apksigner/ApkVerifier rejects APKs JAR-signed with multiple digests [38497270]

Fixed

Bug

Status Update

No update yet.

Description

kl...@google.com

created issue #1

May 22, 2017 05:18PM

apksig's ApkVerifier and "apksigner verify" incorrectly reject APKs whose MANIFEST.MF references contents of JAR entries via multiple digests. For example, if a MANIFEST.MF contains both the SHA1-Digest and SHA-256-Digest attributes, both with correct digests of the entry's contents, "apksigner verify" and apksig's ApkVerifier reject the APK claiming:

ERROR: SHA-256 digest of AndroidManifest.xml does not match the digest specified in META-INF/MANIFEST.MF. Expected: <m5RN5FDhPTSIGRMQ0uVUXeEI+J0i51uoGsXVFFZGbnQ=>, actual: <2jlj7l5rSw0yVb/vlWAYkK/YBwk=>

An easy way to spot the issue is that "expected" and "actual" digests in the above error message are of different lengths.

The issue occurs only when verifying APKs for API Level / minSdkVersion 17 and lower.

I'm attaching a sample APK which exhibits this issue.

temp2.apk

4.7 KB

Download

Comments

kl...@google.com <kl...@google.com> May 22, 2017 05:18PM

Accepted by kl...@google.com.

ap...@google.com <ap...@google.com> #2May 22, 2017 09:37PM

Fixed in r1313.

ap...@google.com <ap...@google.com> #3Jun 22, 2017 06:56PM

[Empty comment from Monorail migration]

kl...@google.com <kl...@google.com> #4Jul 25, 2017 07:34PM

Marked as fixed.

[Empty comment from Monorail migration]

Issue 38497270

Description

Issue summary

Comments

kl...@google.com <kl...@google.com> May 22, 2017 05:18PM

ap...@google.com <ap...@google.com> #2May 22, 2017 09:37PM

ap...@google.com <ap...@google.com> #3Jun 22, 2017 06:56PM

kl...@google.com <kl...@google.com> #4Jul 25, 2017 07:34PM

Add comment

Issue metadata