From 5f797b4ae5fa8e6a8b232b756bae073a1782f728 Mon Sep 17 00:00:00 2001
From: 3405691582 <dsk@google.com>
Date: Thu, 17 Sep 2026 14:34:47 +0000
Subject: [PATCH] Pad vbmeta images during cvd fetch

The guest reads the vbmeta images with libavb, which expects to be able
to read the maximum vbmeta size, so we pad the images in place to match
this or the read will fail.

This implies that the image location must be writable, which is
problematic for particular use-cases. It is worthwhile noting that
images are also modified during cvd fetch to de-sparse images before the
images are quiescent on disk. While this change does not alleviate the
need for in-place image modification, it does ensure that the images need
not be modifiable after the cvd fetch occurs.

assemble_cvd behavior is unchanged -- indeed it must not change, since it
will need to operate correctly on images not sourced from cvd fetch.
---
 .../host/commands/cvd/fetch/BUILD.bazel       |  2 ++
 .../host/commands/cvd/fetch/fetch_context.cc  | 32 +++++++++++++++++++
 2 files changed, 34 insertions(+)

diff --git a/base/cvd/cuttlefish/host/commands/cvd/fetch/BUILD.bazel b/base/cvd/cuttlefish/host/commands/cvd/fetch/BUILD.bazel
index 16cd15e9a2b..a36fb2e3feb 100644
--- a/base/cvd/cuttlefish/host/commands/cvd/fetch/BUILD.bazel
+++ b/base/cvd/cuttlefish/host/commands/cvd/fetch/BUILD.bazel
@@ -190,6 +190,7 @@ cf_cc_library(
         "//cuttlefish/host/commands/cvd/fetch:de_android_sparse",
         "//cuttlefish/host/commands/cvd/fetch:fetch_tracer",
         "//cuttlefish/host/commands/cvd/fetch:target_directories",
+        "//cuttlefish/host/libs/avb",
         "//cuttlefish/host/libs/config:fetcher_config",
         "//cuttlefish/host/libs/config:file_source",
         "//cuttlefish/host/libs/web:android_build",
@@ -201,6 +202,7 @@ cf_cc_library(
         "//cuttlefish/posix:remove",
         "//cuttlefish/result",
         "//libbase",
+        "@abseil-cpp//absl/log",
         "@abseil-cpp//absl/strings",
         "@fmt",
     ],
diff --git a/base/cvd/cuttlefish/host/commands/cvd/fetch/fetch_context.cc b/base/cvd/cuttlefish/host/commands/cvd/fetch/fetch_context.cc
index fd6e5d09188..8577e95a97d 100644
--- a/base/cvd/cuttlefish/host/commands/cvd/fetch/fetch_context.cc
+++ b/base/cvd/cuttlefish/host/commands/cvd/fetch/fetch_context.cc
@@ -24,6 +24,7 @@
 #include <variant>
 #include <vector>
 
+#include "absl/log/log.h"
 #include "absl/strings/match.h"
 #include "absl/strings/strip.h"
 #include "android-base/file.h"
@@ -36,6 +37,7 @@
 #include "cuttlefish/host/commands/cvd/fetch/de_android_sparse.h"
 #include "cuttlefish/host/commands/cvd/fetch/fetch_tracer.h"
 #include "cuttlefish/host/commands/cvd/fetch/target_directories.h"
+#include "cuttlefish/host/libs/avb/avb.h"
 #include "cuttlefish/host/libs/config/fetcher_config.h"
 #include "cuttlefish/host/libs/config/file_source.h"
 #include "cuttlefish/host/libs/web/android_build.h"
@@ -53,6 +55,28 @@ static constexpr mode_t kRwxAllMode = S_IRWXU | S_IRWXG | S_IRWXO;
 
 using android::base::Dirname;
 
+namespace {
+
+bool IsVbmetaImage(std::string_view path) {
+  return absl::EndsWith(path, "/vbmeta.img") ||
+         absl::EndsWith(path, "/vbmeta_system.img") ||
+         absl::EndsWith(path, "/vbmeta_system_dlkm.img") ||
+         absl::EndsWith(path, "/vbmeta_vendor_dlkm.img");
+}
+
+void PadVbmetaImage(const std::string& path) {
+  /*
+   * Try enforcing the vbmeta size now. If it fails, then let
+   * `assemble_cvd` trip on it later; don't fail the fetch.
+   */
+  if (Result<void> result = EnforceVbMetaSize(path); !result.has_value()) {
+    LOG(WARNING) << "PadVbmetaImage: failed padding " << path << ": "
+                 << result.error();
+  }
+}
+
+}  // namespace
+
 FetchArtifact::FetchArtifact(FetchBuildContext& context,
                              std::string artifact_name)
     : fetch_build_context_(context), artifact_name_(artifact_name) {}
@@ -87,6 +111,10 @@ Result<void> FetchArtifact::DownloadTo(std::string local_path) {
     CF_EXPECT(Copy(downloaded_path_, new_path));
   }
 
+  if (IsVbmetaImage(new_path)) {
+    PadVbmetaImage(new_path);
+  }
+
   CF_EXPECT(fetch_build_context_.AddFileToConfig(downloaded_path_));
 
   return {};
@@ -151,6 +179,10 @@ Result<void> FetchArtifact::ExtractOneTo(const std::string& member_name,
   // TODO: b/471069557 - diagnose unused
   Result<void> unused = fetch_build_context_.DesparseFiles({local_path});
 
+  if (IsVbmetaImage(extract_path)) {
+    PadVbmetaImage(extract_path);
+  }
+
   return {};
 }