avbroot/CHANGELOG.md

Unreleased

• Add support for AVB 2.0 format 1.3.0 (for Android 15) (PR #210)
• Add new avbroot key decode-avb command for converting AVB-encoded public keys to the standard PKCS8-encoded format (PR #219)
• Adjust AVB sanity check to validate *_dlkm and odm specifically because some devices have an unprotected odm_ext partition (PR #220)
• Add new --otacerts-partition option to override the autodetected partition for replacing otacerts.zip (Issue #218, PR #221)
• Build precompiled executables as statically linked executables (Issue #222, PR #224, PR #227)
• Limit critical partition check to bootloader-verified partitions (Issue #223, PR #226)

Behind-the-scenes changes:

• Fix lint warnings introduced in Rust 1.74.0 (PR #211)
• Temporarily silence RUSTSEC-2023-0071 warning in cargo-deny (PR #214)

Version 2.3.3

• Add support for XZ-compressed ramdisks (Issue #203, PR #207)
• Merge property and kernel command line AVB descriptors when replacing partitions (Issue #203, PR #208)

Version 2.3.2

• Improve error messages when using --replace with an image that has the wrong AVB descriptor type (Issue #201, PR #202)
• Automatically update legacy dm= kernel command line descriptor when packing AVB images (Issue #203, PR #205)
• Automatically promote insecure hash algorithms (eg. sha1) to sha256 when packing AVB images (Issue #203, PR #206)

Version 2.3.1

• Mark Magisk 264xx as supported (PR #199)

Version 2.3.0

• Fix missing --help text for avbroot avb unpack's --ignore-invalid option (PR #183)
• Group avbroot ota patch --help output into more readable sections (PR #184)
• Add more checks to ensure that the OTA has a secure AVB setup (PR #188)
  • OTAs with blatantly insecure or missing AVB configuration are now more likely to be rejected by avbroot to avoid providing a false sense of security.
• Allow avbroot avb verify and avbroot ota verify to work for dm-verity partitions that use insecure SHA1 hashes (PR #190)
• Add support for legacy Android 11 OTAs (Discussion #195, PR #196)

Behind-the-scenes changes:

• Bump maximum payload manifest size to 4 MiB (PR #182)
• Rework file handle reopen functionality to use traits instead of callbacks (PR #189)
• Don't set signature algorithm field for indirectly signed boot images (PR #191)
• Update dependencies (PR #197)

Version 2.2.0

It's Android 14 release day! All versions of avbroot, including the old Python version, are compatible with Android 14 OTAs.

Changes:

• Add new unpack and pack commands for cpio archives (ramdisks) (PR #173, PR #178)
• Rename header.toml to boot.toml for the boot image unpack and pack commands (PR #175)
  • Also changes the file format a bit to make it more readable.

Behind-the-scenes changes:

• Add streaming CPIO reader and writer (PR #172)
• Update dependencies (PR #174, PR #181)
• Switch to prost for protobuf encoding/decoding (PR #176)

Version 2.1.1

This release is all about hardening avbroot against untrusted (or corrupted) inputs. While all of avbroot's parsers are memory-safe, it's still possible for crashes to occur due to logic issues like allocating too much memory or dividing by zero. With this release, most of these potential issues have been fixed and fuzz tests have been added to help find more of these situations.

On the filesystem side of things, it is no longer possible for a nefarious program to cause avbroot to write to unintended locations by eg. swapping out an output directory or temp directory with a symlink while it is running.

Behind-the-scenes changes:

• Consolidate logic for handling --pass-file and --pass-env-var (PR #156)
• cargo-deny: Block executables in dependencies (PR #133)
• Implement size limits for parsers to prevent allocating too much memory (Issue #157, PR #158, PR #159, PR #164, PR #168, PR #169, PR #170)
• Add fuzzers to help catch panics/crashes (Issue #160, PR #161, PR #162, PR #163, PR #165, PR #167)
• Use handle-based directory operations instead of path-based directory operations (Issue #166, PR #171)

Version 2.1.0

• Add support for dm-verify FEC (forward error correction) (Issue #145, PR #146)
  • ota verify and avb verify will now check the FEC data.
• Print status and warning messages to stderr (PR #149)
• Add new avb unpack, avb pack, and avb repack commands for AVB images (Issue #144, Issue #148, PR #152)
  • avb verify now optionally accepts --repair to fix corrupted dm-verity images.

Behind-the-scenes changes:

• Remove unnecessary use of Arc (PR #147)
• Use bstr crate to escape mostly UTF-8 binary data (PR #150)
• Improve error fields and error contest (PR #153)

Version 2.0.3

• Upgrade xz version in precompiled binaries (Issue #138, PR #139)
  • This fixes the ota extract and ota verify commands in some multithreaded situations.
• Add --version option to print out avbroot's version (Issue #138, PR #140)

Version 2.0.2

• Fix data_offset being set for payload operations that don't need it (PR #136)
  • This fixes patched stock OnePlus images from being rejected when flashing.

Behind-the-scenes changes:

• Move full OTA check to CLI functions to allow library functions to parse delta OTAs (PR #135)
• Remove unnecessary use of anyhow macro (PR #137)

Version 2.0.1

• Add support for Magisk 263xx (PR #132)

Version 2.0.0

• Initial Rust release. The old Python implementation can be found in the python branch. (PR #130)