Failed to verify OTA update signature!

peterjanbalkenende commented 2 years ago

First of all, you published this tool exactly at the moment I was searching for an tool with these exact features. Thank you.

But I do get an error with it, see below, it's probably a stupid mistake on my side, but I can't quite figure this one out. If you can help out, that'd be appreciated.

Package: build/ota.zip
Certificate: /srv/android-build/resign-android-image/grapheneos-ota.pem
Package length: 1102048021
Comment length: 1983
Signed data length: 1102046036
Signature start: 1102046056
Use SHA-256: True
Digest: eafbf513294e998e967bae2ec38e80a1264f199eca8d64379661e1cedbcf507a
RSA operation error
140027523401024:error:0407008A:rsa routines:RSA_padding_check_PKCS1_type_1:invalid padding:../crypto/rsa/rsa_pk1.c:66:
140027523401024:error:04067072:rsa routines:rsa_ossl_public_decrypt:padding check failed:../crypto/rsa/rsa_ossl.c:588:
Traceback (most recent call last):
  File "/root/.resign-android-image/otatools/bin/check_ota_package_signature/internal/stdlib/runpy.py", line 174, in _run_module_as_main
  File "/root/.resign-android-image/otatools/bin/check_ota_package_signature/internal/stdlib/runpy.py", line 72, in _run_code
  File "/root/.resign-android-image/otatools/bin/check_ota_package_signature/__main__.py", line 12, in <module>
  File "/root/.resign-android-image/otatools/bin/check_ota_package_signature/internal/stdlib/runpy.py", line 174, in _run_module_as_main
  File "/root/.resign-android-image/otatools/bin/check_ota_package_signature/internal/stdlib/runpy.py", line 72, in _run_code
  File "/root/.resign-android-image/otatools/bin/check_ota_package_signature/check_ota_package_signature.py", line 183, in <module>
  File "/root/.resign-android-image/otatools/bin/check_ota_package_signature/check_ota_package_signature.py", line 177, in main
  File "/root/.resign-android-image/otatools/bin/check_ota_package_signature/check_ota_package_signature.py", line 125, in VerifyPackage
  File "/root/.resign-android-image/otatools/bin/check_ota_package_signature/common.py", line 312, in RunAndCheckOutput
common.ExternalError: Failed to run command '['openssl', 'rsautl', '-verify', '-certin', '-inkey', '/srv/android-build/resign-android-image/grapheneos-ota.pem', '-in', '/tmp/digest-6OY5hU', '-out', '/tmp/decrypted-0XNjPV']' (exit code 1):

Failed to verify OTA update signature!
Failed to run: download_ota build/ota.zip.ok.Dnwzgo.tmp
Failed to run: make_extract_ota build/ota.nYHA9M.tmp
Failed to run: make_extract_ota_payload build/ota_payload.WeuMLI.tmp
Failed to run: make_target_files_extracted build/out_resign/target_files_extracted.done.zsxQys.tmp
Failed to run: make_target_files_intermediates_base build/out_resign/target_files_intermediates.CxTtA6.tmp
Failed to run: make_target_files_intermediates build/out_resign/target_files_intermediates.done.UIOZOo.tmp
Failed to run: make_target_files_intermediates_zip build/out_resign/target_files_intermediates.zip.cys3Nh.tmp
Failed to run: make_target_files_signed build/out_resign/target_files_signed.uuoKYW.tmp
Failed to run: make_target_files_base build/out_resign/target_files.Kj8HZ5.tmp
Failed to run: make_target_files_zip build/out_resign/target_files.zip.iANgtZ.tmp

peterjanbalkenende commented 2 years ago

Ah, I think the issue was that GrapheneOS uses different keys per device and the provided key is for raven whilst I am using oriole. Then again, it seems even changing out the key or testing using raven results in a different error for me. (Unexpected file size change for file ./apex/com.android.cellbroadcast.capex: 4420998 -> 4395562)

chriswoope commented 2 years ago

Sorry for the issues, I just published the script and it hasn't been tested much beyond my own setup and device.

The first issue is indeed because I mistakenly only included the raven key.

I think the second might be because you are using the otatools.zip from ci.android.com as the script says while I built it myself from GrapheneOS sources, and I guess they might build APEXes slightly differently, so the size is not the same. I think the simplest solution is to use the code path that replaces the files whenever the size changes. In general, it would probably a good idea to rebuild the ext4 images from scratch instead of the current patching approach; I wrote the current code with the idea of modifying the original images as little as possible, but it creates a lot of complexity and potential issues and produces images that are larger than needed.

Will fix as soon as possible.

peterjanbalkenende commented 2 years ago

I'm sorry, I forgot I was using a different otatools.zip than needed (https://ci.android.com/builds/submitted/8562694/aosp_cf_x86_64_phone-userdebug/latest/otatools.zip). That still gives the below error:

Updating ./system/etc/security/otacerts.zip: 1955 -> 1955
0+1 records in
0+1 records out
1955 bytes (2.0 kB, 1.9 KiB) copied, 8.833e-05 s, 22.1 MB/s
Compressed 35927296 bytes into 19026424 bytes ==> 52.96%
        MADE /home/build/android-build/build/out_resign/target_files/IMAGES/vendor_boot.img with make_boot_image
        MAKING /home/build/android-build/build/out_resign/target_files/IMAGES/vbmeta.img with make_vbmeta
        MADE /home/build/android-build/build/out_resign/target_files/IMAGES/vbmeta.img with make_vbmeta
        DISCARD: /home/build/android-build/build/out_resign/target_files_signed
        MAKING /home/build/android-build/build/out_resign/target_files/META/care_map.pb with make_care_map
        MADE /home/build/android-build/build/out_resign/target_files/META/care_map.pb with make_care_map
MADE /home/build/android-build/build/out_resign/target_files.zip with make_target_files_zip
DISCARD: /home/build/android-build/build/out_resign/target_files /home/build/android-build/build/out_resign/target_files_signed.zip
MAKING /home/build/android-build/build/out_resign/factory with make_factory
        MAKING /home/build/android-build/build/out_resign/factory_unchecked with make_factory_unchecked
                MAKING /home/build/android-build/build/out_resign/factory_image with make_factory_image
                        MAKING /home/build/android-build/build/factory_zip.ok with download_factory
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 1273M  100 1273M    0     0  41.8M      0  0:00:30  0:00:30 --:--:-- 49.4M
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   250  100   250    0     0   4098      0 --:--:-- --:--:-- --:--:--  4098
                        MADE /home/build/android-build/build/factory_zip.ok with download_factory
                        MAKING /home/build/android-build/build/factory with do_unzip
                        MADE /home/build/android-build/build/factory with do_unzip
                        MAKING /home/build/android-build/build/factory.list with do_unzip_list
                        MADE /home/build/android-build/build/factory.list with do_unzip_list
                        DISCARD: /home/build/android-build/build/factory_zip/oriole-factory-2022050800.zip
                        MAKING /home/build/android-build/build/factory_image with do_unzip
                        MADE /home/build/android-build/build/factory_image with do_unzip
                        MAKING /home/build/android-build/build/factory_image.list with do_unzip_list
                        MADE /home/build/android-build/build/factory_image.list with do_unzip_list
                        DISCARD: /home/build/android-build/build/factory/oriole-factory-2022050800/image-oriole-2022050800.zip
                MADE /home/build/android-build/build/out_resign/factory_image with make_factory_image
        MADE /home/build/android-build/build/out_resign/factory_unchecked with make_factory_unchecked
unzip:  cannot find or open /home/build/android-build/build/out_resign/factory_unchecked/image-oriole-2022050800, /home/build/android-build/build/out_resign/factory_unchecked/image-oriole-2022050800.zip or /home/build/android-build/build/out_resign/factory_unchecked/image-oriole-2022050800.ZIP.
Cannot open input file /home/build/android-build/build/out_resign/check_factory.Yb27bj.tmp/factory_image/system.img
Traceback (most recent call last):
  File "/home/build/.resign-android-image/otatools/bin/unpack_bootimg/internal/stdlib/runpy.py", line 196, in _run_module_as_main
  File "/home/build/.resign-android-image/otatools/bin/unpack_bootimg/internal/stdlib/runpy.py", line 86, in _run_code
  File "/home/build/.resign-android-image/otatools/bin/unpack_bootimg/__main__.py", line 12, in <module>
  File "/home/build/.resign-android-image/otatools/bin/unpack_bootimg/internal/stdlib/runpy.py", line 196, in _run_module_as_main
  File "/home/build/.resign-android-image/otatools/bin/unpack_bootimg/internal/stdlib/runpy.py", line 86, in _run_code
  File "/home/build/.resign-android-image/otatools/bin/unpack_bootimg/unpack_bootimg.py", line 563, in <module>
  File "/home/build/.resign-android-image/otatools/bin/unpack_bootimg/unpack_bootimg.py", line 558, in main
  File "/home/build/.resign-android-image/otatools/bin/unpack_bootimg/unpack_bootimg.py", line 480, in unpack_bootimg
FileNotFoundError: [Errno 2] No such file or directory: '/home/build/android-build/build/out_resign/check_factory.Yb27bj.tmp/factory_image/vendor_boot.img'
/home/build/android-build/build/out_resign/check_factory.Yb27bj.tmp/vendor_boot/vendor_ramdisk00: is not a regular file
cpio: premature end of archive
unzip:  cannot find or open /home/build/android-build/build/out_resign/check_factory.Yb27bj.tmp/vendor_boot_ramdisk/system/etc/security/otacerts.zip, /home/build/android-build/build/out_resign/check_factory.Yb27bj.tmp/vendor_boot_ramdisk/system/etc/security/otacerts.zip.zip or /home/build/android-build/build/out_resign/check_factory.Yb27bj.tmp/vendor_boot_ramdisk/system/etc/security/otacerts.zip.ZIP.
cmp: /home/build/android-build/build/out_resign/check_factory.Yb27bj.tmp/recovery_otacerts/keys/releasekey.x509.pem: No such file or directory
Recovery otacerts.zip has wrong key!!!
Failed to run: check_factory /home/build/android-build/build/out_resign/check_factory.Yb27bj.tmp
Factory key check failed!!!
Failed to run: make_factory /home/build/android-build/build/out_resign/factory.D2Dy58.tmp

When using any other kind of otatools from ci.android.com it always gave the below error:

ERROR: Failed to obtain minSdkVersion: aapt2 return code 1:

/tmp/tmpSaMIHR_framework-res.apk: error: failed to find resource entry for staged  resource ID 0x01fe0000.

Traceback (most recent call last):
  File "/home/build/.resign-android-image/otatools/bin/sign_target_files_apks/internal/stdlib/runpy.py", line 174, in _run_module_as_main
  File "/home/build/.resign-android-image/otatools/bin/sign_target_files_apks/internal/stdlib/runpy.py", line 72, in _run_code
  File "/home/build/.resign-android-image/otatools/bin/sign_target_files_apks/__main__.py", line 12, in <module>
  File "/home/build/.resign-android-image/otatools/bin/sign_target_files_apks/internal/stdlib/runpy.py", line 174, in _run_module_as_main
  File "/home/build/.resign-android-image/otatools/bin/sign_target_files_apks/internal/stdlib/runpy.py", line 72, in _run_code
  File "/home/build/.resign-android-image/otatools/bin/sign_target_files_apks/sign_target_files_apks.py", line 1401, in <module>
  File "/home/build/.resign-android-image/otatools/bin/sign_target_files_apks/sign_target_files_apks.py", line 1382, in main
  File "/home/build/.resign-android-image/otatools/bin/sign_target_files_apks/sign_target_files_apks.py", line 547, in ProcessTargetFiles
  File "/home/build/.resign-android-image/otatools/bin/sign_target_files_apks/sign_target_files_apks.py", line 464, in SignApk
  File "/home/build/.resign-android-image/otatools/bin/sign_target_files_apks/common.py", line 2280, in SignFile
  File "/home/build/.resign-android-image/otatools/bin/sign_target_files_apks/common.py", line 2228, in GetMinSdkVersionInt
  File "/home/build/.resign-android-image/otatools/bin/sign_target_files_apks/common.py", line 2203, in GetMinSdkVersion
common.ExternalError: Failed to obtain minSdkVersion: aapt2 return code 1:

/tmp/tmpSaMIHR_framework-res.apk: error: failed to find resource entry for staged  resource ID 0x01fe0000.

Failed to run: go /home/build/android-build/build/out_resign/sign_target_files.bIM40s.tmp /home/build/android-build/build/out_resign/target_files_signed.zip.7qDnjp.tmp
Failed to run: make_target_files_signed_zip /home/build/android-build/build/out_resign/target_files_signed.zip.7qDnjp.tmp
Failed to run: make_target_files_signed /home/build/android-build/build/out_resign/target_files_signed.0rhGXN.tmp
Failed to run: make_target_files_base /home/build/android-build/build/out_resign/target_files.4Gg2ai.tmp
Failed to run: make_target_files_zip /home/build/android-build/build/out_resign/target_files.zip.pTaMZt.tmp

chriswoope commented 2 years ago

Sorry, looks like the code to test built factory images was broken since I most likely never tested it because I wrote it after I had already installed the OS on my device and started building only OTAs and forgot to test it.

I pushed a commit that should hopefully fix it, but I haven't finished testing it yet.

peterjanbalkenende commented 2 years ago

No problem, thanks for taking the time to look after the project.

I now get the following error with grapheneos built otatools:

Updating ./system/etc/security/otacerts.zip: 1955 -> 1955
0+1 records in
0+1 records out
1955 bytes (2.0 kB, 1.9 KiB) copied, 8.305e-05 s, 23.5 MB/s
Compressed 35927296 bytes into 19026424 bytes ==> 52.96%
        MADE /home/build/android-build/build/out_resign/target_files/IMAGES/vendor_boot.img with make_boot_image
        MAKING /home/build/android-build/build/out_resign/target_files/IMAGES/vbmeta.img with make_vbmeta
        MADE /home/build/android-build/build/out_resign/target_files/IMAGES/vbmeta.img with make_vbmeta
        DISCARD: /home/build/android-build/build/out_resign/target_files_signed
        MAKING /home/build/android-build/build/out_resign/target_files/META/care_map.pb with make_care_map
        MADE /home/build/android-build/build/out_resign/target_files/META/care_map.pb with make_care_map
MADE /home/build/android-build/build/out_resign/target_files.zip with make_target_files_zip
DISCARD: /home/build/android-build/build/out_resign/target_files /home/build/android-build/build/out_resign/target_files_signed.zip
MAKING /home/build/android-build/build/out_resign/factory with make_factory
        MAKING /home/build/android-build/build/out_resign/factory_unchecked with make_factory_unchecked
                MAKING /home/build/android-build/build/out_resign/factory_image with make_factory_image
                        MAKING /home/build/android-build/build/factory_zip.ok with download_factory
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 1273M  100 1273M    0     0  27.8M      0  0:00:45  0:00:45 --:--:-- 25.2M
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   250  100   250    0     0   4629      0 --:--:-- --:--:-- --:--:--  4629
                        MADE /home/build/android-build/build/factory_zip.ok with download_factory
                        MAKING /home/build/android-build/build/factory with do_unzip
                        MADE /home/build/android-build/build/factory with do_unzip
                        MAKING /home/build/android-build/build/factory.list with do_unzip_list
                        MADE /home/build/android-build/build/factory.list with do_unzip_list
                        DISCARD: /home/build/android-build/build/factory_zip/oriole-factory-2022050800.zip
                        MAKING /home/build/android-build/build/factory_image with do_unzip
                        MADE /home/build/android-build/build/factory_image with do_unzip
                        MAKING /home/build/android-build/build/factory_image.list with do_unzip_list
                        MADE /home/build/android-build/build/factory_image.list with do_unzip_list
                        DISCARD: /home/build/android-build/build/factory/oriole-factory-2022050800/image-oriole-2022050800.zip
                MADE /home/build/android-build/build/out_resign/factory_image with make_factory_image
        MADE /home/build/android-build/build/out_resign/factory_unchecked with make_factory_unchecked
Archive:  /home/build/android-build/build/out_resign/factory_unchecked/oriole-factory-2022050800/image-oriole-2022050800.zip
  inflating: /home/build/android-build/build/out_resign/check_factory.xjhjX3.tmp/factory_image/vendor_boot.img
  inflating: /home/build/android-build/build/out_resign/check_factory.xjhjX3.tmp/factory_image/system.img
boot magic: VNDRBOOT
vendor boot image header version: 4
page size: 0x00000800
kernel load address: 0x10008000
ramdisk load address: 0x11000000
vendor ramdisk total size: 25317131
vendor command line args: earlycon=exynos4210,0x10A00000 console=ttySAC0,115200 androidboot.console=ttySAC0 printk.devkmsg=on cma_sysfs.experimental=Y stack_depot_disable=off page_pinner=on swiotlb=noforce at24.write_timeout=100 log_buf_len=1024K bootconfig buildvariant=user
kernel tags load address: 0x10000100
product name:
vendor boot image header size: 2128
dtb size: 495134
dtb address: 0x0000000011f00000
vendor ramdisk table size: 216
vendor ramdisk table: [
    vendor_ramdisk00: {
        size: 19026424
        offset: 0
        type: 0x1
        name:
        board_id: [
            0x00000000, 0x00000000, 0x00000000, 0x00000000,
            0x00000000, 0x00000000, 0x00000000, 0x00000000,
            0x00000000, 0x00000000, 0x00000000, 0x00000000,
            0x00000000, 0x00000000, 0x00000000, 0x00000000,
        ]
    }
    vendor_ramdisk01: {
        size: 6290707
        offset: 19026424
        type: 0x3
        name: dlkm
        board_id: [
            0x00000000, 0x00000000, 0x00000000, 0x00000000,
            0x00000000, 0x00000000, 0x00000000, 0x00000000,
            0x00000000, 0x00000000, 0x00000000, 0x00000000,
            0x00000000, 0x00000000, 0x00000000, 0x00000000,
        ]
    }
]
vendor bootconfig size: 38
70171 blocks
Archive:  /home/build/android-build/build/out_resign/check_factory.xjhjX3.tmp/vendor_boot_ramdisk/system/etc/security/otacerts.zip
 extracting: /home/build/android-build/build/out_resign/check_factory.xjhjX3.tmp/recovery_otacerts/keys/releasekey.x509.pem
debugfs 1.45.5 (07-Jan-2020)
debugfs:  dump /system/etc/security/otacerts.zip /home/build/android-build/build/out_resign/check_factory.xjhjX3.tmp/system_otacerts.zip
debugfs:  Archive:  /home/build/android-build/build/out_resign/check_factory.xjhjX3.tmp/system_otacerts.zip
 extracting: /home/build/android-build/build/out_resign/check_factory.xjhjX3.tmp/system_otacerts/keys/releasekey.x509.pem
ln: failed to access '/home/build/android-build/build/out_resign/factory': No such file or directory
Failed to run: make_factory /home/build/android-build/build/out_resign/factory.as0Kdm.tmp

chriswoope commented 2 years ago

Pushed another commit that should fix that, thanks for reporting!

peterjanbalkenende commented 2 years ago

Changing this to a symbolic link seems to fix the below error:

DISCARD: /home/build/android-build/build/out_resign/target_files /home/build/android-build/build/out_resign/target_files_signed.zip
MAKING /home/build/android-build/build/out_resign/factory with make_factory
Archive:  /home/build/android-build/build/out_resign/factory_unchecked/oriole-factory-2022050800/image-oriole-2022050800.zip
  inflating: /home/build/android-build/build/out_resign/check_factory.SkdQaY.tmp/factory_image/vendor_boot.img
  inflating: /home/build/android-build/build/out_resign/check_factory.SkdQaY.tmp/factory_image/system.img
boot magic: VNDRBOOT
vendor boot image header version: 4
page size: 0x00000800

kernel load address: 0x10008000
ramdisk load address: 0x11000000
vendor ramdisk total size: 25317131
vendor command line args: earlycon=exynos4210,0x10A00000 console=ttySAC0,115200 androidboot.console=ttySAC0 printk.devkmsg=on cma_sysfs.experimental=Y stack_depot_disable=off page_pinner=on swiotlb=noforce at24.write_timeout=100 log_buf_len=1024K bootconfig buildvariant=user
kernel tags load address: 0x10000100
product name:
vendor boot image header size: 2128
dtb size: 495134
dtb address: 0x0000000011f00000
vendor ramdisk table size: 216
vendor ramdisk table: [
    vendor_ramdisk00: {
        size: 19026424
        offset: 0
        type: 0x1
        name:
        board_id: [
            0x00000000, 0x00000000, 0x00000000, 0x00000000,
            0x00000000, 0x00000000, 0x00000000, 0x00000000,
            0x00000000, 0x00000000, 0x00000000, 0x00000000,
            0x00000000, 0x00000000, 0x00000000, 0x00000000,
        ]
    }
    vendor_ramdisk01: {
        size: 6290707
        offset: 19026424
        type: 0x3
        name: dlkm
        board_id: [
            0x00000000, 0x00000000, 0x00000000, 0x00000000,
            0x00000000, 0x00000000, 0x00000000, 0x00000000,
            0x00000000, 0x00000000, 0x00000000, 0x00000000,
            0x00000000, 0x00000000, 0x00000000, 0x00000000,
        ]
    }
]
vendor bootconfig size: 38
70171 blocks
Archive:  /home/build/android-build/build/out_resign/check_factory.SkdQaY.tmp/vendor_boot_ramdisk/system/etc/security/otacerts.zip
 extracting: /home/build/android-build/build/out_resign/check_factory.SkdQaY.tmp/recovery_otacerts/keys/releasekey.x509.pem
debugfs 1.45.5 (07-Jan-2020)
debugfs:  dump /system/etc/security/otacerts.zip /home/build/android-build/build/out_resign/check_factory.SkdQaY.tmp/system_otacerts.zip
debugfs:  Archive:  /home/build/android-build/build/out_resign/check_factory.SkdQaY.tmp/system_otacerts.zip
 extracting: /home/build/android-build/build/out_resign/check_factory.SkdQaY.tmp/system_otacerts/keys/releasekey.x509.pem
ln: /home/build/android-build/build/out_resign/factory_unchecked/oriole-factory-2022050800: hard link not allowed for directory
Failed to run: make_factory /home/build/android-build/build/out_resign/factory.FvT0wx.tmp

chriswoope commented 2 years ago

Added a commit that should fix that, should have time to complete testing and fix any other issue in 12-24 hours

peterjanbalkenende commented 2 years ago

Thanks, building works perfectly now.

Only the --replace-boot option gives the following error and doesn't build:

debugfs:        MADE /home/build/android-build/build/out_resign/target_files/IMAGES/system_ext.img with make_fs_image
        MAKING /home/build/android-build/build/out_resign/target_files/IMAGES/vendor_dlkm.img with make_fs_image
        MADE /home/build/android-build/build/out_resign/target_files/IMAGES/vendor_dlkm.img with make_fs_image
        MAKING /home/build/android-build/build/out_resign/target_files/IMAGES/boot.img with make_boot_image
/home/build/android-build/tools/resign-android-image: line 863: $4: unbound variable
Failed to run: make_boot_image /home/build/android-build/build/out_resign/target_files/IMAGES/boot.img.s03pkS.tmp boot /home/build/android-build/build/ota_payload/boot.img /home/build/android-build/build/out_resign/bootimg/boot /home/build/android-build/build/out_resign/target_files_signed/BOOT
Failed to run: make_target_files_zip /home/build/android-build/build/out_resign/target_files.zip.42nfRL.tmp

chriswoope commented 2 years ago

Added a commit that should fix --replace-boot. Does it work?

peterjanbalkenende commented 2 years ago

It did, but I accidentally bricked my phone in the process. I installed the update via the recovery which worked, but then I disabled OTA unlocking in the settings and installed a magisk module that apparently overwrote the boot image to which I restarted to recovery to try and install the update again at which point it was bricked. A bunch of stupid mistakes on my side, but RMA will hopefully be not too expensive xD

chriswoope commented 2 years ago

So you have locked the bootloader with a custom key, disabled OEM unlocking so that you can't unlock it, and the device fails to boot normally and fails to boot to recovery?

I think you could try these:

If you can enter rescue mode (not recovery mode) from the bootloader and it says waiting for commands, then Google's repair tool at https://pixelrepair.withgoogle.com/ should work (haven't used it personally)
If it actually boots, but then fails to work or reboots due to a Magisk module, then maybe running "adb wait-for-device shell magisk --remove-modules" and booting normally could work
You can try to convince the bootloader to use the other A/B slot. Not sure how exactly it decides it, but probably some sequence of having it boot and fail multiple times (3-5 times I guess), and well as 15 second power button presses and entering the bootloader should convince it eventually, and that will fix it assuming the other slot is not also broken

peterjanbalkenende commented 2 years ago

Thank you for the suggestions, unfortunately booting normally/into rescue or recovery all give the same error (No valid operating system could be found. The device will not boot.) with pushing the power button to power off. I tried the slot selection command from the fastboot cli but that doesn't work due to the device being locked.

peterjanbalkenende commented 2 years ago

fastboot getvar all gives this. The current slot is B, I probably need to get to A.

(bootloader) slot-fastboot-ok:a:yes
(bootloader) slot-fastboot-ok:b:yes
(bootloader) slot-retry-count:a:2
(bootloader) slot-retry-count:b:2
(bootloader) slot-successful:a:yes
(bootloader) slot-successful:b:yes
(bootloader) slot-suffixes:_a,_b
(bootloader) slot-unbootable:a:no
(bootloader) slot-unbootable:b:no

chriswoope commented 2 years ago

Unfortunately I don't think I can offer more help; I'm not really an expert on recovering devices though so maybe there's some way I don't know.

In general I think disabling OEM unlocking is not really advisable, since I don't think it provides any benefit and can make the device unrecoverable.

peterjanbalkenende commented 2 years ago

Unfortunately I don't think I can offer more help; I'm not really an expert on recovering devices though so maybe there's some way I don't know.

No worries, it was completely my fault and no issue of the script.

In general I think disabling OEM unlocking is not really advisable, since I don't think it provides any benefit and can make the device unrecoverable.

Yes, I guess so.

I am currently waiting on the RMA process, I'll let you know when it's done.

peterjanbalkenende commented 1 year ago

Sorry, I forgot to mention. The RMA went great, after a few weeks the motherboard got replaced for free by Google.

chriswoope / resign-android-image

Failed to verify OTA update signature! #1