Take the 2-minute tour ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.

Are the gapps (e.g. from goo.im) signed in a way that prevents tampering? Is there a way to verify they're the same as you'd get from Google?

Do all / most ROMs check for this?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

All Android apps are signed.

Android will not run an unsigned app. In addition, the signatures are tied to the app permissions, such that if the signature was wrong, other apps would not be able to talk with it, and you would not be able to receive updates to it from Google Play.

Android signing is discussed in more depth in Signing Your Applications in the Android developer documentation, from which the above information was drawn.

If you are paranoid and want to verify an app's signature, you can use the jarsigner utility included with the Java Development Kit (JDK). For example:

jarsigner -verify -verbose -certs Vending.apk
share|improve this answer
  • If you got your gapps from goo.im, you could manually check if the MD5sum of the .zip file you downloaded is correct. This would assure you that the file has not been tampered with.

  • If flashing through ClockworkMod Recovery, there is this option: install zip from sdcard > toggle signature verification.

share|improve this answer
    
I don't think zip signature verification will check that the apps (or other contents) inside the zip are signed, though; it only checks that the zip file itself is signed. Similarly, checking the md5 of the zip doesn't really prove anything about the apps it contains unless you create your own flashable zip with known good copies of the same versions of the same apps and then md5 them both (but then why would you download it? You'd already have your own flashable version) –  eldarerathis Feb 10 '13 at 15:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.