Well, the app I tested — YouTube Vanced — is installed as a bundle, you can see Vanced Manager download its parts. I did check with jadx, that apk is validly si

Well, the app I tested — YouTube Vanced — is installed as a bundle, you can see Vanced Manager download its parts. I did check with jadx, that apk is validly signed with v1, v2, and v3 signatures. Now, as far as my own knowledge of apk signing goes, v1 signature should definitely be fine because it operates on files inside the archive, so naturally merging multiple apks signed with the same certificate would keep it valid. But v2 signs the archive itself, which means merely repacking it would render the signature invalid. I don't have much of an idea about v3. Maybe there's some algorithm to merge multiple apks such that signatures remain valid. Related question that needs research: how are bundle apps stored after installation? I know that installing a regular apk copies it into /data/app, extracts native libraries from it, and adds its metadata to some XML files I forgot names of. Again, it's been too much time since I did something serious for Android, so I'm not quite up to date on this stuff. (are you the guy behind Cydia btw?) edit again: apparently it doesn't back up the additional parts $ pm path com.vanced.android.youtube package:/data/app/~~JVhMJHpiRhB5U1ZM1MHNmw==/com.vanced.android.youtube-iqpVMVaXRD4XezgeqdjBHQ==/base.apk package:/data/app/~~JVhMJHpiRhB5U1ZM1MHNmw==/com.vanced.android.youtube-iqpVMVaXRD4XezgeqdjBHQ==/split_config.arm64_v8a.apk package:/data/app/~~JVhMJHpiRhB5U1ZM1MHNmw==/com.vanced.android.youtube-iqpVMVaXRD4XezgeqdjBHQ==/split_config.en.apk package:/data/app/~~JVhMJHpiRhB5U1ZM1MHNmw==/com.vanced.android.youtube-iqpVMVaXRD4XezgeqdjBHQ==/split_config.ru.apk The apk I backed up earlier is base.apk, so that mystery is solved. It probably just adds them all to the classpath in runtime like regular JVM does with a bunch of jars.