4 ms·

Any secure co-signing approach would require putting app developers in the loop. Are app developers going to do that? If developers want to provide device-optim

Any secure co-signing approach would require putting app developers in the loop. Are app developers going to do that? If developers want to provide device-optimized APKs, they can do that already without this Google-signs-the-APK stuff. [1] https://developer.android.com/google/play/filters https://developer.android.com/google/play/filters

dredmorbius 5y ago
Disclaimer: I know next to nothing about Android development. I do know a bit about PKI. And one option might be that the workflow be something like: Dev signs bundle => Google signs bundle (including dev signature) => User/Client verifies both signatures. Google are still signing here, but if the dev signature doesn't verify (or isn't present), there's a post-build modification occurring, which is the principle issue raised in the tweet thread.
- dbrgn 5y ago
  Post-build modifications are the whole point of App Bundles :) See https://developer.android.com/platform/technology/app-bundle/ https://developer.android.com/platform/technology/app-bundle... for details.
- UncleMeat 5y ago
  The entire reason this exists is because of post-build modifications. A huge portion of an APK file is not useful on a given device. To save disk space and bandwidth and improve load times, Google will automatically remove content from APK files that aren't relevant for the particular device downloading the app. But doing this would break the signature unless Google possesses the signing keys.
  - iggldiggl 5y ago
    One the one hand yes, but on the other hand unfortunately it also complicates backups and makes them somewhat non-portable. While APK backups aren't officially supported and therefore might not factor into the decision making, curiously enough Google itself only recently added a feature to the Play Store which apparently allows direct sharing of APKs between nearby devices. Split APKs however mean that you can only sensibly share apps with devices having the same screen density, language, etc. as your own device, somewhat devaluating that feature again.

dredmorbius 5y ago

Disclaimer: I know next to nothing about Android development. I do know a bit about PKI. And one option might be that the workflow be something like: Dev signs bundle => Google signs bundle (including dev signature) => User/Client verifies both signatures. Google are still signing here, but if the dev signature doesn't verify (or isn't present), there's a post-build modification occurring, which is the principle issue raised in the tweet thread.

dbrgn 5y ago
Post-build modifications are the whole point of App Bundles :) See https://developer.android.com/platform/technology/app-bundle/ https://developer.android.com/platform/technology/app-bundle... for details.
UncleMeat 5y ago
The entire reason this exists is because of post-build modifications. A huge portion of an APK file is not useful on a given device. To save disk space and bandwidth and improve load times, Google will automatically remove content from APK files that aren't relevant for the particular device downloading the app. But doing this would break the signature unless Google possesses the signing keys.
- iggldiggl 5y ago
  One the one hand yes, but on the other hand unfortunately it also complicates backups and makes them somewhat non-portable. While APK backups aren't officially supported and therefore might not factor into the decision making, curiously enough Google itself only recently added a feature to the Play Store which apparently allows direct sharing of APKs between nearby devices. Split APKs however mean that you can only sensibly share apps with devices having the same screen density, language, etc. as your own device, somewhat devaluating that feature again.