X-Git-Url: https://glassweightruler.freedombox.rocks/gitweb/waydroid.git/blobdiff_plain/cca8af2d7d3494d887d9655f8e78244b5a2ca513..0835ece5bc10f3cfe4a09cf0ef24351ee315ba68:/tools/services/hardware_manager.py

diff --git a/tools/services/hardware_manager.py b/tools/services/hardware_manager.py
index 8d21dd0..9175022 100644
--- a/tools/services/hardware_manager.py
+++ b/tools/services/hardware_manager.py
@@ -2,6 +2,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 import logging
 import threading
+import os
 import tools.actions.container_manager
 import tools.actions.session_manager
 import tools.config
@@ -29,11 +30,24 @@ def start(args):
         helpers.lxc.start(args)
 
     def upgrade(system_zip, system_time, vendor_zip, vendor_time):
+        if os.path.exists(system_zip):
+            if not helpers.images.validate(args, "system_ota", system_zip):
+                logging.warning("Not upgrading because system.img comes from an unverified source")
+                return
+        else:
+            system_zip = "" # Race prevention
+        if os.path.exists(vendor_zip):
+            if not helpers.images.validate(args, "vendor_ota", vendor_zip):
+                logging.warning("Not upgrading because vendor.img comes from an unverified source")
+                return
+        else:
+            vendor_zip = "" # Race prevention
         helpers.lxc.stop(args)
         helpers.images.umount_rootfs(args)
         helpers.images.replace(args, system_zip, system_time,
                                vendor_zip, vendor_time)
-        helpers.images.mount_rootfs(args, args.images_path)
+        args.session["background_start"] = "false"
+        helpers.images.mount_rootfs(args, args.images_path, args.session)
         helpers.protocol.set_aidl_version(args)
         helpers.lxc.start(args)