4 ms·

AAB supports a code transparency feature: https://developer.android.com/guide/app-bundle/code-transparency https://developer.android.com/guide/app-bundle/code-t

• toast0 5y ago
  > The code transparency file does not verify resources, assets, the Android Manifest, or any other files that are not DEX files or native libraries contained in the lib/ folder. > Important: The Android OS does not verify code transparency files at install time, and continues to rely on the APK signing schemes for verification of any installed APKs. This is like having checksums in a Readme. If nobody checks them (and that's the likely case, since the OS doesn't), it doesn't matter if they differ from the distributed files. It's still the case that Google is taking over the code signing roles, so that the user's OS will no longer tell the difference between a developer signed update and a Google signed update. This is a negative for security and transparency, regardless of the size benefits and regardless of the fact that the Apple App Store has operated in this fashion since the beginning.