666a9ef85643e3f4ab214a67a5ca91f31f810eab89df57d2f9ef35e9a5f46a99228af059cdd1f0685f1b9405beb0e44fe7f590b50feea1554e8bdaf7be7fd22e6f050a7751731cd7f8737b5acb92378da9d59068106da25b30882abad4629dff6ca9c4c0cf5337bf2d2a9e8c6182dcd6d7c681da01df6c11d0b335cf1f982156393c4e572df540cee2c53a2c146dec9644be4e81cce20df4cb136b3a08fad9a186be892d6653330d11cac1e96d308fd0d2896c8a141edfbdcac827cdf97ac581f493721c9aa1305667df312277c8ab6700c3a978e6f9d00b389faaeaa99b5e023b72c5f5ce885fa2ba816ffc735599fad1e3876d91a501efbbf1315f42a503ddd7a26a784a3f290a86f43dd580c03fc4125716d6b534e35daf1156fcaec37ac8bc9e881d5ec1715632ff82b4dc4e3aabf48c5db6f3608ce2b8bb48bceae621b07f231254dd6f1f7b4584e7102969f523252a6839dca065"
+public_key_metadata = "000102030405060708090a0b0c0d0e0f"
+rollback_index = 1677974400
+flags = 0
+rollback_index_location = 0
+release_string = "MaxLengthMaxLengthMaxLengthMaxLengthMaxLengthMa"
+reserved = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+
+[[header.descriptors]]
+type = "Property"
+key = "foobar"
+value = 'Invalid\x20UTF-8:\x20\xFF'
+
+[[header.descriptors]]
+type = "HashTree"
+dm_verity_version = 1
+image_size = 8192
+tree_offset = 8192
+tree_size = 4096
+data_block_size = 4096
+hash_block_size = 4096
+fec_num_roots = 2
+fec_offset = 12288
+fec_size = 8192
+hash_algorithm = "sha256"
+partition_name = "vbmeta_appended_hash_tree"
+salt = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+root_digest = "bfb9f01152b3315096319d03697b4013d1674063418deec55920686ad13537a8"
+flags = 0
+reserved = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef01234567"
+
+[footer]
+version_major = 1
+version_minor = 0
+original_image_size = 8192
+vbmeta_offset = 20480
+vbmeta_size = 2240
+reserved = "0123456789abcdef0123456789abcdef0123456789abcdef01234567"
@@ -0,0 +1,61 @@
+image_size = 4096
+
+[header]
+required_libavb_version_major = 1
+required_libavb_version_minor = 0
+algorithm_type = "Sha256Rsa4096"
+hash = "892d9bd80a0b8b5e5daed1cdedfc252e3fe5573ffa812fa485c2eaec17632f3b"
+signature = "752e7688a4de06eab55d37b56c4d7158e6e0477916f5217904edb85c946e4bfa4c0fb5d8aed0d1a0cc084c528cc303209075caa1067bdba7c0cc970d024c022ffe61feabc0eaf45755938d2b9b248ae07d369388b92c23c0f0f31a4a5ac1a4e92ebd2b24fff7953448a8f6827363fd3d32055977d708f72c9224b1a6616b59e79cdb20a4c17959081904d394fdfa27573f0b428fd7179ae3607c93e99a07badd6908e3f76893a346267126798503807d4a58904262afca7544349a796b04f658511724207c5a645c2976faec055f44c44ea21d63c7b2af21a8ffb7f4007249e8f81f8e2746e20965ced023b952bc48cb9c5ae11587b771f47383cfc1f5d021b1024128fc02a5a2f458d131a08975470d9373a9b70336d647943ed9e04bdaa0bbf19bfb087e0e6454cd178152eb826244bbfad20315dc20ae9a889ea99ac0045f438726bb882bf54c87fecfb3056aac7f2d649523b8cbcc8dd5a54917740e440ad7ffdaefde7e98b557798054d94653005213f377ce560fdec934435b2049b09e613906c12da713b97d31966238e7708a47501c0c91c6a9cfb4911fef54acacfa3e83f29a542d8a7d2c0f7b3b92815502ca9307e40c009415e575aab7f3b998a48d4a0a6d59adf3c8bd253620a9cbf53ea5fdb84bce5e21aca3d8d749406770725fc22f925e9a53f1c58eddc5e4dbd68d8537e7dda5035c20c54a5045434c6505"
+public_key = "0000100080af29ebacee1fc0a795d91674aaeb4f55f4d36ba6f899ddb543be5d1cc878d45d776fe6211a330c0843322334b690dbbb9dc13fa47642abc75889dbba79c82a9dba19c64d4c099f36240775834e9d86013f433a1aaab0bed1f2212dc53cf2d967ded53209c1e5eb5b563d00d307c021b9d2d084e80cdd20a695225ce31e7fb407ccebdec5cda2eb44ed079df3edf31751e77ce43ae9681bc7f6cc4e58945366bb655550e07dd215eb516815e9457feef9301b772f92291fd5758782f20734b9ac75e7469f42ffd4055ae43a8301a37e56dfda4ede5e639fec57ab7268d8787190268952a27e6b8e3ffc503759af317da4a076fd36fe6499f15de27d81dca566f500838d13a442b01ecd1ffdb655ea2ef779bab13cd8eab649402cc1a3f81444ed24717a7c3fa65ac2b8d3625450aae15b75d3dc37e962f516799cb555063eeb262bb51f9af465fc992e07f3aa66917ce086abd9a60716f04fe155efe7901e4132a4dcdcdcf7db23e4eade6b3664bee87a7fd4c6b3247beeb0553263845d6547efda705f58cab911d9a98fb7cdd807bfdbf3dbf1f81ac3e837ba75ea5512be7246bfe768aa1edf23c469db87df980bbb939fd1f28948340882350e4c58f0450329f8088da6b908b4c4c78689eb18b3c06b683b12e518bde5cd57e7fb43792df94c38f643675e5c92b1c0a95f45256969a4bc6ea1db6682745d423cc676f97f57cf2d493d850bfba9362a858faa355e2bd0c9b1a46f6581c9c0751399788bd37fc5e597a402a3bc05bb5959677a48ce4aa9fa6ed5add36a7e11117152610b0e8f86692669825206eb5d297d7f77d114bc867736b6d6eb4309329569d78dfb910cb66132c5a3f415bd1ededfb61fd58c958db4c7a2c17578f537d24b5405e545d1618ae58be3525c9659d6baf2634255e7ca26fcfde1cbc4401e8ca062babede5f5b3f2ad5cbecd3d9332098f402666a9ef85643e3f4ab214a67a5ca91f31f810eab89df57d2f9ef35e9a5f46a99228af059cdd1f0685f1b9405beb0e44fe7f590b50feea1554e8bdaf7be7fd22e6f050a7751731cd7f8737b5acb92378da9d59068106da25b30882abad4629dff6ca9c4c0cf5337bf2d2a9e8c6182dcd6d7c681da01df6c11d0b335cf1f982156393c4e572df540cee2c53a2c146dec9644be4e81cce20df4cb136b3a08fad9a186be892d6653330d11cac1e96d308fd0d2896c8a141edfbdcac827cdf97ac581f493721c9aa1305667df312277c8ab6700c3a978e6f9d00b389faaeaa99b5e023b72c5f5ce885fa2ba816ffc735599fad1e3876d91a501efbbf1315f42a503ddd7a26a784a3f290a86f43dd580c03fc4125716d6b534e35daf1156fcaec37ac8bc9e881d5ec1715632ff82b4dc4e3aabf48c5db6f3608ce2b8bb48bceae621b07f231254dd6f1f7b4584e7102969f523252a6839dca065"
+public_key_metadata = "000102030405060708090a0b0c0d0e0f"
+rollback_index = 1677974400
+flags = 0
+rollback_index_location = 0
+release_string = "MaxLengthMaxLengthMaxLengthMaxLengthMaxLengthMa"
+reserved = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+
+[[header.descriptors]]
+type = "Property"
+key = "foobar"
+value = 'Invalid\x20UTF-8:\x20\xFF'
+
+[[header.descriptors]]
+type = "HashTree"
+dm_verity_version = 1
+image_size = 4096
+tree_offset = 0
+tree_size = 2048
+data_block_size = 4096
+hash_block_size = 4096
+fec_num_roots = 1
+fec_offset = 2048
+fec_size = 2048
+hash_algorithm = "sha512"
+partition_name = "hashtreed_partition"
+salt = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+root_digest = "fedcba9876543210fedcba9876543210fedcba9876543210fedcba9876543210fedcba9876543210fedcba9876543210fedcba9876543210fedcba9876543210"
+flags = 0
+reserved = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef01234567"
+
+[[header.descriptors]]
+type = "Hash"
+image_size = 6
+hash_algorithm = "sha256"
+partition_name = "hashed_partition"
+salt = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+root_digest = "fedcba9876543210fedcba9876543210fedcba9876543210fedcba9876543210"
+flags = 0
+reserved = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef01234567"
+
+[[header.descriptors]]
+type = "KernelCmdline"
+flags = 1
+cmdline = "foobar"
+
+[[header.descriptors]]
+type = "ChainPartition"
+rollback_index_location = 1
+partition_name = "chained_partition"
+public_key = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+flags = 4275878552
+reserved = "76543210fedcba9876543210fedcba9876543210fedcba9876543210fedcba9876543210fedcba9876543210fedcba9876543210fedcba9876543210"
@@ -0,0 +1,20 @@
+type = "V0Through2"
+kernel_addr = 19088743
+ramdisk_addr = 2309737967
+second_addr = 38177486
+tags_addr = 324508639
+page_size = 4096
+os_version = 1985229328
+name = "NameNameNameName"
+cmdline = "CmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineC"
+id = [
+    1122867,
+    1146447479,
+    2291772091,
+    3437096703,
+    4293844428,
+    3148519816,
+    2003195204,
+    857870592,
+]
+extra_cmdline = "ExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtr"
@@ -0,0 +1 @@
+kernel data
@@ -0,0 +1 @@
+ramdisk data
@@ -0,0 +1 @@
+second data
@@ -0,0 +1,23 @@
+type = "V0Through2"
+kernel_addr = 19088743
+ramdisk_addr = 2309737967
+second_addr = 38177486
+tags_addr = 324508639
+page_size = 4096
+os_version = 1985229328
+name = "NameNameNameName"
+cmdline = "CmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineC"
+id = [
+    1122867,
+    1146447479,
+    2291772091,
+    3437096703,
+    4293844428,
+    3148519816,
+    2003195204,
+    857870592,
+]
+extra_cmdline = "ExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtr"
+
+[v1_extra]
+recovery_dtbo_offset = 81985529216486895
@@ -0,0 +1 @@
+kernel data
@@ -0,0 +1 @@
+ramdisk data
@@ -0,0 +1 @@
+recovery_dtbo data
@@ -0,0 +1 @@
+second data
@@ -0,0 +1,26 @@
+type = "V0Through2"
+kernel_addr = 19088743
+ramdisk_addr = 2309737967
+second_addr = 38177486
+tags_addr = 324508639
+page_size = 4096
+os_version = 1985229328
+name = "NameNameNameName"
+cmdline = "CmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineC"
+id = [
+    1122867,
+    1146447479,
+    2291772091,
+    3437096703,
+    4293844428,
+    3148519816,
+    2003195204,
+    857870592,
+]
+extra_cmdline = "ExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtraCmdlineExtr"
+
+[v1_extra]
+recovery_dtbo_offset = 81985529216486895
+
+[v2_extra]
+dtb_addr = 18364758544493064720
@@ -0,0 +1 @@
+dtb data
@@ -0,0 +1 @@
+kernel data
@@ -0,0 +1 @@
+ramdisk data
@@ -0,0 +1 @@
+recovery_dtbo data
@@ -0,0 +1 @@
+second data
@@ -0,0 +1,9 @@
+type = "V3Through4"
+os_version = 19088743
+reserved = [
+    1122867,
+    1146447479,
+    2291772091,
+    3437096703,
+]
+cmdline = "CmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmd"
@@ -0,0 +1 @@
+kernel data
@@ -0,0 +1 @@
+ramdisk data
@@ -0,0 +1,11 @@
+type = "V3Through4"
+os_version = 19088743
+reserved = [
+    1122867,
+    1146447479,
+    2291772091,
+    3437096703,
+]
+cmdline = "CmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmd"
+
+[v4_extra]
@@ -0,0 +1 @@
+kernel data
@@ -0,0 +1 @@
+ramdisk data
@@ -0,0 +1,11 @@
+type = "V3Through4"
+os_version = 19088743
+reserved = [
+    1122867,
+    1146447479,
+    2291772091,
+    3437096703,
+]
+cmdline = "CmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmd"
+
+[v4_extra]
@@ -0,0 +1 @@
+kernel data
@@ -0,0 +1 @@
+ramdisk data
@@ -0,0 +1,25 @@
+image_size = 2048
+
+[header]
+required_libavb_version_major = 1
+required_libavb_version_minor = 0
+algorithm_type = "Sha256Rsa4096"
+hash = "73b770b8199f1e709ce1cc37ee7f699faa99bf7e88c6eff429a6eda1feb6a1f9"
+signature = "58c16f72718891a11f8d1ad92b8053c20d701ac3cc997ee7889d45c999ee91b05795d59d6feac44c316fe15f92dd06e9ae3bc570d8f414191bdaab7aae4c37822cb2f6d34fdcccc65a853d2dc72ecec311db000e27fbdc7bc767b80c1a0b4e88e193ce4f878ce15cac2a4b361294eddc193d36e148768b4c6b0de4001cf2e12fe2b8be84d5217a4c3ea12c0e040900a112f6e519363635a3b3108191b5858c90b62a4d459a6d66218978e002ed07478472ff34269ca575a53eb396e3e13972f115827c741b82e5988eb6f59f953e2ee5ad9fc6ab5d86754f282011e4a511c8ce4ed9d8b077a2b5f1a3e8943c222debaab02e02b6e461f98820a8f90a470ea222b625831e280a8d9bdf96bde33bf830bc2e39a62d52103f3b8988025da86f55a5f075ea362e45c0f92279216dfdf47ead516dfd5d9da546fd5a93e325a1706c0241f71a4d4cd5abec836fd2be0812b9716ce126498a67b0d6610adc94bb9cf9b137af57b1f413155428a4bc0318aff369cdcae69008f883b48d3ba6210c8f90cb473c8101c2381ad1ab2d2b17cdf3a8e65d118beb2283b140630e3f4800159d208c34abac3d9493e321948205e1a6df529a36ec47dac50b06a71aa2350f87738022ad8175c514dfb6acca04b9bac4a002ff587639cab9f1d94e68f13739d7d72b30010db4cf0e62ea796d6207e3b9264b9ec980076c6be7dbd9973e6278225be0"
+public_key = "0000100080af29ebacee1fc0a795d91674aaeb4f55f4d36ba6f899ddb543be5d1cc878d45d776fe6211a330c0843322334b690dbbb9dc13fa47642abc75889dbba79c82a9dba19c64d4c099f36240775834e9d86013f433a1aaab0bed1f2212dc53cf2d967ded53209c1e5eb5b563d00d307c021b9d2d084e80cdd20a695225ce31e7fb407ccebdec5cda2eb44ed079df3edf31751e77ce43ae9681bc7f6cc4e58945366bb655550e07dd215eb516815e9457feef9301b772f92291fd5758782f20734b9ac75e7469f42ffd4055ae43a8301a37e56dfda4ede5e639fec57ab7268d8787190268952a27e6b8e3ffc503759af317da4a076fd36fe6499f15de27d81dca566f500838d13a442b01ecd1ffdb655ea2ef779bab13cd8eab649402cc1a3f81444ed24717a7c3fa65ac2b8d3625450aae15b75d3dc37e962f516799cb555063eeb262bb51f9af465fc992e07f3aa66917ce086abd9a60716f04fe155efe7901e4132a4dcdcdcf7db23e4eade6b3664bee87a7fd4c6b3247beeb0553263845d6547efda705f58cab911d9a98fb7cdd807bfdbf3dbf1f81ac3e837ba75ea5512be7246bfe768aa1edf23c469db87df980bbb939fd1f28948340882350e4c58f0450329f8088da6b908b4c4c78689eb18b3c06b683b12e518bde5cd57e7fb43792df94c38f643675e5c92b1c0a95f45256969a4bc6ea1db6682745d423cc676f97f57cf2d493d850bfba9362a858faa355e2bd0c9b1a46f6581c9c0751399788bd37fc5e597a402a3bc05bb5959677a48ce4aa9fa6ed5add36a7e11117152610b0e8f86692669825206eb5d297d7f77d114bc867736b6d6eb4309329569d78dfb910cb66132c5a3f415bd1ededfb61fd58c958db4c7a2c17578f537d24b5405e545d1618ae58be3525c9659d6baf2634255e7ca26fcfde1cbc4401e8ca062babede5f5b3f2ad5cbecd3d9332098f402666a9ef85643e3f4ab214a67a5ca91f31f810eab89df57d2f9ef35e9a5f46a99228af059cdd1f0685f1b9405beb0e44fe7f590b50feea1554e8bdaf7be7fd22e6f050a7751731cd7f8737b5acb92378da9d59068106da25b30882abad4629dff6ca9c4c0cf5337bf2d2a9e8c6182dcd6d7c681da01df6c11d0b335cf1f982156393c4e572df540cee2c53a2c146dec9644be4e81cce20df4cb136b3a08fad9a186be892d6653330d11cac1e96d308fd0d2896c8a141edfbdcac827cdf97ac581f493721c9aa1305667df312277c8ab6700c3a978e6f9d00b389faaeaa99b5e023b72c5f5ce885fa2ba816ffc735599fad1e3876d91a501efbbf1315f42a503ddd7a26a784a3f290a86f43dd580c03fc4125716d6b534e35daf1156fcaec37ac8bc9e881d5ec1715632ff82b4dc4e3aabf48c5db6f3608ce2b8bb48bceae621b07f231254dd6f1f7b4584e7102969f523252a6839dca065"
+public_key_metadata = ""
+rollback_index = 0
+flags = 0
+rollback_index_location = 0
+release_string = "avbtool 1.2.0"
+reserved = "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
+
+[[header.descriptors]]
+type = "Hash"
+image_size = 12288
+hash_algorithm = "sha256"
+partition_name = "boot"
+salt = "6430306466303064"
+root_digest = "abd5483e11e7940cb9bf387587a4a1659981a1b83962b7c1faf1b0cd6307d449"
+flags = 0
+reserved = "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
@@ -0,0 +1,8 @@
+type = "VendorV3Through4"
+page_size = 4096
+kernel_addr = 19088743
+ramdisk_addr = 2309737967
+cmdline = "CmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdl"
+tags_addr = 4275878552
+name = "NameNameNameName"
+dtb_addr = 1985229328
@@ -0,0 +1 @@
+dtb data
@@ -0,0 +1 @@
+ramdisk data
@@ -0,0 +1,96 @@
+type = "VendorV3Through4"
+page_size = 2048
+kernel_addr = 19088743
+ramdisk_addr = 2309737967
+cmdline = "CmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdlineCmdl"
+tags_addr = 4275878552
+name = "NameNameNameName"
+dtb_addr = 1985229328
+
+[[v4_extra.ramdisk_metas]]
+ramdisk_type = 0
+ramdisk_name = "NoneNoneNoneNoneNoneNoneNoneNone"
+board_id = [
+    1122867,
+    1146447479,
+    2291772091,
+    3437096703,
+    4293844428,
+    3148519816,
+    2003195204,
+    857870592,
+    4491468,
+    290822621,
+    577153774,
+    863484927,
+    4290475827,
+    4004144674,
+    3717813521,
+    3431482368,
+]
+
+[[v4_extra.ramdisk_metas]]
+ramdisk_type = 1
+ramdisk_name = "PlatformPlatformPlatformPlatform"
+board_id = [
+    1122867,
+    1146447479,
+    2291772091,
+    3437096703,
+    4293844428,
+    3148519816,
+    2003195204,
+    857870592,
+    4491468,
+    290822621,
+    577153774,
+    863484927,
+    4290475827,
+    4004144674,
+    3717813521,
+    3431482368,
+]
+
+[[v4_extra.ramdisk_metas]]
+ramdisk_type = 2
+ramdisk_name = "RecoveryRecoveryRecoveryRecovery"
+board_id = [
+    1122867,
+    1146447479,
+    2291772091,
+    3437096703,
+    4293844428,
+    3148519816,
+    2003195204,
+    857870592,
+    4491468,
+    290822621,
+    577153774,
+    863484927,
+    4290475827,
+    4004144674,
+    3717813521,
+    3431482368,
+]
+
+[[v4_extra.ramdisk_metas]]
+ramdisk_type = 3
+ramdisk_name = "DlkmDlkmDlkmDlkmDlkmDlkmDlkmDlkm"
+board_id = [
+    1122867,
+    1146447479,
+    2291772091,
+    3437096703,
+    4293844428,
+    3148519816,
+    2003195204,
+    857870592,
+    4491468,
+    290822621,
+    577153774,
+    863484927,
+    4290475827,
+    4004144674,
+    3717813521,
+    3431482368,
+]
@@ -0,0 +1 @@
+bootconfig data
@@ -0,0 +1 @@
+dtb data
@@ -0,0 +1 @@
+ramdisk 0 data
@@ -0,0 +1 @@
+ramdisk 1 data
@@ -0,0 +1 @@
+ramdisk 2 data
@@ -0,0 +1 @@
+ramdisk 3 data
@@ -0,0 +1,35 @@
+format = "None"
+
+[[entries]]
+path = "symlink"
+data = "target"
+file_type = "Symlink"
+file_mode = "777"
+nlink = 1
+
+[[entries]]
+path = "directory"
+file_type = "Directory"
+file_mode = "755"
+nlink = 1
+
+[[entries]]
+path = "file"
+file_type = "Regular"
+file_mode = "644"
+nlink = 1
+
+[[entries]]
+path = "reserved"
+inode = 12345
+file_type = "Reserved"
+file_mode = "4777"
+uid = 12345678
+gid = 87654321
+nlink = 2
+mtime = 1700000000
+dev_maj = 2222
+dev_min = 3333
+rdev_maj = 4444
+rdev_min = 5555
+crc32 = 4275878409
@@ -0,0 +1 @@
+foobar
@@ -0,0 +1 @@
+datadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadata
@@ -0,0 +1,80 @@
+image_type = "Empty"
+metadata_max_size = 65536
+metadata_slot_count = 3
+logical_block_size = 4096
+
+[[slots]]
+major_version = 10
+minor_version = 2
+flags = "VIRTUAL_AB_DEVICE"
+
+[[slots.groups]]
+name = "default"
+flags = ""
+partitions = []
+
+[[slots.groups]]
+name = "google_dynamic_partitions_a"
+flags = ""
+maximum_size = 8527020032
+
+[[slots.groups.partitions]]
+name = "system_a"
+attributes = "READONLY"
+
+[[slots.groups.partitions]]
+name = "system_dlkm_a"
+attributes = "READONLY"
+
+[[slots.groups.partitions]]
+name = "system_ext_a"
+attributes = "READONLY"
+
+[[slots.groups.partitions]]
+name = "product_a"
+attributes = "READONLY"
+
+[[slots.groups.partitions]]
+name = "vendor_a"
+attributes = "READONLY"
+
+[[slots.groups.partitions]]
+name = "vendor_dlkm_a"
+attributes = "READONLY"
+
+[[slots.groups]]
+name = "google_dynamic_partitions_b"
+flags = ""
+maximum_size = 8527020032
+
+[[slots.groups.partitions]]
+name = "system_b"
+attributes = "READONLY"
+
+[[slots.groups.partitions]]
+name = "system_dlkm_b"
+attributes = "READONLY"
+
+[[slots.groups.partitions]]
+name = "system_ext_b"
+attributes = "READONLY"
+
+[[slots.groups.partitions]]
+name = "product_b"
+attributes = "READONLY"
+
+[[slots.groups.partitions]]
+name = "vendor_b"
+attributes = "READONLY"
+
+[[slots.groups.partitions]]
+name = "vendor_dlkm_b"
+attributes = "READONLY"
+
+[[slots.block_devices]]
+first_logical_sector = 2048
+alignment = 1048576
+alignment_offset = 0
+size = 8531214336
+partition_name = "super"
+flags = ""
@@ -0,0 +1 @@
+datadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadata
@@ -1 +0,0 @@
-../../../../avbroot/tests/data/vbmeta_appended_hash.img
@@ -1 +0,0 @@
-../../../../avbroot/tests/data/vbmeta_appended_hash_tree.img
@@ -1 +0,0 @@
-../../../../avbroot/tests/data/vbmeta_root.img
@@ -1 +0,0 @@
-../../../../avbroot/tests/data/boot_v0.img
@@ -1 +0,0 @@
-../../../../avbroot/tests/data/boot_v1.img
@@ -1 +0,0 @@
-../../../../avbroot/tests/data/boot_v2.img
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				datadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadatadata
				`@@ -1 +0,0 @@`
				`../../../../avbroot/tests/data/vbmeta_appended_hash.img`
				`@@ -1 +0,0 @@`
				`../../../../avbroot/tests/data/vbmeta_root.img`