mirror of
https://github.com/chenxiaolong/avbroot.git
synced 2026-07-03 14:05:11 +02:00
Andrew Gunnerson
e397998d9e
The zip crate gained support for streaming writes in its master branch, so we can finally upgrade from our ancient fork of it. The new implementation is done a bit differently, with seekable writers having the ZipWriter<W> type and streaming writers having the ZipWriter<StreamWriter<W>> type. This forces us to add a new wrapper type since we have to switch between them at runtime. We still need to maintain a (hopefully temporary) fork of the crate due to a few issues: 1. There's no way to get the original underlying writer instance back after finalizing a streaming zip. A fix for this has been submitted upstream: https://github.com/zip-rs/zip2/pull/367 2. The streaming writes implementation does not include the magic signature for data descriptors. While the zip spec says the magic value is optional and parsers should not require it, older versions of Android's libziparchive do. A fix for this has been submitted upstream: https://github.com/zip-rs/zip2/pull/368 3. There is currently no way to get the data offset of zip entries. avbroot requires this to fill in the OTA metadata's "property files" entries, which Android uses to read file data without parsing the zip file structures. This new zip update produces files that are slightly different to before. The "version made by" and "version needed to extract" fields are now set to their minimum possible values. Previously, the zip crate was hardcoded to use versions 4.6 and 2.0, respectively. Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
74 lines
2.1 KiB
TOML
74 lines
2.1 KiB
TOML
[advisories]
|
|
version = 2
|
|
yanked = "deny"
|
|
ignore = [
|
|
# https://rustsec.org/advisories/RUSTSEC-2023-0071
|
|
#
|
|
# This is a side-channel vulnerability where secrets can be leaked to an
|
|
# attacker that is able to measure the timing of a large number of RSA
|
|
# operations. As of 2023-12-03, there is no released version of the rsa
|
|
# crate that contains a fix.
|
|
#
|
|
# For avbroot specifically, this vulnerability is not too critical for a
|
|
# couple reasons:
|
|
#
|
|
# 1. avbroot performs RSA signing only at the end of lengthy processes
|
|
# that involve a lot of disk I/O. It's very expensive to run avbroot
|
|
# the millions of times needed to capture a sufficient amount of timing
|
|
# data.
|
|
# 2. During a single run of avbroot, it will only perform RSA signing a
|
|
# handful of times. To get sufficient measurements, the attacker would
|
|
# need to rerun avbroot. If they are able to rerun avbroot, then they
|
|
# are also able to just read and steal the private key directly.
|
|
#
|
|
# avbroot has no network capabilities, so this is not inherently remotely
|
|
# exploitable.
|
|
"RUSTSEC-2023-0071",
|
|
]
|
|
|
|
[licenses]
|
|
version = 2
|
|
include-dev = true
|
|
allow = [
|
|
"Apache-2.0",
|
|
"Apache-2.0 WITH LLVM-exception",
|
|
"BSD-3-Clause",
|
|
"bzip2-1.0.6",
|
|
"GPL-3.0",
|
|
"ISC",
|
|
"MIT",
|
|
"Unicode-3.0",
|
|
"Zlib",
|
|
]
|
|
|
|
[[licenses.clarify]]
|
|
name = "ring"
|
|
expression = "MIT AND ISC AND OpenSSL"
|
|
license-files = [
|
|
{ path = "LICENSE", hash = 0xbd0eed23 },
|
|
]
|
|
|
|
[bans]
|
|
multiple-versions = "warn"
|
|
multiple-versions-include-dev = true
|
|
deny = [
|
|
# https://github.com/serde-rs/serde/issues/2538
|
|
{ name = "serde_derive", version = ">=1.0.172,<1.0.184" },
|
|
]
|
|
|
|
[bans.build]
|
|
executables = "deny"
|
|
include-dependencies = true
|
|
include-workspace = true
|
|
bypass = [
|
|
# Copies of unmodified crashwrangler objects for old macOS versions.
|
|
{ name = "honggfuzz", allow-globs = ["honggfuzz/third_party/mac/CrashReport_*.o"] },
|
|
]
|
|
|
|
[sources]
|
|
unknown-registry = "deny"
|
|
unknown-git = "deny"
|
|
allow-git = [
|
|
"https://github.com/chenxiaolong/zip2",
|
|
]
|