> So they are recompressing the files after applying the patches and hope that it's the same? Wouldn't it make more sense to work on having the signature work o

> So they are recompressing the files after applying the patches and hope that it's the same? Wouldn't it make more sense to work on having the signature work on uncompressed files? I was thinking the exact same thing when I read that portion of the article. Trying to recreate the exact APK seems entirely irrelevant. All the user (and developer) cares about is that the installed product is identical to the one the developer submitted via the Google Play developer console. This is much more easily achieved by generating a signature on the decompressed content. It also gives Google greater freedom to change compression algorithms etc.