3 ms·
Apk are usually signed using v1 an v2 signatures for backwards compatibility. Ripping out v2 signature would keep v1 signature valid. I hope Android 7 doesn't
by Karliss 9y ago
Apk are usually signed using v1 an v2 signatures for backwards compatibility. Ripping out v2 signature would keep v1 signature valid. I hope Android 7 doesn't allow signing scheme downgrades if previously installed version was signed with v2 signature.
UPD Documentation states it does.
- klyubin 9y agoRipping out v2 signatures makes the APK invalid on Android 7.0 and newer. This is because the v1 signature contains a special header X-Android-APK-Signed in its META-INF/*.SF files. When Android 7.0 or newer encounters this header without having encountered a valid v2 signature, it rejects the APK. Installing a v1-only signed update to an APK which is v2 signed is permitted. However, the update has to be the same versionCode or higher to be accepted, meaning it can't be a downgrade in terms of versionCode. Thus, as long as you don't produce updates/upgrades which are v1-only signed, you should be protected against this vulnerability on Android 7.0 and newer.