generate_delta_main.cc revision 8e66534e4c76de1b2882ef637cdb8f3c361cb48f 
1// Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#include <errno.h>
6#include <fcntl.h>
7#include <sys/stat.h>
8#include <sys/types.h>
9#include <unistd.h>
10
11#include <set>
12#include <string>
13#include <vector>
14
15#include <base/logging.h>
16#include <base/strings/string_number_conversions.h>
17#include <base/strings/string_split.h>
18#include <chromeos/flag_helper.h>
19#include <glib.h>
20
21#include "update_engine/delta_performer.h"
22#include "update_engine/payload_generator/delta_diff_generator.h"
23#include "update_engine/payload_generator/payload_generation_config.h"
24#include "update_engine/payload_generator/payload_signer.h"
25#include "update_engine/payload_verifier.h"
26#include "update_engine/prefs.h"
27#include "update_engine/subprocess.h"
28#include "update_engine/terminator.h"
29#include "update_engine/update_metadata.pb.h"
30#include "update_engine/utils.h"
31
32// This file contains a simple program that takes an old path, a new path,
33// and an output file as arguments and the path to an output file and
34// generates a delta that can be sent to Chrome OS clients.
35
36using std::set;
37using std::string;
38using std::vector;
39
40namespace chromeos_update_engine {
41
42namespace {
43
44void ParseSignatureSizes(const string& signature_sizes_flag,
45                         vector<int>* signature_sizes) {
46  signature_sizes->clear();
47  vector<string> split_strings;
48
49  base::SplitString(signature_sizes_flag, ':', &split_strings);
50  for (const string& str : split_strings) {
51    int size = 0;
52    bool parsing_successful = base::StringToInt(str, &size);
53    LOG_IF(FATAL, !parsing_successful)
54        << "Invalid signature size: " << str;
55
56    LOG_IF(FATAL, size != (2048 / 8)) <<
57        "Only signature sizes of 256 bytes are supported.";
58
59    signature_sizes->push_back(size);
60  }
61}
62
63bool ParseImageInfo(const string& channel,
64                    const string& board,
65                    const string& version,
66                    const string& key,
67                    const string& build_channel,
68                    const string& build_version,
69                    ImageInfo* image_info) {
70  // All of these arguments should be present or missing.
71  bool empty = channel.empty();
72
73  CHECK_EQ(channel.empty(), empty);
74  CHECK_EQ(board.empty(), empty);
75  CHECK_EQ(version.empty(), empty);
76  CHECK_EQ(key.empty(), empty);
77
78  if (empty)
79    return false;
80
81  image_info->set_channel(channel);
82  image_info->set_board(board);
83  image_info->set_version(version);
84  image_info->set_key(key);
85
86  image_info->set_build_channel(
87      build_channel.empty() ? channel : build_channel);
88
89  image_info->set_build_version(
90      build_version.empty() ? version : build_version);
91
92  return true;
93}
94
95void CalculatePayloadHashForSigning(const vector<int> &sizes,
96                                    const string& out_hash_file,
97                                    const string& in_file) {
98  LOG(INFO) << "Calculating payload hash for signing.";
99  LOG_IF(FATAL, in_file.empty())
100      << "Must pass --in_file to calculate hash for signing.";
101  LOG_IF(FATAL, out_hash_file.empty())
102      << "Must pass --out_hash_file to calculate hash for signing.";
103
104  chromeos::Blob hash;
105  bool result = PayloadSigner::HashPayloadForSigning(in_file, sizes,
106                                                     &hash);
107  CHECK(result);
108
109  result = utils::WriteFile(out_hash_file.c_str(), hash.data(), hash.size());
110  CHECK(result);
111  LOG(INFO) << "Done calculating payload hash for signing.";
112}
113
114
115void CalculateMetadataHashForSigning(const vector<int> &sizes,
116                                     const string& out_metadata_hash_file,
117                                     const string& in_file) {
118  LOG(INFO) << "Calculating metadata hash for signing.";
119  LOG_IF(FATAL, in_file.empty())
120      << "Must pass --in_file to calculate metadata hash for signing.";
121  LOG_IF(FATAL, out_metadata_hash_file.empty())
122      << "Must pass --out_metadata_hash_file to calculate metadata hash.";
123
124  chromeos::Blob hash;
125  bool result = PayloadSigner::HashMetadataForSigning(in_file, sizes,
126                                                      &hash);
127  CHECK(result);
128
129  result = utils::WriteFile(out_metadata_hash_file.c_str(), hash.data(),
130                            hash.size());
131  CHECK(result);
132
133  LOG(INFO) << "Done calculating metadata hash for signing.";
134}
135
136void SignPayload(const string& in_file,
137                 const string& out_file,
138                 const string& signature_file) {
139  LOG(INFO) << "Signing payload.";
140  LOG_IF(FATAL, in_file.empty())
141      << "Must pass --in_file to sign payload.";
142  LOG_IF(FATAL, out_file.empty())
143      << "Must pass --out_file to sign payload.";
144  LOG_IF(FATAL, signature_file.empty())
145      << "Must pass --signature_file to sign payload.";
146  vector<chromeos::Blob> signatures;
147  vector<string> signature_files;
148  base::SplitString(signature_file, ':', &signature_files);
149  for (const string& signature_file : signature_files) {
150    chromeos::Blob signature;
151    CHECK(utils::ReadFile(signature_file, &signature));
152    signatures.push_back(signature);
153  }
154  uint64_t final_metadata_size;
155  CHECK(PayloadSigner::AddSignatureToPayload(
156      in_file, signatures, out_file, &final_metadata_size));
157  LOG(INFO) << "Done signing payload. Final metadata size = "
158            << final_metadata_size;
159}
160
161void VerifySignedPayload(const string& in_file,
162                         const string& public_key,
163                         int public_key_version) {
164  LOG(INFO) << "Verifying signed payload.";
165  LOG_IF(FATAL, in_file.empty())
166      << "Must pass --in_file to verify signed payload.";
167  LOG_IF(FATAL, public_key.empty())
168      << "Must pass --public_key to verify signed payload.";
169  CHECK(PayloadVerifier::VerifySignedPayload(in_file, public_key,
170                                             public_key_version));
171  LOG(INFO) << "Done verifying signed payload.";
172}
173
174void ApplyDelta(const string& in_file,
175                const string& old_kernel,
176                const string& old_rootfs,
177                const string& prefs_dir) {
178  LOG(INFO) << "Applying delta.";
179  LOG_IF(FATAL, old_rootfs.empty())
180      << "Must pass --old_image to apply delta.";
181  Prefs prefs;
182  InstallPlan install_plan;
183  LOG(INFO) << "Setting up preferences under: " << prefs_dir;
184  LOG_IF(ERROR, !prefs.Init(base::FilePath(prefs_dir)))
185      << "Failed to initialize preferences.";
186  // Get original checksums
187  LOG(INFO) << "Calculating original checksums";
188  PartitionInfo kern_info, root_info;
189  ImageConfig old_image;
190  old_image.kernel.path = old_kernel;
191  old_image.rootfs.path = old_rootfs;
192  CHECK(old_image.LoadImageSize());
193  CHECK(DeltaDiffGenerator::InitializePartitionInfo(old_image.kernel,
194                                                    &kern_info));
195  CHECK(DeltaDiffGenerator::InitializePartitionInfo(old_image.rootfs,
196                                                    &root_info));
197  install_plan.kernel_hash.assign(kern_info.hash().begin(),
198                                  kern_info.hash().end());
199  install_plan.rootfs_hash.assign(root_info.hash().begin(),
200                                  root_info.hash().end());
201  DeltaPerformer performer(&prefs, nullptr, &install_plan);
202  CHECK_EQ(performer.Open(old_rootfs.c_str(), 0, 0), 0);
203  CHECK(performer.OpenKernel(old_kernel.c_str()));
204  chromeos::Blob buf(1024 * 1024);
205  int fd = open(in_file.c_str(), O_RDONLY, 0);
206  CHECK_GE(fd, 0);
207  ScopedFdCloser fd_closer(&fd);
208  for (off_t offset = 0;; offset += buf.size()) {
209    ssize_t bytes_read;
210    CHECK(utils::PReadAll(fd, buf.data(), buf.size(), offset, &bytes_read));
211    if (bytes_read == 0)
212      break;
213    CHECK_EQ(performer.Write(buf.data(), bytes_read), bytes_read);
214  }
215  CHECK_EQ(performer.Close(), 0);
216  DeltaPerformer::ResetUpdateProgress(&prefs, false);
217  LOG(INFO) << "Done applying delta.";
218}
219
220int Main(int argc, char** argv) {
221  DEFINE_string(old_dir, "",
222                "Directory where the old rootfs is loop mounted read-only");
223  DEFINE_string(new_dir, "",
224                "[DEPRECATED] Directory where the new rootfs is loop mounted "
225                "read-only. Not required anymore.");
226  DEFINE_string(old_image, "", "Path to the old rootfs");
227  DEFINE_string(new_image, "", "Path to the new rootfs");
228  DEFINE_string(old_kernel, "", "Path to the old kernel partition image");
229  DEFINE_string(new_kernel, "", "Path to the new kernel partition image");
230  DEFINE_string(in_file, "",
231                "Path to input delta payload file used to hash/sign payloads "
232                "and apply delta over old_image (for debugging)");
233  DEFINE_string(out_file, "", "Path to output delta payload file");
234  DEFINE_string(out_hash_file, "", "Path to output hash file");
235  DEFINE_string(out_metadata_hash_file, "",
236                "Path to output metadata hash file");
237  DEFINE_string(private_key, "", "Path to private key in .pem format");
238  DEFINE_string(public_key, "", "Path to public key in .pem format");
239  DEFINE_int32(public_key_version,
240               chromeos_update_engine::kSignatureMessageCurrentVersion,
241               "Key-check version # of client");
242  DEFINE_string(prefs_dir, "/tmp/update_engine_prefs",
243                "Preferences directory, used with apply_delta");
244  DEFINE_string(signature_size, "",
245                "Raw signature size used for hash calculation. "
246                "You may pass in multiple sizes by colon separating them. E.g. "
247                "2048:2048:4096 will assume 3 signatures, the first two with "
248                "2048 size and the last 4096.");
249  DEFINE_string(signature_file, "",
250                "Raw signature file to sign payload with. To pass multiple "
251                "signatures, use a single argument with a colon between paths, "
252                "e.g. /path/to/sig:/path/to/next:/path/to/last_sig . Each "
253                "signature will be assigned a client version, starting from "
254                "kSignatureOriginalVersion.");
255  DEFINE_int32(chunk_size, -1, "Payload chunk size (-1 -- no limit/default)");
256  DEFINE_uint64(rootfs_partition_size,
257               chromeos_update_engine::kRootFSPartitionSize,
258               "RootFS partition size for the image once installed");
259  DEFINE_int32(minor_version, DeltaPerformer::kFullPayloadMinorVersion,
260               "The minor version of the payload being generated");
261
262  DEFINE_string(old_channel, "",
263                "The channel for the old image. 'dev-channel', 'npo-channel', "
264                "etc. Ignored, except during delta generation.");
265  DEFINE_string(old_board, "",
266                "The board for the old image. 'x86-mario', 'lumpy', "
267                "etc. Ignored, except during delta generation.");
268  DEFINE_string(old_version, "",
269                "The build version of the old image. 1.2.3, etc.");
270  DEFINE_string(old_key, "",
271                "The key used to sign the old image. 'premp', 'mp', 'mp-v3',"
272                " etc");
273  DEFINE_string(old_build_channel, "",
274                "The channel for the build of the old image. 'dev-channel', "
275                "etc, but will never contain special channels such as "
276                "'npo-channel'. Ignored, except during delta generation.");
277  DEFINE_string(old_build_version, "",
278                "The version of the build containing the old image.");
279
280  DEFINE_string(new_channel, "",
281                "The channel for the new image. 'dev-channel', 'npo-channel', "
282                "etc. Ignored, except during delta generation.");
283  DEFINE_string(new_board, "",
284                "The board for the new image. 'x86-mario', 'lumpy', "
285                "etc. Ignored, except during delta generation.");
286  DEFINE_string(new_version, "",
287                "The build version of the new image. 1.2.3, etc.");
288  DEFINE_string(new_key, "",
289                "The key used to sign the new image. 'premp', 'mp', 'mp-v3',"
290                " etc");
291  DEFINE_string(new_build_channel, "",
292                "The channel for the build of the new image. 'dev-channel', "
293                "etc, but will never contain special channels such as "
294                "'npo-channel'. Ignored, except during delta generation.");
295  DEFINE_string(new_build_version, "",
296                "The version of the build containing the new image.");
297
298  chromeos::FlagHelper::Init(argc, argv,
299      "Generates a payload to provide to ChromeOS' update_engine.\n\n"
300      "This tool can create full payloads and also delta payloads if the src\n"
301      "image is provided. It also provides debugging options to apply, sign\n"
302      "and verify payloads.");
303  Terminator::Init();
304  Subprocess::Init();
305
306  logging::LoggingSettings log_settings;
307  log_settings.log_file     = "delta_generator.log";
308  log_settings.logging_dest = logging::LOG_TO_SYSTEM_DEBUG_LOG;
309  log_settings.lock_log     = logging::DONT_LOCK_LOG_FILE;
310  log_settings.delete_old   = logging::APPEND_TO_OLD_LOG_FILE;
311
312  logging::InitLogging(log_settings);
313
314  // Check flags.
315  if (!FLAGS_new_dir.empty()) {
316    LOG(INFO) << "--new_dir flag is deprecated and ignored.";
317  }
318
319  vector<int> signature_sizes;
320  ParseSignatureSizes(FLAGS_signature_size, &signature_sizes);
321
322  if (!FLAGS_out_hash_file.empty() || !FLAGS_out_metadata_hash_file.empty()) {
323    if (!FLAGS_out_hash_file.empty()) {
324      CalculatePayloadHashForSigning(signature_sizes, FLAGS_out_hash_file,
325                                     FLAGS_in_file);
326    }
327    if (!FLAGS_out_metadata_hash_file.empty()) {
328      CalculateMetadataHashForSigning(signature_sizes,
329                                      FLAGS_out_metadata_hash_file,
330                                      FLAGS_in_file);
331    }
332    return 0;
333  }
334  if (!FLAGS_signature_file.empty()) {
335    SignPayload(FLAGS_in_file, FLAGS_out_file, FLAGS_signature_file);
336    return 0;
337  }
338  if (!FLAGS_public_key.empty()) {
339    VerifySignedPayload(FLAGS_in_file, FLAGS_public_key,
340                        FLAGS_public_key_version);
341    return 0;
342  }
343  if (!FLAGS_in_file.empty()) {
344    ApplyDelta(FLAGS_in_file, FLAGS_old_kernel, FLAGS_old_image,
345               FLAGS_prefs_dir);
346    return 0;
347  }
348
349  // A payload generation was requested. Convert the flags to a
350  // PayloadGenerationConfig.
351  PayloadGenerationConfig payload_config;
352  payload_config.source.rootfs.path = FLAGS_old_image;
353  payload_config.source.kernel.path = FLAGS_old_kernel;
354
355  payload_config.target.rootfs.path = FLAGS_new_image;
356  payload_config.target.kernel.path = FLAGS_new_kernel;
357
358  payload_config.chunk_size = FLAGS_chunk_size;
359  payload_config.block_size = kBlockSize;
360
361  // The kernel and rootfs size is never passed to the delta_generator, so we
362  // need to detect those from the provided files.
363  if (!FLAGS_old_image.empty()) {
364    CHECK(payload_config.source.LoadImageSize());
365  }
366  if (!FLAGS_new_image.empty()) {
367    CHECK(payload_config.target.LoadImageSize());
368  }
369
370  payload_config.is_delta = !FLAGS_old_image.empty();
371
372  CHECK(!FLAGS_out_file.empty());
373
374  // Ignore failures. These are optional arguments.
375  ParseImageInfo(FLAGS_new_channel,
376                 FLAGS_new_board,
377                 FLAGS_new_version,
378                 FLAGS_new_key,
379                 FLAGS_new_build_channel,
380                 FLAGS_new_build_version,
381                 &payload_config.target.image_info);
382
383  // Ignore failures. These are optional arguments.
384  ParseImageInfo(FLAGS_old_channel,
385                 FLAGS_old_board,
386                 FLAGS_old_version,
387                 FLAGS_old_key,
388                 FLAGS_old_build_channel,
389                 FLAGS_old_build_version,
390                 &payload_config.source.image_info);
391
392  payload_config.rootfs_partition_size = FLAGS_rootfs_partition_size;
393  payload_config.minor_version = FLAGS_minor_version;
394  // Look for the minor version in the old image if it was not given as an
395  // argument.
396  if (payload_config.is_delta &&
397      !base::CommandLine::ForCurrentProcess()->HasSwitch("minor_version")) {
398    uint32_t minor_version;
399    base::FilePath image_path(FLAGS_old_dir);
400    base::FilePath conf_loc("etc/update_engine.conf");
401    base::FilePath conf_path = image_path.Append(conf_loc);
402    if (utils::GetMinorVersion(conf_path, &minor_version)) {
403      payload_config.minor_version = minor_version;
404    } else {
405      payload_config.minor_version = kInPlaceMinorPayloadVersion;
406    }
407  }
408
409  // Load the rootfs size from verity's kernel command line if rootfs
410  // verification is enabled.
411  payload_config.source.LoadVerityRootfsSize();
412  payload_config.target.LoadVerityRootfsSize();
413
414  if (payload_config.is_delta) {
415    LOG(INFO) << "Generating delta update";
416  } else {
417    LOG(INFO) << "Generating full update";
418  }
419
420  // From this point, all the options have been parsed.
421  if (!payload_config.Validate()) {
422    LOG(ERROR) << "Invalid options passed. See errors above.";
423    return 1;
424  }
425
426  uint64_t metadata_size;
427  if (!GenerateUpdatePayloadFile(payload_config,
428                                 FLAGS_out_file,
429                                 FLAGS_private_key,
430                                 &metadata_size)) {
431    return 1;
432  }
433
434  return 0;
435}
436
437}  // namespace
438
439}  // namespace chromeos_update_engine
440
441int main(int argc, char** argv) {
442  return chromeos_update_engine::Main(argc, argv);
443}
444