The vendored libavb under lib/libavb/ has been frozen at a ~2019 AOSP
snapshot (AVB version 1.1.0) for about six years. A v1.1.0 library
rejects any vbmeta whose required libavb minor version is greater than 1
with UNSUPPORTED_VERSION, so an image signed by a newer avbtool that uses
a 1.2/1.3 feature fails to verify. This series re-syncs the library to
version 1.3.0 and picks up the accumulated upstream fixes.
The vendored files are taken verbatim from AOSP external/avb commit
a1fe228b8654 ("libavb: support chain partition no ab"), the commit that
introduced version 1.3.0 [1].
Functionality the library now parses:
- AvbVBMetaImageHeader.rollback_index_location (v1.2)
- AvbChainPartitionDescriptor flags / DO_NOT_USE_AB (v1.3)
- AvbHashtreeDescriptor FLAGS_CHECK_AT_MOST_ONCE
- AVB_HASHTREE_ERROR_MODE_PANIC
Scope / integration impact:
- The AvbOps callback set is unchanged between 1.1.0 and 1.3.0, so the
U-Boot integration in common/avb_verify.c needs no changes.
- The U-Boot port is preserved rather than pulling upstream's
BoringSSL-oriented crypto restructure (sha/, boringssl/):
avb_sysdeps.h / avb_sysdeps_posix.c and the flat avb_sha.h /
avb_sha256.c / avb_sha512.c are kept as-is. The SHA API signatures
are unchanged, so the retained implementation stays compatible.
- Per-file licenses are preserved (avb_rsa.c stays MIT OR
BSD-3-Clause). The Apache-2.0-licensed avb_crc32.c is not imported,
as it is unused by U-Boot.
Note: patch 1 is a verbatim upstream import and therefore triggers a
number of checkpatch style warnings. The files are intentionally left in
upstream (AOSP) coding style to keep them diffable against external/avb;
they are deliberately not reformatted to U-Boot style.
[1]
https://android.googlesource.com/platform/external/avb/+/a1fe228b86543a21739c51352f5ce72f134fccfa
Signed-off-by: Igor Opaniuk <[email protected]>
---
Igor Opaniuk (2):
libavb: update to AOSP 1.3.0
doc: android: refresh AVB provenance and pin libavb reference
doc/android/avb2.rst | 7 +-
lib/libavb/avb_chain_partition_descriptor.c | 1 +
lib/libavb/avb_chain_partition_descriptor.h | 16 +-
lib/libavb/avb_cmdline.c | 44 +---
lib/libavb/avb_descriptor.c | 62 ++++--
lib/libavb/avb_hashtree_descriptor.h | 3 +
lib/libavb/avb_property_descriptor.h | 8 +-
lib/libavb/avb_rsa.c | 6 +-
lib/libavb/avb_slot_verify.c | 313 +++++++++++++++-------------
lib/libavb/avb_slot_verify.h | 6 +-
lib/libavb/avb_util.c | 46 +++-
lib/libavb/avb_util.h | 140 +++++++------
lib/libavb/avb_vbmeta_image.c | 1 +
lib/libavb/avb_vbmeta_image.h | 8 +-
lib/libavb/avb_version.h | 2 +-
15 files changed, 384 insertions(+), 279 deletions(-)
---
base-commit: 6741b0dfb41dc82a284ab1cff4c58af6ef2f3f9c
change-id: 20260712-avb-libavb-1-3-f273645366da
Best regards,
--
Igor Opaniuk <[email protected]>
