Are the signatures of gapps from zips checked?

Question

Are the gapps (e.g. from goo.im) signed in a way that prevents tampering? Is there a way to verify they're the same as you'd get from Google?

Do all / most ROMs check for this?

Answer 1

All Android apps are signed.

Android will not run an unsigned app. In addition, the signatures are tied to the app permissions, such that if the signature was wrong, other apps would not be able to talk with it, and you would not be able to receive updates to it from Google Play.

Android signing is discussed in more depth in Signing Your Applications in the Android developer documentation, from which the above information was drawn.

If you are paranoid and want to verify an app's signature, you can use the jarsigner utility included with the Java Development Kit (JDK). For example:

jarsigner -verify -verbose -certs Vending.apk

Answer 2

• If you got your gapps from goo.im, you could manually check if the MD5sum of the .zip file you downloaded is correct. This would assure you that the file has not been tampered with.

• If flashing through ClockworkMod Recovery, there is this option: install zip from sdcard > toggle signature verification.