From bc6fdd85134ccc4c55cb1b243119d55141b7afec Mon Sep 17 00:00:00 2001 From: Jan Erik Petersen Date: Tue, 12 Sep 2023 21:09:26 +0200 Subject: [PATCH] README.md: Add additional notes about lost keys and OTA updaters --- README.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/README.md b/README.md index f023b8c..6acb770 100644 --- a/README.md +++ b/README.md @@ -64,6 +64,8 @@ The boot-related components are signed with an AVB key and OTA-related component The commands above are provided for convenience. avbroot is compatible with any standard PKCS8-encoded 4096-bit RSA private key and X509 certificate (eg. like those generated by openssl). +If you lose your AVB or OTA signing key you will no longer be able to sign new OTA zips. You will have to generate new signing keys and unlock your bootloader again (including a data wipe). Follow the [Usage section](#usage) as if doing an initial setup. + ## Usage 1. Make sure the caveats listed above are understood. It is possible to hard brick by doing the wrong thing! @@ -153,6 +155,8 @@ Unpatched OTA updates are already blocked in recovery because the original OTA c The `clearotacerts` module additionally makes A/B OTAs fail while booted into Android to prevent accidental manual updates. The module simply overrides `/system/etc/security/otacerts.zip` at runtime with an empty zip so that even if an OTA is downloaded, signature verification will fail. +At least in CalyxOS the Updater app does not respect the `Automatic system updates` setting and may enter an infinite loop downloading the OTA update and restarting the download when signature verification fails. If this happens on your ROM, you can try to either remove network access from the Updater app or disable the Updater app altogether (if your ROM allows you to do so). In CalyxOS it is possible to go to `Settings > Apps > See all apps`, open the three-dot menu, `Show system`, then find the `System updater` app and disable it. + Alternatively, see [Custota](https://github.com/chenxiaolong/Custota) for a custom OTA updater app that pulls from a self-hosted OTA server. ### `oemunlockonboot`: Enable OEM unlocking on every boot