1.13.1 - build-apks on .aab generated by 1.8.2 incorrectly fails transparency check: bundletool/archive/dex/0_0_0/classes.dex
- Dominant language
- Java
- Stars
- 4k
- Forks
- 428
- PR merge metrics
- No merged PRs in 30d
Description
I have an app bundle generated from bundletool 1.8.2 that I cannot upload to the Google Play Console because of an error in 1.13.1. I can reproduce the error locally and found a suspected cause in the source code.
```
Error: Verification failed because code was modified after transparency metadata generation.
Files deleted after transparency metadata generation: []
Files added after transparency metadata generation: [/com/android/tools/build/bundletool/archive/dex/0_0_0/classes.dex]
Files modified after transparency metadata generation: []
```
- I can't update my bundletool version to fix this, because a different company generates the app bundle (business reasons).
- This is not happening with bundletool 1.11.0.
I think I found the root cause in `BundleTransparencyCheckUtils.checkTransparency()`. It adds `/com/android/tools/build/bundletool/archive/dex/0_0_0/classes.dex` to the bundle's files list before validating, which leads to this error message. This transparency check implementation changed since 1.11.0.
The file gets added in CodeTransparencyFactory.java, createCodeTransparencyMetadata(), line 55.
```
if (bundle.getStoreArchive().orElse(true)) {
codeTransparencyBuilder.addCodeRelatedFile(createArchivedCodeRelatedFile(bundle));
}
```
The above adds the classes.dex file to the `ImmutableList` used to check the the bundle against the parsed transparency file. The check is on BundleTransparencyCheckUtils.java, getCodeRelatedFilesFromBundle() on line 101. I'm referencing branch master, db27934.
**Request**
1. It seems like we should not be adding `/com/android/tools/build/bundletool/archive/dex/0_0_0/classes.dex` artificially to the bundle's code-related-files list when validating the code transparency file. This is because the original app bundle and its code transparency file match.
2. The error message in this case is misleading because the original bundle is fine - could it be improved to reflect this?
**Bundletool version(s) affected**
Version: 1.13.1, 1.8.2
**Stacktrace**
**Command:**
`bundletool build-apks --connected-device --bundle=my_artifact.aab --output="output.apks"`
**Output:**
```
Error: Verification failed because code was modified after transparency metadata generation.
Files deleted after transparency metadata generation: []
Files added after transparency metadata generation: [/com/android/tools/build/bundletool/archive/dex/0_0_0/classes.dex]
Files modified after transparency metadata generation: []
```
**To Reproduce**
Steps to reproduce the behavior.
1. A partner company generates my_artifact.aab with bundletool 1.8.2
2. I run `bundletool build-apks --connected-device --bundle=my_artifact.aab --output="output.apks"`
3. I get error message.
4. This occurs when I try to upload to Google Play Store as well with the same error. It prevented me from publishing.
**Expected behavior**
1. A partner company generates my_artifact.aab with bundletool 1.8.2
2. I run `bundletool build-apks --connected-device --bundle=my_artifact.aab --output="output.apks"`
3. No error, because the .aab bundle and it's code transparency file are valid.
**Known workaround**
1. I followed this post to prevent the `...0_0_0/classes.dex` file from being added during the code transparency check. This is because it forces the condition `if (bundle.getStoreArchive().orElse(true))` to be false. See disabling storeArchive in: https://android-developers.googleblog.com/2022/03/freeing-up-60-of-storage-for-apps.html.
2. Also, if this is just happening locally, bundletool 1.11.0 works fine.
**Environment:**
OS: MacOS 12.5.1
**Additional context**
Apologies for providing less detail about the .aab file generation. A partner company generates the file and I don't have information on their configuration. However this is what I've deduced is happening.
The Google Play Console error I'm getting is the same as the local one. I suspect this started happening recently because Google Play Console updated their bundletool version.
`An error occurred while running bundletool build-apks on your uploaded App Bundle. Ensure that your App Bundle is valid by running bundletool build-apks locally and try again. Learn more. Error: Verification failed because code was modified after transparency metadata generation. Files deleted after transparency metadata generation: [] Files added after transparency metadata generation: [/com/android/tools/build/bundletool/archive/dex/0_0_0/classes.dex] Files modified after transparency metadata generation: []`
Contributor guide
Assessment
This issue has not been assessed yet.