search

google / bundletool

Bundletool is a command-line tool to manipulate Android App Bundles
https://g.co/androidappbundle
Apache License 2.0
3.52k stars 385 forks source link

Bundletool fails to validate code transparency for apps using v3.1 signature scheme #369

Open greyson-signal opened 2 months ago

greyson-signal commented 2 months ago

Describe the bug apksig 4.2.0-alpha13 doesn’t support the v3.1 signature scheme, causing an APK signed with that scheme to fail validation with the following error:

APK Signature Scheme v3 signers supported min/max SDK versions do not cover the entire desired range.  Found min:  24 max 32

Bundletool version(s) affected Version: presumably all, but tested using 1.17.0

Stacktrace Copy all of the output of the command, including the stacktrace if visible.

APK Signature Scheme v3 signers supported min/max SDK versions do not cover the entire desired range.  Found min:  24 max 32

To Reproduce Install Signal on a device (which uses the v3.1 signature scheme), and run the following:

java -jar bundle tool.jar check-transparency --mode=connected_device --package-name="org.thoughtcrime.securesms"

Expected behavior The signature is valid and should not fail.

Known workaround Thankfully this can be fixed if apksig is updated to the latest version: https://github.com/google/bundletool/pull/368

Environment: OS: Ubuntu 22.04, but presumably this doesn't matter

Additional context None