Skip to content

Bundletool fails to validate code transparency for apps using v3.1 signature scheme #369

@greyson-signal

Description

@greyson-signal

Describe the bug
apksig 4.2.0-alpha13 doesn’t support the v3.1 signature scheme, causing an APK signed with that scheme to fail validation with the following error:

APK Signature Scheme v3 signers supported min/max SDK versions do not cover the entire desired range.  Found min:  24 max 32

Bundletool version(s) affected
Version: presumably all, but tested using 1.17.0

Stacktrace
Copy all of the output of the command, including the stacktrace if visible.

APK Signature Scheme v3 signers supported min/max SDK versions do not cover the entire desired range.  Found min:  24 max 32

To Reproduce
Install Signal on a device (which uses the v3.1 signature scheme), and run the following:

java -jar bundle tool.jar check-transparency --mode=connected_device --package-name="org.thoughtcrime.securesms"

Expected behavior
The signature is valid and should not fail.

Known workaround
Thankfully this can be fixed if apksig is updated to the latest version:
#368

Environment:
OS: Ubuntu 22.04, but presumably this doesn't matter

Additional context
None

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions