DSU compatibility

[Unb0rn]

Usually installing a custom DSU image requires the bootloader to be in open state. I wonder if it's possible to sign the GSI image with avb key and install it as usual android.os.image.action.START_INSTALL without re-unlocking the BL?
Better safe than sorry) Thanks!

[chenxiaolong]

Yep, this is possible as long as the main OS is signed by your own key (so that you're able to modify it).

The keys used for verifying DSUs are stored in first_stage_ramdisk/avb/*.avbpubkey in the ramdisk of the init_boot or vendor_boot partition.

The process would look something like this:

1. Extract init_boot or vendor_boot from the main OS's OTA
2. Unpack the ramdisk
3. Copy your public key avb_pkmd.bin to the ramdisk's first_stage_ramdisk/avb/ directory and rename it to have the .avbpubkey extension
4. Repack the ramdisk
5. Patch the main OS's OTA with avbroot and include the modified init_boot/vendor_boot
6. Now, the main OS is able to boot any DSU image signed by your key

[Unb0rn]

This is super cool) Having a key to automate this in avbroot would be incredible - we're already repacking the system with ota certs, adding an option for ramdisk repack would be great.
Manual repack with something like magiskboot works for me either. Thanks!

[chenxiaolong]

Yeah, I think it should be pretty easy to add an option to do this automatically. I'll look into it today.

[chenxiaolong]

This has been implemented in #289! Patching the OTA with --dsu will add the AVB public key to the ramdisk.

This change will be included in avbroot 3.2.0, which I'll release later today.

[Unb0rn]

Hey @chenxiaolong! Sorry for pinging you directly - is there any way to re-sign the GSI image the same way as we do with OTA using avbroot? Thanks!)

[chenxiaolong]

Do you have a link to an example GSI image? I could take a look and find out.

EDIT: Nevermind, I found some at: https://developer.android.com/topic/generic-system-image/releases

[chenxiaolong]

I don't have a spare device where I can test this, but I think it should be as easy as:

# --force is required
avbroot avb repack -i system.img -o system.resigned.img -k avb.key --force

and then installing system.resigned.img with android.os.image.action.START_INSTALL.

[Unb0rn]

Thank you! Tried it but something seems to be off - the GSI is installed, yet it doesn't boot. Trying on Pixel 9 Pro Fold/CalyxOS/A15. UART debugger would've made everything much easier)

[Unb0rn]

BTW, do you replace AOSP keys with ours running --dsu or just adding? I wanna try AOSP DSU loader - maybe something's off with the image I use

[chenxiaolong]

Darn 🙁 --dsu adds to the existing keys. If the ROM you're running contains AOSP keys, then they should still be there.