IQ.Pilot Release Commit @ 4521b0f

iqpilot/system/hardware/tici/agnos.py

@@ -39,6 +39,81 @@ IQPILOT_MANIFEST_PUBLIC_KEY = bytes.fromhex("40ae3f81b77506ecc4982a1ca37ba1d6f87
 
 AGNOS_MANIFEST_FILE = "system/hardware/tici/agnos.json"
 
+LFS_POINTER_MAGIC = b"version https://git-lfs"
+
+
+def _image_auth_module():
+  """Return the git_remote auth module, or None. On IQ.OS this comes through the
+  verified loader; on stock AGNOS (an AGNOS->IQ.OS upgrade) that loader is not
+  present, but the compiled bundle IS in every checkout -- import it directly."""
+  try:
+    from iqpilot.system.proprietary_runtime._verified_import import import_verified_module
+    return import_verified_module("iqpilot_updater_private", "iqpilot_private.updater.git_remote")
+  except Exception:
+    pass
+  try:
+    root = os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "..", ".."))
+    bundle_python = os.path.join(root, "artifacts", "iqpilot_updater_private", "python")
+    if os.path.isdir(bundle_python):
+      if bundle_python not in sys.path:
+        sys.path.insert(0, bundle_python)
+      import importlib
+      return importlib.import_module("iqpilot_private.updater.git_remote")
+  except Exception:
+    pass
+  return None
+
+
+def _download_headers(url: str) -> dict:
+  mod = _image_auth_module()
+  if mod is not None:
+    try:
+      headers = mod.os_image_headers(url)
+      if headers:
+        return headers
+    except Exception:
+      pass
+  try:
+    from iqpilot.common.git_creds import get_credentials
+    creds = get_credentials()
+    if creds and all(creds) and "/iq.lvbs/iqos" in url.lower():
+      return {"Authorization": "Basic " + base64.b64encode(f"{creds[0]}:{creds[1]}".encode()).decode()}
+  except Exception:
+    pass
+  return {}
+
+
+def _open_image_response(url: str) -> requests.Response:
+  """GET an image URL; when the server answers with a Git-LFS pointer (the image
+  repo stores partitions as LFS objects and its raw endpoint does not resolve
+  them), follow it through the LFS batch API using the same credentials."""
+  auth = _download_headers(url)
+  req = requests.get(url, stream=True, headers={'Accept-Encoding': None, **auth}, timeout=60)
+  req.raise_for_status()
+  if int(req.headers.get('content-length') or 0) >= 1024:
+    return req
+
+  body = req.content
+  if not body.startswith(LFS_POINTER_MAGIC):
+    raise requests.exceptions.InvalidURL(f"unexpected tiny response ({len(body)} bytes) for {url}")
+  meta = dict(line.split(" ", 1) for line in body.decode().strip().splitlines() if " " in line)
+  oid = meta["oid"].split(":", 1)[1]
+  size = int(meta["size"])
+
+  batch_url = url.split("/raw/", 1)[0] + ".git/info/lfs/objects/batch"
+  batch = requests.post(batch_url,
+                        data=json.dumps({"operation": "download", "transfers": ["basic"],
+                                         "objects": [{"oid": oid, "size": size}]}),
+                        headers={"Content-Type": "application/vnd.git-lfs+json",
+                                 "Accept": "application/vnd.git-lfs+json", **auth},
+                        timeout=60)
+  batch.raise_for_status()
+  action = batch.json()["objects"][0]["actions"]["download"]
+  req = requests.get(action["href"], stream=True,
+                     headers={'Accept-Encoding': None, **action.get("header", {})}, timeout=60)
+  req.raise_for_status()
+  return req
+
 
 def verify_manifest_signature(manifest_path: str) -> None:
   sig_path = f"{manifest_path}.sig"
@@ -54,11 +129,34 @@ def verify_manifest_signature(manifest_path: str) -> None:
   public_key.verify(signature, digest)
 
 
+class _ChainedParts:
+  """Response-like wrapper streaming N sequential part files as one body.
+
+  The image host caps single uploads well below the system image size, so big
+  images are stored as `<name>.pNN` LFS objects; devices re-join them here."""
+
+  def __init__(self, urls: list[str]) -> None:
+    self.urls = urls
+    self.req: requests.Response | None = None
+
+  def raise_for_status(self) -> None:
+    if self.req is not None:
+      self.req.raise_for_status()
+
+  def iter_content(self, chunk_size: int) -> Generator[bytes, None, None]:
+    for u in self.urls:
+      self.req = _open_image_response(u)
+      yield from self.req.iter_content(chunk_size=chunk_size)
+
+
 class StreamingDecompressor:
-  def __init__(self, url: str) -> None:
+  def __init__(self, url: str, parts: int = 0) -> None:
     self.buf = b""
 
-    self.req = requests.get(url, stream=True, headers={'Accept-Encoding': None}, timeout=60)
+    if parts > 1:
+      self.req = _ChainedParts([f"{url}.p{i:02d}" for i in range(parts)])
+    else:
+      self.req = _open_image_response(url)
     self.it = self.req.iter_content(chunk_size=1024 * 1024)
     self.decompressor = lzma.LZMADecompressor(format=lzma.FORMAT_AUTO)
     self.eof = False
@@ -196,7 +294,7 @@ def clear_partition_hash(target_slot_number: int, partition: dict) -> None:
 
 def extract_compressed_image(target_slot_number: int, partition: dict, cloudlog):
   path = get_partition_path(target_slot_number, partition)
-  downloader = StreamingDecompressor(partition['url'])
+  downloader = StreamingDecompressor(partition['url'], parts=int(partition.get('url_parts', 0)))
 
   with open(path, 'wb+') as out:
     # Flash partition