avast / avast/apkverifier

APK Signature Scheme v4 Support

Open
#12 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
94
Forks
29
PR merge metrics
No merged PRs in 30d

Description

Hi and thanks for the excellent library!

Are there any future plans adding support for [Signature v4 scheme](https://source.android.com/security/apksigning/v4)? It's a file based signature that can be bundled within an XAPK archive before release.

Here are some simple steps to reproduce V4 signed APK:
1. Compile an APK with `compileSdk 31` and `targetSdk 31` and `minSdk 21`
2. Sign the APK with the following command:
```sh
apksigner sign -v --ks /path/to/release.keystore --ks-pass pass:123456 --v4-signing-enabled true --v3-signing-enabled true --v2-signing-enabled true --v1-signing-enabled true --out v4-signed.apk app-release-unsigned.apk
```
3. The previous command will generate two files; `v4-signed.apk` and `v4-signed.apk.idsig`. To verify that signature is correct, use apksigner with the following command:
```sh
apksigner verify -v -print-certs -v4-signature-file v4-signed.apk.idsig v4-signed.apk
```

The output of [3] should be:
```
Verifies
Verified using v1 scheme (JAR signing): true
Verified using v2 scheme (APK Signature Scheme v2): true
Verified using v3 scheme (APK Signature Scheme v3): true
Verified using v4 scheme (APK Signature Scheme v4): true
```

Happy to help if there are any questions.

Kind regards,
Gilad

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the repository's existing v1, v2, and v3 verification paths and the Android Signature Scheme v4 specification linked in the issue. Use the provided apksigner commands and v4-signed.apk.idsig example as the validation case; done means the library verifies V4-signed APK inputs alongside its current schemes.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cryptography, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.