Skip to content

Commit 6b1d724

Browse files
BungeetacoBungeetaco
committed
Initial commit
0 parents  commit 6b1d724

File tree

4 files changed

+701
-0
lines changed

4 files changed

+701
-0
lines changed

‎LICENSE

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2024
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README.md

Lines changed: 179 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,179 @@
1+
# Android OTA Update Automation
2+
3+
A bash script for automating OTA (Over-The-Air) updates for Android devices with support for Magisk and KernelSU root solutions.
4+
5+
## Features
6+
7+
- Automated OTA update fetching and patching
8+
- Support for multiple rooting solutions:
9+
- Magisk
10+
- KernelSU
11+
- Rootless mode
12+
- Automatic tool updates (avbroot, custota-tool, Magisk)
13+
- File integrity verification
14+
- Email notifications
15+
- Secure credential handling
16+
- Retention policy for old updates
17+
- Web directory management for OTA distribution
18+
19+
## Requirements
20+
21+
### System Requirements
22+
- Linux-based operating system
23+
- Root access
24+
- Python 3
25+
- `mail` command (optional, for notifications)
26+
27+
### Required Tools
28+
- `avbroot`
29+
- `custota-tool`
30+
- `python3`
31+
- `curl`
32+
- `wget`
33+
- `unzip`
34+
- `jq`
35+
36+
### Directory Structure
37+
```
38+
/opt/android-ota/
39+
├── credentials # Credentials file (600 permissions)
40+
├── keys/ # Directory containing encryption keys
41+
│ ├── avb.key
42+
│ ├── ota.key
43+
│ └── ota.crt
44+
├── kernelsu_boot.img # (Optional) KernelSU boot image
45+
├── Magisk-v*.apk # Magisk APK file
46+
├── ota/ # Directory for OTA files
47+
├── update-ota.log # Log file
48+
└── download.py # Python download script
49+
```
50+
51+
## Installation
52+
53+
1. Create the required directories:
54+
```bash
55+
sudo mkdir -p /opt/android-ota
56+
sudo mkdir -p /opt/android-ota/keys
57+
sudo mkdir -p /opt/android-ota/ota
58+
sudo mkdir -p /var/www/ota.yourdomain.com
59+
60+
# Set proper ownership and permissions for directories
61+
sudo chown root:root /opt/android-ota
62+
sudo chmod 755 /opt/android-ota
63+
sudo chmod 700 /opt/android-ota/keys
64+
sudo chmod 755 /opt/android-ota/ota
65+
```
66+
67+
2. Set up the credentials file:
68+
```bash
69+
sudo touch /opt/android-ota/credentials
70+
sudo chown root:root /opt/android-ota/credentials
71+
sudo chmod 600 /opt/android-ota/credentials
72+
```
73+
74+
3. Add required credentials to `/opt/android-ota/credentials`:
75+
```bash
76+
PASSPHRASE_AVB="your_avb_passphrase"
77+
PASSPHRASE_OTA="your_ota_passphrase"
78+
```
79+
80+
4. Place your encryption keys in the `/opt/android-ota/keys/` directory and set proper permissions:
81+
```bash
82+
# Copy your keys
83+
sudo cp avb.key ota.key ota.crt /opt/android-ota/keys/
84+
85+
# Set ownership to root
86+
sudo chown root:root /opt/android-ota/keys/*
87+
88+
# Set restrictive permissions on private keys
89+
sudo chmod 600 /opt/android-ota/keys/avb.key
90+
sudo chmod 600 /opt/android-ota/keys/ota.key
91+
92+
# Set permissions on public certificate
93+
sudo chmod 644 /opt/android-ota/keys/ota.crt
94+
```
95+
96+
5. Set proper permissions for the log file:
97+
```bash
98+
sudo touch /opt/android-ota/update-ota.log
99+
sudo chown root:root /opt/android-ota/update-ota.log
100+
sudo chmod 640 /opt/android-ota/update-ota.log
101+
```
102+
103+
6. If using Magisk, set proper permissions for the APK:
104+
```bash
105+
sudo chown root:root /opt/android-ota/Magisk-v*.apk
106+
sudo chmod 644 /opt/android-ota/Magisk-v*.apk
107+
```
108+
109+
7. If using KernelSU, set proper permissions for the boot image:
110+
```bash
111+
sudo chown root:root /opt/android-ota/kernelsu_boot.img
112+
sudo chmod 600 /opt/android-ota/kernelsu_boot.img
113+
```
114+
115+
## Usage
116+
117+
Basic usage:
118+
```bash
119+
sudo ./update-ota.sh --device DEVICE_CODENAME
120+
```
121+
122+
Available options:
123+
- `--device`, `-d`: Specify device codename (e.g., husky)
124+
- `--rootless`: Use rootless mode (no root modifications)
125+
- `--kernelsu`: Use KernelSU instead of Magisk
126+
- `--verbose`, `-v`: Enable verbose logging
127+
- `--force`, `-f`: Force update even if another instance is running
128+
- `--notify EMAIL`: Send email notifications to specified address
129+
130+
Examples:
131+
```bash
132+
# Update Pixel 8 Pro (husky) with Magisk
133+
sudo ./update-ota.sh --device husky
134+
135+
# Update with KernelSU
136+
sudo ./update-ota.sh --device husky --kernelsu
137+
138+
# Update without root modifications
139+
sudo ./update-ota.sh --device husky --rootless
140+
141+
# Enable verbose logging and notifications
142+
sudo ./update-ota.sh --device husky --verbose --notify [email protected]
143+
```
144+
145+
## Configuration
146+
147+
The script uses several configurable variables at the beginning of the file. Key configurations include:
148+
149+
- `DEVICE`: Default device codename
150+
- `MAGISK_PREINIT_DEVICE`: Device partition for Magisk preinit
151+
- `RETENTION_DAYS`: Number of days to keep old OTA files
152+
- `WEB_DIR`: Directory for serving OTA updates
153+
- `WEB_USER` and `WEB_GROUP`: Web server user/group ownership
154+
155+
## Security
156+
157+
- Base directory (`/opt/android-ota`) permissions: 755 (drwxr-xr-x)
158+
- Keys directory (`/opt/android-ota/keys`) permissions: 700 (drwx------)
159+
- Credentials file permissions: 600 (-rw-------)
160+
- Private key files permissions: 600 (-rw-------)
161+
- Public certificate permissions: 644 (-rw-r--r--)
162+
- Log file permissions: 640 (-rw-r-----)
163+
- Magisk APK permissions: 644 (-rw-r--r--)
164+
- KernelSU boot image permissions: 600 (-rw-------)
165+
- Script uses secure environment variables for passphrases
166+
- Implements file locking to prevent concurrent runs
167+
- Validates file integrity with checksums
168+
169+
## Logging
170+
171+
The script logs all operations to `/opt/android-ota/update-ota.log`. Use `--verbose` for detailed logging.
172+
173+
## Contributing
174+
175+
Feel free to submit issues and pull requests.
176+
177+
## License
178+
179+
This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.

‎credentials.template

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# OTA Update Credentials
2+
# Copy this file to /opt/android-ota/credentials and set permissions to 600
3+
# Then edit it to add your actual passwords
4+
5+
# AVB key passphrase
6+
export PASSPHRASE_AVB=""
7+
8+
# OTA key passphrase
9+
export PASSPHRASE_OTA=""
10+
11+
# Device to update (can be overridden with --device argument)
12+
export DEVICE="husky"

0 commit comments

Comments
 (0)