Skip to content

Bundletool fails to validate code transparency for apps using v3.1 signature scheme #369

@greyson-signal

Description

@greyson-signal

Describe the bug
apksig 4.2.0-alpha13 doesn’t support the v3.1 signature scheme, causing an APK signed with that scheme to fail validation with the following error:

APK Signature Scheme v3 signers supported min/max SDK versions do not cover the entire desired range.  Found min:  24 max 32

Bundletool version(s) affected
Version: presumably all, but tested using 1.17.0

Stacktrace
Copy all of the output of the command, including the stacktrace if visible.

APK Signature Scheme v3 signers supported min/max SDK versions do not cover the entire desired range.  Found min:  24 max 32

To Reproduce
Install Signal on a device (which uses the v3.1 signature scheme), and run the following:

java -jar bundle tool.jar check-transparency --mode=connected_device --package-name="org.thoughtcrime.securesms"

Expected behavior
The signature is valid and should not fail.

Known workaround
Thankfully this can be fixed if apksig is updated to the latest version:
#368

Environment:
OS: Ubuntu 22.04, but presumably this doesn't matter

Additional context
None

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions