3 ms·

Yeah it's this. Android itself has no idea about Google Play requirements. edit: just tried to back up an app that was definitely installed as a bundle, and ye

Yeah it's this. Android itself has no idea about Google Play requirements. edit: just tried to back up an app that was definitely installed as a bundle, and yes, the result was a regular apk

saurik 5y ago
That doesn't make any sense at all, even merely cryptographically (as you would need the signing key to merge the bundle back into a normal apk file and sign that new different file), and doesn't match the behaviors people talk about on various blogs and stack overflow.
- grishka 5y ago
  Well, the app I tested — YouTube Vanced — is installed as a bundle, you can see Vanced Manager download its parts. I did check with jadx, that apk is validly signed with v1, v2, and v3 signatures. Now, as far as my own knowledge of apk signing goes, v1 signature should definitely be fine because it operates on files inside the archive, so naturally merging multiple apks signed with the same certificate would keep it valid. But v2 signs the archive itself, which means merely repacking it would render the signature invalid. I don't have much of an idea about v3. Maybe there's some algorithm to merge multiple apks such that signatures remain valid. Related question that needs research: how are bundle apps stored after installation? I know that installing a regular apk copies it into /data/app, extracts native libraries from it, and adds its metadata to some XML files I forgot names of. Again, it's been too much time since I did something serious for Android, so I'm not quite up to date on this stuff. (are you the guy behind Cydia btw?) edit again: apparently it doesn't back up the additional parts $ pm path com.vanced.android.youtube package:/data/app/~~JVhMJHpiRhB5U1ZM1MHNmw==/com.vanced.android.youtube-iqpVMVaXRD4XezgeqdjBHQ==/base.apk package:/data/app/~~JVhMJHpiRhB5U1ZM1MHNmw==/com.vanced.android.youtube-iqpVMVaXRD4XezgeqdjBHQ==/split_config.arm64_v8a.apk package:/data/app/~~JVhMJHpiRhB5U1ZM1MHNmw==/com.vanced.android.youtube-iqpVMVaXRD4XezgeqdjBHQ==/split_config.en.apk package:/data/app/~~JVhMJHpiRhB5U1ZM1MHNmw==/com.vanced.android.youtube-iqpVMVaXRD4XezgeqdjBHQ==/split_config.ru.apk The apk I backed up earlier is base.apk, so that mystery is solved. It probably just adds them all to the classpath in runtime like regular JVM does with a bunch of jars.
- DennisAleynikov 5y ago
  there seem to be edge cases where the bundle isn't extractable back into an apks but despite packaging my apps as bundles and downloading from the play store they still end up as useable apks in the end. as far as I've gathered bundles are a way of adding multiple ABI's into a smaller shared apk that then is split into per abi by google but I may be entirely off base here

Yeah it's this. Android itself has no idea about Google Play requirements. edit: just tried to back up an app that was definitely installed as a bundle, and yes, the result was a regular apk

saurik 5y ago

That doesn't make any sense at all, even merely cryptographically (as you would need the signing key to merge the bundle back into a normal apk file and sign that new different file), and doesn't match the behaviors people talk about on various blogs and stack overflow.

grishka 5y ago
Well, the app I tested — YouTube Vanced — is installed as a bundle, you can see Vanced Manager download its parts. I did check with jadx, that apk is validly signed with v1, v2, and v3 signatures. Now, as far as my own knowledge of apk signing goes, v1 signature should definitely be fine because it operates on files inside the archive, so naturally merging multiple apks signed with the same certificate would keep it valid. But v2 signs the archive itself, which means merely repacking it would render the signature invalid. I don't have much of an idea about v3. Maybe there's some algorithm to merge multiple apks such that signatures remain valid. Related question that needs research: how are bundle apps stored after installation? I know that installing a regular apk copies it into /data/app, extracts native libraries from it, and adds its metadata to some XML files I forgot names of. Again, it's been too much time since I did something serious for Android, so I'm not quite up to date on this stuff. (are you the guy behind Cydia btw?) edit again: apparently it doesn't back up the additional parts $ pm path com.vanced.android.youtube package:/data/app/~~JVhMJHpiRhB5U1ZM1MHNmw==/com.vanced.android.youtube-iqpVMVaXRD4XezgeqdjBHQ==/base.apk package:/data/app/~~JVhMJHpiRhB5U1ZM1MHNmw==/com.vanced.android.youtube-iqpVMVaXRD4XezgeqdjBHQ==/split_config.arm64_v8a.apk package:/data/app/~~JVhMJHpiRhB5U1ZM1MHNmw==/com.vanced.android.youtube-iqpVMVaXRD4XezgeqdjBHQ==/split_config.en.apk package:/data/app/~~JVhMJHpiRhB5U1ZM1MHNmw==/com.vanced.android.youtube-iqpVMVaXRD4XezgeqdjBHQ==/split_config.ru.apk The apk I backed up earlier is base.apk, so that mystery is solved. It probably just adds them all to the classpath in runtime like regular JVM does with a bunch of jars.
DennisAleynikov 5y ago
there seem to be edge cases where the bundle isn't extractable back into an apks but despite packaging my apps as bundles and downloading from the play store they still end up as useable apks in the end. as far as I've gathered bundles are a way of adding multiple ABI's into a smaller shared apk that then is split into per abi by google but I may be entirely off base here