0

I have a trivial app up at the Play Store. It calculates its own keyed checksum and displays the results.

The Play Store checksum is always different than that of the uploaded apk file. I understand Google is adding its own special sauce to the apk, presumably in the manifest.

The Play Store checksum has changed since the app was first available. Is Google Play changing the apk from time to time?

Improve this question

1 Answer 1

Reset to default
1

When uploading an APK file to PlayStore Google add another signature to the APK file.

This "Google PlayStore Signature" (also known as "frosting") allows to identify if an APK file has been retrieved from Google Play Store.

Based on the APK signature scheme v2 an APK file can have multiple signatures.

You can't add add every signature in the signed content the signatures are ignored when verifying the APK (or in detail the complete APK signing block is ignored). Therefore adding the frosting signature does not invalidate any signatures you have created.

This may be the reason that a APK file retrieved from PlayStore has a different check sum that the one you uploaded.

Improve this answer
4
  • +1 It's will be great if you add a link or explaination of the frosting part.
    – Reddy Lutonadio
    Aug 22, 2019 at 13:18
  • Whatever they're doing, do they change their additions with time, i.e. monthly?
    – user3594510
    Aug 22, 2019 at 13:33
  • @Reddy Most of the information I have about this comes from the following SO page: stackoverflow.com/questions/48090841 Especially the link to the Avast apkverifier code shows some details.
    – Robert
    Aug 22, 2019 at 15:26
  • @Robert Thanks for the info.
    – Reddy Lutonadio
    Aug 22, 2019 at 15:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .