[ASUS ZenFone 8] bnsmb:
While doing my tests and development with the OmniROM OS it's sometimes useful to update an installed original OmniROM to one of my self-compiled OmniROM images without reinstalling the phone from scratch.

Doing this using the local file feature of the SystemUpdate app from the OmniROM will fail with the error message "Updated failed with error 26". This is a not really understandable error message but checking the output of logcat will print some more infos about the error:

Spoiler content hidden.

So the update_engine refuse to update the OS using the image /sdcard/Download/omni-13-20230611-zenfone8-MICROG.zip because there is no matching certificate for the new OS image in the file /system/etc/security/otacerts.zip of the running OS.

This is quite a useful feature, but not really necessary for my development phone, so I would like to disable it.

That can be done like this on phones wit installed Magisk:

Create a Magisk Module to replace the file /system/etc/security/otacerts.zip with a zip file with certificates from the original OmniROM image and the self-compiled OmiROM image.

To create that file do:

First copy the file /system/etc/security/otacerts.zip from the original OmniROM installed to the directory /sdcard/Download and then to your local workstation via adb pull command.

The file otacerts.zip for the self-compiled OmniROM image for the ASUS Zenfone 8 is in the directory ./out/target/product/zenfone8/system/etc/security in the build tree for the OmniROM.

Extract the certificate testkey.x509.pem from the file otacerts.zip in the build tree, rename it, add it to the file otacerts.zip from the original OmniROM image, and upload the changed file otacerts.zip to the phone:

Spoiler content hidden.

Now open an adb shell on the phone and create a dummy Magisk Module to replace the file /system/etc/security/otacerts.zip with the new zip file:

Spoiler content hidden.

Next reboot the phone to activate the dummy Magisk Module.

Check the result after the reboot:

ASUS_I006D:/ $ unzip -t /system/etc/security/otacerts.zip
Archive: /system/etc/security/otacerts.zip
testing: testkey.x509.pem OK
testing: my_testkey.x509.pem OK
No errors detected in compressed data of /system/etc/security/otacerts.zip.
ASUS_I006D:/ $

Now you can update the installed original OmniROM image with a self-compiled OmniROM image and vice versa using the local file functionality of the SystemUpdate App from the OmniROM OS as long as the dummy Magisk module is installed.

It's recommended to create a complete Magisk Module for this replacment if used on a regular base.

Notes

The certificate for the OmniROM OS is valid until March 2041:

[ OmniRom 13 Dev - xtrnaw7@t15g /data/develop/android/otacerts ] $ keytool -printcert -file testkey.x509.pem 2>/dev/null | grep "Valid from:"
Valid from: Fri Oct 25 04:40:22 CEST 2013 until: Tue Mar 12 03:40:22 CET 2041
[ OmniRom 13 Dev - xtrnaw7@t15g /data/develop/android/otacerts ] $

Therefor the new zip file with the certificates should work for a while.

This method only works with compatible OS images - e.g. you cannot use it to update the OmniROM image with the original Android image from ASUS or an image with the LineageOS.

(well, you can -- but after the update the new OS will not boot ...)

Temporary allow updating another OS image

To only temporary allow the update to another compatible OS via SystemUpdate App you may use a bind mount. bind mounts need root access therefor an installed Magisk or any other tool to get root access is required.

The steps necessary for this temporary solution are:

First copy the file /system/etc/security/otacerts.zip from the OS image to install to the phone, e.g.:

adb push otacerts.zip /sdcard/Download/my_otacerts.zip

Then create a temporary bind mount on the phone for the file /system/etc/security/otacerts.zip :

su - -c mount -o bind /sdcard/Download/my_otacerts.zip /system/etc/security/otacerts.zip

Now the update via SystemUpdate app will work.

Note:

bind mounts are only temporary and will not survive the reboot

Trouble Shooting

The error message "Update failed with error 51" is printed by the SystemUpdate App when the new OS image is older then the installed OS image. I did not yet find a method to disable that test.

To get a more detailed error message for the errors of the SystemUpdate app use this command in an adb shell:

ASUS_I006D:/ # logcat -d | grep update_engine | grep ERROR
06-11 11:30:32.154 1428 1428 E update_engine: [ERROR:delta_performer.cc(1046)] The current OS build timestamp (1686434647) is newer than the maximum timestamp in the manifest (1683475334)
06-11 11:30:32.155 1428 1428 E update_engine: [ERROR:download_action.cc(227)] Error ErrorCode::kPayloadTimestampError (51) in DeltaPerformer's Write method when processing the received payload -- Terminating processing

Disclaimer

This procedure should NOT be performed on phones in productive use. -- the procedure is intended for testing and development only.