verify_from_target_files

#!/usr/bin/env python
"""
Given a target-files zipfile, connect to the device over Fastboot and verify that
the installed system exactly matches that build.

Usage: verify_from_target_files <target-files-package>

   -V (--variant) <variant name> IRDA device variant, if applicable
"""

import sys
import hashlib
import os
import subprocess
import zipfile
import re
import tempfile

# Android Release Tools
sys.path.append("build/tools/releasetools")
import common

sys.path.append("device/intel/build/releasetools")
import intel_common

OPTIONS = common.OPTIONS
OPTIONS.variant = None

_SIMG2IMG = "out/host/linux-x86/bin/simg2img"
_FASTBOOT = "out/host/linux-x86/bin/fastboot"

def get_hash_and_size_from_file(filename):
    fd = open(filename)
    data = fd.read()
    fd.close()
    h = hashlib.sha1(data).hexdigest()
    s = len(data)
    return (h, s)


def hash_sparse_ext4_image(unpack_dir, image_name):
    img_path = os.path.join(unpack_dir, "IMAGES", image_name)
    print "Hashing TFP", image_name
    t = tempfile.NamedTemporaryFile(delete=False)
    OPTIONS.tempfiles.append(t.name)
    t.close()

    subprocess.check_call([_SIMG2IMG, img_path, t.name])

    remain = os.path.getsize(t.name)
    fd = open(t.name)
    hc = hashlib.sha1()

    while (remain):
        data = fd.read(1024 * 1024)
        hc.update(data)
        remain = remain - len(data)

    fd.close()
    return hc.hexdigest()


def check_bootimage(name, unpack_dir, hashdict):
    img = common.GetBootableImage(name, name+".img", unpack_dir,
                name.upper())

    h = hashlib.sha1(img.data).hexdigest()
    if "/"+name not in hashdict:
        print "FAILED: Hash for", name, " image not reported by device"
        return False

    if (h != hashdict["/"+name]):
        print "FAILED: Hash mismatch for", name, "image"
        print "got",hashdict["/"+name],"expected",h
        return False

    print name, "image OK"
    return True


"""
Sample output:

...
(bootloader) target: /boot
(bootloader) hash: d0448a1e91030e5c37277e4a77eabefc36fc8e6c
(bootloader) target: /recovery
(bootloader) hash: 411c61de23f6f73934b79eda4f64779706c220f4
(bootloader) target: /bootloader/EFI/BOOT/bootx64.efi
(bootloader) hash: 2773c4c039dc37b96171f6ef131f04dd8faf73e1
(bootloader) target: /bootloader/loader.efi
(bootloader) hash: 2773c4c039dc37b96171f6ef131f04dd8faf73e1
(bootloader) target: /bootloader/fastboot.img
(bootloader) hash: b0b3d122c4dca255ed2a75268ef30f6cbbc11085
(bootloader) target: /system
(bootloader) hash: d417239a25df718d73b6326e6c93a7fc1b00afb2
OKAY [134.307s]
finished. total time: 134.307s
"""

_TARGET_LINE_PREFIX = "(bootloader) target: "
_HASH_LINE_PREFIX = "(bootloader) hash: "


def process_fastboot_data(data):
    hashes = {}
    lines = data.split("\n")
    index = 0

    for i in range(len(lines)):
        line = lines[i]
        if not line.startswith(_TARGET_LINE_PREFIX):
            continue

        target = line[len(_TARGET_LINE_PREFIX):]
        i = i + 1
        line = lines[i]
        if not line.startswith(_HASH_LINE_PREFIX):
            raise Exception("unexpected Fastboot output")

        hashdata = line[len(_HASH_LINE_PREFIX):]
        print "DUT reported", target, hashdata
        hashes[target] = hashdata
    return hashes


def main(argv):

    def option_handler(o, a):
        if o in ("-V", "--variant"):
            OPTIONS.variant = a
        else:
            return False
        return True

    args = common.ParseOptions(argv, __doc__, extra_opts="V:",
            extra_long_opts=["variant="], extra_option_handler=option_handler)

    if (len(args) != 1):
        common.Usage(__doc__)
        sys.exit(1)

    for app in [_SIMG2IMG, _FASTBOOT]:
        if not os.path.exists(app):
            print "Can't find", app
            print "Run lunch and 'm fastboot otatools'"
            sys.exit(1)

    print "Running 'fastboot oem get-hashes'..."
    fastboot_data = subprocess.check_output([_FASTBOOT, "oem", "get-hashes"],
            stderr=subprocess.STDOUT)
    hashdict = process_fastboot_data(fastboot_data)

    print "Extracting target files package..."
    unpack_dir, tfp = common.UnzipTemp(args[0])
    success = True
    OPTIONS.info_dict = common.LoadInfoDict(tfp)

    print "Extracting bootloader archive..."
    data = intel_common.GetBootloaderImageFromTFP(unpack_dir,
            variant=OPTIONS.variant)
    image = common.File("bootloader.img", data).WriteToTemp()
    esp_root = tempfile.mkdtemp(prefix="bootloader-")
    OPTIONS.tempfiles.append(esp_root)
    intel_common.add_dir_to_path("/sbin")
    subprocess.check_output(["mcopy", "-s", "-i", image.name, "::*", esp_root]);
    image.close();


    sys.stdout.write("Checking boot images...\n")
    for bootimage in ["boot", "recovery"]:
        if not check_bootimage(bootimage, unpack_dir, hashdict):
            success = False

    sys.stdout.write("Checking bootloader...\n")
    for dpath, dname, fnames in os.walk(esp_root):
        for fname in fnames:
            # Capsule update file -- gets consumed and deleted by the firmware
            # at first boot, shouldn't try to check it
            if (fname == "BIOSUPDATE.fv"):
                continue
            abspath = os.path.join(dpath, fname)
            relpath = os.path.relpath(abspath, esp_root)

            h, s = get_hash_and_size_from_file(abspath)

            devpath = "/bootloader/" + relpath
            if devpath not in hashdict:
                print "FAILED: no hash reported for", devpath
                success = False
                continue

            if hashdict[devpath] != h:
                print "FAILED: hash mismatch for", devpath
                success = False
                continue

            print devpath,"OK"


    sys.stdout.write("Checking system partition...\n")
    if "/system" in hashdict:
        syshash = hash_sparse_ext4_image(unpack_dir, "system.img")
        if hashdict["/system"] != syshash:
            print "FAILED: system image hash mismatch"
            success = False
        else:
            print "System image OK"
    else:
        print "FAILED: system hash not reported"
        success = False


    if success:
        print "All tests completed successfully"
    else:
        print "OTA Tests FAILED!"
        sys.exit(1)


if __name__ == '__main__':
    try:
        main(sys.argv[1:])
    finally:
        common.Cleanup()