Oxygen Updater v6.4.0 released, fixes OTA ZIP download errors
Note: this is relevant only to users on EU, GLO, or Indian ROMs. OTA ZIPs for NA devices are hosted on Google servers, which still has all the links publicly accessible.
TLDR: if you experienced OTA ZIP download failures in our app, simply update to v6.4.0 via Play Store or GitHub.
On 2nd September 2024, we noticed that all of a sudden, many OTA ZIP links that were hosted on OnePlus' Indian servers stopped working. At the time, we assumed it was a misconfiguration on their end, and that it would be fixed soon. We realised that Singapore links were still working, so we replaced all Indian links with Singapore ones. Download speeds shouldn't have been affected, as the two countries are relatively close together, geographically speaking.
However, a few days later, we noticed that even Singapore and EU links stopped working; all of them failing with 403 "Access Denied" errors:
This alarmed us, as it meant that Oppo/OnePlus had decided to block external downloads of all their OTA ZIPs. That meant that you could not download OTA ZIPs at your own convenience anymore, either via our app, or a web browser on your phone/PC. The only place that these OTA ZIPs could be downloaded from was the built-in system OTA screen.
We're not entirely sure why they had to resort to such restrictive policies. One theory could be that some people who were part of Closed Beta programs have been leaking builds to the public. This has been going on for years — they'd share them on OnePlus Forums, Telegram, Reddit, Discord, and even YouTube comments. Even though OnePlus required NDAs, perhaps they failed to enforce rules or penalize offenders. So maybe, instead of only restricting access to closed/alpha builds, they decided to block all OTA ZIPs? Sad and a bit unbelievable, but it could be true. An all-or-nothing approach has been employed by many people before.
Regardless of the real reason, we believe that limiting the freedom of their users is surely to result in bad PR, over time. After all, public OTA links are not just useful for Oxygen Updater users, but also for anyone who relies on them for development, rooting, or simply to satisfy their curious tinkering mind. We've previously shared links with several major publishers like Android Police, XDA, among many others, and now OnePlus has rendered them all invalid.
Thankfully, we managed to find a workaround, which means you can use Oxygen Updater to download the latest updates once again. All you need to do is update to the latest version of the app, via Play Store or GitHub. Make sure you've enabled auto-update for our app on Play Store, so that you get all future app updates ASAP.
If you are wondering what the workaround was, read on. The following instructions are especially useful for people who want to download OTA ZIPs from wherever they wish, not just system OTA or our app.
The workaround was to use the same HTTP User-Agent that the built-in system OTA screen uses. Luckily for us, it's the Android's platform-default User-Agent, so we didn't have to do much work. We simply had to query the User-Agent from Android itself.
However, for others who wish to download OTA ZIPs via the browser or CLI tools, you'll need to do more work. First of all, the default Android User-Agent is different from a web browser (Chrome, Firefox, etc.) User-Agent. Android's HTTP User-Agent has the following format:
Dalvik/{java.vm.version} (Linux; U; Android {ro.build.version.release_or_codename}; {ro.product.model} Build/{ro.build.id})
The text in braces — {…} — represents dynamic information that must be queried either via code or CLI tools. {ro…} can be retrieved via getprop, like so:
getprop ro.build.version.release_or_codename
getprop ro.product.model
getprop ro.build.id
Once you run these commands on a terminal emulator on your device (or via adb shell on your PC), you can plug those values in the above specified format. java.vm.version is a bit more tricky, as it can only be queried from an app running on Android itself. If you are not familiar with Android development, I recommend using a placeholder value for this, e.g. 2.1.0. A full list of all Android java VM versions may be available elsewhere on the internet.
Once you have your fully constructed Android User-Agent, simply supply it to your CLI downloader of choice. Instructions for the most popular ones:
curl -H 'User-Agent:Dalvik/…' <url>wget -U 'Dalvik/…' <url>aria2c -U 'Dalvik/…' <url>
If you are unwilling or unfamiliar with CLI (Command LIne), and want to use only a browser, then you'll have to install extensions that allow modifying your browser User-Agent. Remember, though, the preceding instructions are only for folks who don't want to use our app to download the latest updates. For most people reading this, you can simply update to v6.4.0 via GitHub or Play Store and enjoy working downloads again. This section is only for transparency and education's sake, to help the community understand the problem and its solution.
With all that said, we sincerely hope Oppo/OnePlus reconsiders their decision to block external downloads. Android is built on openness, and applying limitations of any kind on your users is inadvisable. Removing public access to OTA ZIP download links harms developers and users alike. The enthusiasts, especially, may leave for other brands and that's not a good thing for anyone. The greatest products and the best marketing campaigns may lead to a lot of sales, but if the public opinion of your brand falters, then all that effort is wasted. For long-term success, it's much wiser to build confidence and trust.
But alas, Oppo & OnePlus are big companies, and in big companies decisions are rarely made with the long-term in mind. At the end of the day, they care only for short-term monetary gains. If they implement stricter and more complex restrictions, then finding workarounds would be even more difficult in the future. Please, don't let it become a cat-and-mouse game.
Here's to the future; hope it doesn't turn out to be as bleak as it looks.