Allow skipping timestamp check in certain debug conditions
As proposed in go/ota-downgrade, the android auto team wants to install
a full OTA with the older timestamp. We will only allow it on devices
with userdebug build, and has the property "ro.ota.allow_downgrade"
set. Data wipe is almost inevitable due to the probability of security
patch level and database rollback.
Test: set the property and install a full payload with older timestamp.
Change-Id: I897bbb19bfec820340f791abf3c6d8138995fa90
diff --git a/common/fake_hardware.h b/common/fake_hardware.h
index 3e5a66e..8da5326 100644
--- a/common/fake_hardware.h
+++ b/common/fake_hardware.h
@@ -128,6 +128,8 @@
int64_t GetBuildTimestamp() const override { return build_timestamp_; }
+ bool AllowDowngrade() const override { return false; }
+
bool GetFirstActiveOmahaPingSent() const override {
return first_active_omaha_ping_sent_;
}
diff --git a/common/hardware_interface.h b/common/hardware_interface.h
index 0140588..4a64c3e 100644
--- a/common/hardware_interface.h
+++ b/common/hardware_interface.h
@@ -122,6 +122,10 @@
// Returns the timestamp of the current OS build.
virtual int64_t GetBuildTimestamp() const = 0;
+ // Returns true if the current OS build allows installing the payload with an
+ // older timestamp.
+ virtual bool AllowDowngrade() const = 0;
+
// Returns whether the first active ping was sent to Omaha at some point, and
// that the value is persisted across recovery (and powerwash) once set with
// |SetFirstActiveOmahaPingSent()|.