10

In the custom recovery TWRP, what does the option "zip file signature verification" do? How do I know if it should be checked when installing something?

  • Note, that you can disable it in the TWRP settings. – toogley Dec 20 '16 at 17:04
7

Basically the Zip File Signature Verification flag will enable flashing only if the zip file is signed properly by the developer. This is (almost) the same method used signing Jar files in Java.

From here

Basically, before executing any third-party program you want to make sure that it hasn't been tampered with (integrity) and that it was actually created by the entity that it claims to come from (authenticity). Those features are usually implemented by some digital signature scheme, which guarantees that only the entity owning the signing key can produce a valid code signature. The signature verification process verifies both that the code has not been tampered with and that the signature was produced with the expected key.

Note from the above, that this (obviously) cannot detect if the code itself is malware etc, just that it is as it was when it was signed by the developer. You have to trust the developer of any software you flash.

An example of this is that you cannot flash a custom ROM through a Stock Recovery as the stock recovery will look for a signature from the manufacturer.

It can also detect if a zip is corrupt but is not a definitive check, you would be better verifying the MD5 sum of the file and comparing to the one provided by the ROM developer.

"How do I know if it should be checked?" This is probably going to vary depending on what you are doing, I generally have it left at the default value of the particular recovery I'm using, and I've never actually had to check or uncheck it for any Zip files. Keep in mind some perfectly functional packages might be signed incorrectly and may install perfectly if you disable the verification, but conversely it could be a corrupt file and bootloop the device.

I leave it checked, and if someone on a thread / the developer says it's ok to install then I will make a backup and try flashing it with the signature verification turned off. (ALWAYS make a backup!)

Here is an example of trying to install a custom ROM on a stock S4 Recovery:

Finding update package...
Opening update package...
Verifying update package...
E:No signature (188 files)
E:Verification failed
Installation aborted.

Here's a link to the more technical information on GitHub which is a bit out of scope to go into on here.

  • 3
    As I understand it, verifying the authenticity of a signature (as opposed to just its integrity) requires having a set of root certificates, one of which should have signed the certificate that signed the file itself - self-signed code only guarantees integrity, unless the user manually compares the certificate fingerprint against a trusted source. Does TWRP have a list of root certificates built-in? – Josh Feb 21 '17 at 0:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.