2

For a given Android Studio release published by Google, how can I cryptographically verify the authenticity and integrity of the .tar.gz file that I downloaded before I copy it onto a USB drive and attempt to install it on my laptop?

Today I wanted to download Android Studio, but the download page said nothing about how to cryptographically verify the integrity and authenticity of their release after download.

https://developer.android.com/studio#downloads

I expected to see a message on the download page telling me:

  1. The fingerprint of their PGP release signing key,
  2. A link to further documentation, and
  3. Links to [a] a manifest file (eg SHA256SUMS) and [b] a detached signature of that manifest file (eg SHA256SUMS.asc, SHA256SUMS.sig, SHA256SUMS.gpg, etc)

Unfortunately, the only information I found on the download page was how to verify the integrity of the tarball using a SHA-256 checksum found in a table on the same page. Obviously, this checks integrity but not authenticity. And it provides no security because it's not out-of-band from the .tar.gz itself.

How can I preform cryptographic integrity and authenticity verification with Google's Android Studio releases?

6
  • 1
    As an example of why this matters: The SDK for developing apps is a great target for supply chain attacks, and it happened to Apple's XCode in 2015, successfully infecting >4,000 apps in the Apple Store, affecting hundreds of millions of users en.wikipedia.org/wiki/XcodeGhost Mar 23, 2021 at 22:51
  • 1
    Your example has developers downloading from non-Apple sites. Honestly, if you aren't trusting the download/sums from android.com along with going through the EULA then you are in a worse situation of MITM or DNS spoof for android.com and quite probably your entire network access. Frankly I'd be more concerned about: Poisoned Projects Mar 24, 2021 at 0:55
  • 1
    MITM isn't the only route. android.com itself could get hacked. Even if the integrity of the page is manipulated for 30 minutes at just the right time by an APT, it could do significant damage to a target. Consider how this was done to the official monero wallet in 2019 github.com/monero-project/monero/issues/6151 Mar 24, 2021 at 8:31
  • 1
    But MITM or DNS spoofs are certainly a threat for the APTs that craft supply chain attacks. Consider the target of XCodeGhost was mostly Chinese app developers. See also security.stackexchange.com/questions/234052/… Mar 24, 2021 at 8:34
  • 1
    I notice that google has closed the issue as "won't fix (infeasible)", showing an appalling lack of concern for the most basic of security practices. Especially outrageous considering that Android Studio is at the root of the supply chain for a large percentage of all the world's running applications! @MichaelAltfield
    – Bogatyr
    Nov 3 at 11:13

0

You must log in to answer this question.