Bundletool fails to validate code transparency for apps using v3.1 signature scheme
- Dominant language
- Java
- Stars
- 4k
- Forks
- 428
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
apksig 4.2.0-alpha13 doesn’t support the v3.1 signature scheme, causing an APK signed with that scheme to fail validation with the following error:
```
APK Signature Scheme v3 signers supported min/max SDK versions do not cover the entire desired range. Found min: 24 max 32
```
**Bundletool version(s) affected**
Version: presumably all, but tested using 1.17.0
**Stacktrace**
Copy all of the output of the command, including the stacktrace if visible.
```
APK Signature Scheme v3 signers supported min/max SDK versions do not cover the entire desired range. Found min: 24 max 32
```
**To Reproduce**
Install [Signal](https://play.google.com/store/apps/details?id=org.thoughtcrime.securesms&hl=en_US) on a device (which uses the v3.1 signature scheme), and run the following:
```
java -jar bundle tool.jar check-transparency --mode=connected_device --package-name="org.thoughtcrime.securesms"
```
**Expected behavior**
The signature is valid and should not fail.
**Known workaround**
Thankfully this can be fixed if apksig is updated to the latest version:
[https://github.com/google/bundletool/pull/368](https://github.com/google/bundletool/pull/368)
**Environment:**
OS: Ubuntu 22.04, but presumably this doesn't matter
**Additional context**
None
Contributor guide
Assessment
This issue has not been assessed yet.