DSU compatibility

[Unb0rn]

Usually installing a custom DSU image requires the bootloader to be in open state. I wonder if it's possible to sign the GSI image with avb key and install it as usual android.os.image.action.START_INSTALL without re-unlocking the BL?
Better safe than sorry) Thanks!

[chenxiaolong]

Yep, this is possible as long as the main OS is signed by your own key (so that you're able to modify it).

The keys used for verifying DSUs are stored in first_stage_ramdisk/avb/*.avbpubkey in the ramdisk of the init_boot or vendor_boot partition.

The process would look something like this:

1. Extract init_boot or vendor_boot from the main OS's OTA
2. Unpack the ramdisk
3. Copy your public key avb_pkmd.bin to the ramdisk's first_stage_ramdisk/avb/ directory and rename it to have the .avbpubkey extension
4. Repack the ramdisk
5. Patch the main OS's OTA with avbroot and include the modified init_boot/vendor_boot
6. Now, the main OS is able to boot any DSU image signed by your key

[Unb0rn]

This is super cool) Having a key to automate this in avbroot would be incredible - we're already repacking the system with ota certs, adding an option for ramdisk repack would be great.
Manual repack with something like magiskboot works for me either. Thanks!

[chenxiaolong]

Yeah, I think it should be pretty easy to add an option to do this automatically. I'll look into it today.

[chenxiaolong]

This has been implemented in #289! Patching the OTA with --dsu will add the AVB public key to the ramdisk.

This change will be included in avbroot 3.2.0, which I'll release later today.