CODEWITHSUNDEEP
androidgoogle-play
Sezgin ACER
Sezgin ACER

Reputation: 61

Security Metadata in Android APK

As mentioned in this blog post- Google to add new security metadata on top of each APK file starting from 2018 to verify the android application installed via Google Play Store.

My question: Is this metadata related with jarsigner & apksigner or Google to put this metadata when the application APK uploaded to Play Store in order to distribute? No detailed information found on the blog post or any other source. Thanks in advance.

Upvotes: 6

Views: 3048

Answers (4)

Tassadar
Tassadar

Reputation: 1891

I have reverse-engineered the signature mechanism here: https://github.com/avast/apkverifier/blob/master/signingblock/frosting.go

It's called "frosting" internally and it is aimed mainly at P2P sharing of APKs. It is implemented in the Play Store APK, not the Android OS. Besides being signed by a key, play store also contains a "blacklist" of package names that can be marked as "not allowed" (currently empty).

The frosting is independent of the signing scheme - for example com.facebook.orca still uses scheme v1 but has frosting.

The frosting block is added by Play Store, so it proves that particular file was downloaded from Play Store, but not all APKs have it yet - APKs that were not updated recently are missing it. Also, sources like apkmirror.com might be getting APKs directly from developers, before they upload them to the Play store, so those will be missing frosting too.

Curiously, the frosting includes a metadata chunk encoded using protbuf. The structure is rather complex, it contains data like signing timestamp, versionCode, minSdkVersion and many more.

The Google Photos APK has metadata that contain string com.google.android.apps.photos.PIXEL_2018_PRELOAD. The string seems to suggest that the APK was part of factory image, but the APK from my own phone (which is not a pixel) also has this string.

APKs inside Pixel 2 (XL) 9.0 factory images do not have frosting.

Upvotes: 3

liudongmiao
liudongmiao

Reputation: 454

Upvotes: 4

Alex Klyubin
Alex Klyubin

Reputation: 5732

Neither jarsigner nor apksigner will be adding any such metadata. It appears that it is Google Play that will be adding this metadata, thus "stamping" APKs as "officially distributed by Google Play" (to quote the blog post). This stamping will have to occur at APK upload time or later, when the APK is distributed to installed base / users.

Upvotes: 2

just
just

Reputation: 2020

In your linked blog post you should read this:

We'll adjust Play's maximum APK size to take into account the small metadata addition, which is inserted into the APK Signing Block and does not alter the functionality of your app.

So when you sign your apk before upload it to the store Google put this metadata into the APK Signing block. You don't have to worry about it, the signing process does it automatically.

Upvotes: 1

Related Questions