google / google/bundletool

Bundletool fails to validate code transparency for apps using v3.1 signature scheme

Open
#369 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
4k
Forks
428
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**
apksig 4.2.0-alpha13 doesn’t support the v3.1 signature scheme, causing an APK signed with that scheme to fail validation with the following error:

```
APK Signature Scheme v3 signers supported min/max SDK versions do not cover the entire desired range. Found min: 24 max 32
```

**Bundletool version(s) affected**
Version: presumably all, but tested using 1.17.0

**Stacktrace**
Copy all of the output of the command, including the stacktrace if visible.

```
APK Signature Scheme v3 signers supported min/max SDK versions do not cover the entire desired range. Found min: 24 max 32
```

**To Reproduce**
Install [Signal](https://play.google.com/store/apps/details?id=org.thoughtcrime.securesms&hl=en_US) on a device (which uses the v3.1 signature scheme), and run the following:

```
java -jar bundle tool.jar check-transparency --mode=connected_device --package-name="org.thoughtcrime.securesms"
```

**Expected behavior**
The signature is valid and should not fail.

**Known workaround**
Thankfully this can be fixed if apksig is updated to the latest version:
[https://github.com/google/bundletool/pull/368](https://github.com/google/bundletool/pull/368)

**Environment:**
OS: Ubuntu 22.04, but presumably this doesn't matter

**Additional context**
None

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.