AVBTool MOD v1.2.0

English

Highlights

Fully Self-Contained — No External Dependencies

This avbtool is a standalone, self-contained build. All cryptographic operations and FEC generation run in-process, with no OpenSSL binary and no external fec tool required.

• In-process RSA — RSA private/public key parsing and signing use the bundled cryptography library instead of shelling out to openssl. The frozen single-file executable has no external binary dependencies.
• --pass-file support — Load encrypted RSA private keys in-process via --pass-file. The passphrase is held in memory for the duration of the invocation only; the decrypted key is never written to disk.
• In-process FEC — Reed-Solomon forward error correction codes are generated directly inside avbtool, emitting the same 4 KiB libfec footer (magic 0xfecfecfe) as AOSP. calc_fec_data_size() and on-disk layout remain consistent.

--dynamic_partition_size

New option for add_hash_footer and add_hashtree_footer:

• partition_size is derived automatically from the image size after any existing footer is truncated, so repeated runs remain idempotent.
• The AVB footer and metadata are placed immediately after the image payload, with no manual partition size calculation needed.
• Combining --dynamic_partition_size with --partition_size or --calc_max_image_size is now a hard error.

Python 3 Compatibility and CLI Hardening

• Binary commands that defaulted to sys.stdout (generate_test_image, extract_vbmeta_image, ATX certificate/metadata/credential commands) now use stdout.buffer, eliminating a TypeError on Python 3.
• Missing required arguments (--image, --partition_size) produce clear error messages instead of NoneType tracebacks.
• set_ab_metadata creates a missing misc image, matching its documented behavior.
• The no-subcommand case prints a usage error; other attribute errors are no longer swallowed silently.

Secure Defaults

• add_hashtree_footer now defaults to sha256 hash (previously sha1), meeting Android 10+ dm-verity requirements out of the box. --hash_algorithm sha1 remains available for legacy devices.

Frozen Binary Packaging

• CI builds single-file executables for amd64 and arm64 using both PyInstaller and Nuitka, packaged in a single workflow.
• Each binary is named with version, architecture, builder, and Shanghai date stamp.

Compatibility Notes

• --dynamic_partition_size places the AVB footer immediately after the image. If the target partition is smaller than image_size + metadata + footer, the operation will fail with a clear error.
• The in-process RSA loader supports PEM and DER formats for both private and public keys. Keys with exponents other than 65537 are not supported.
• Operating requirements: Python 3.8+, or use the pre-built frozen binaries (no Python required).

---

中文

主要更新

完全自包含 — 无外部依赖

此 avbtool 为独立自包含构建，所有加密运算和 FEC 生成均在进程内完成，无需 OpenSSL 二进制文件，无需外部 fec 工具。

• 进程内 RSA — RSA 密钥解析和签名通过打包的 cryptography 库完成，不再调用 openssl。冻结单文件可执行程序无外部二进制依赖。
• --pass-file 支持 — 通过 --pass-file 在进程内加载加密 RSA 私钥，口令仅在单次调用期间驻留内存，解密密钥永远不会写入磁盘。
• 进程内 FEC — Reed-Solomon 前向纠错码直接在 avbtool 内生成，输出与 AOSP 相同的 4 KiB libfec footer（magic 0xfecfecfe），calc_fec_data_size() 与磁盘布局保持一致。

--dynamic_partition_size

add_hash_footer 和 add_hashtree_footer 新增选项：

• 自动从镜像大小推导 partition_size（在截断已有 footer 后计算），重复执行仍保持幂等。
• AVB footer 和元数据紧随镜像载荷之后放置，无需手动计算分区大小。
• --dynamic_partition_size 与 --partition_size 或 --calc_max_image_size 同时使用时会报错。

Python 3 兼容性与 CLI 加固

• 默认写入 sys.stdout 的二进制命令（generate_test_image、extract_vbmeta_image、ATX 证书/元数据/凭据命令）现在使用 stdout.buffer，消除 Python 3 下的 TypeError。
• 缺少必需参数（--image、--partition_size）时给出明确错误信息，不再抛出 NoneType traceback。
• set_ab_metadata 在 misc 镜像不存在时自动创建，与文档描述一致。
• 无子命令时打印 usage error，其他属性错误不再被静默吞掉。

安全默认值

• add_hashtree_footer 默认哈希算法从 sha1 改为 sha256，满足 Android 10+ dm-verity 要求，开箱即用。--hash_algorithm sha1 仍可用于旧设备。

冻结二进制打包

• CI 使用 PyInstaller 和 Nuitka 为 amd64 和 arm64 构建单文件可执行程序，统一在一个 workflow 中完成。
• 每个二进制文件以版本、架构、构建器和上海日期命名。

兼容性注意事项

• --dynamic_partition_size 将 AVB footer 紧接镜像末尾放置，若目标分区小于 image_size + metadata + footer 则会失败并给出明确错误。
• 进程内 RSA 加载器支持 PEM 和 DER 格式的私钥和公钥，不支持指数非 65537 的密钥。
• 运行要求：Python 3.8+，或直接使用预构建的冻结二进制（无需 Python 环境）。