Erik van Straten<p><span class="h-card" translate="no"><a href="https://chaos.social/@brahms" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>brahms</span></a></span> <span class="h-card" translate="no"><a href="https://chaos.social/@SylvieLorxu" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>SylvieLorxu</span></a></span> :</p><p>Figure 1 from <a href="https://developer.android.com/studio/publish/app-signing#app-signing-google-play" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">developer.android.com/studio/p</span><span class="invisible">ublish/app-signing#app-signing-google-play</span></a>.</p><p>(OT: I hate it that webpages can change colors of parts of the browser).</p><p>Unfortunately the image is somewhat confusing: the same pictograms as used for the private keys can be seen in the signed app (which makes no sense). Many people confuse (public) certificates with private keys because of such confusing diagrams.</p><p>How I think it works:</p><p>1️⃣ The programmer embeds their (self-signed) certificate containing the public key (associated with their private upload key) into the APK file, and then signs the APK using their private (upload) key.</p><p>2️⃣ The programmer then uploads the APK to Google.</p><p>3️⃣ Google confirms that the certificate embedded in the APK is the same as used in previous submissions of this app.</p><p>4️⃣ In addition, Google verifies that the signature is valid, and must have been made using the programmer's private upload key (associated with the pubkey in the cert). I.e. step 3 and 4 prove that Google is dealing with the same programmer (unless the programmer's private key was compromised).</p><p>5️⃣ Google has an own publication certificate (+ associated privkey) specifically for each programmer. Google removes the old signature from the APK, replaces the certificate with "theirs" (for the programmer), applies their magic to components in the APK, and finally sign the APK with "their" private key (called "app signing key") associated with the original programmer.</p><p>6️⃣ Finally Google published the APK in the Play Store.</p><p>Please correct me if I'm wrong!</p><p><span class="h-card" translate="no"><a href="https://kolektiva.social/@LukefromDC" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>LukefromDC</span></a></span> <span class="h-card" translate="no"><a href="https://sigmoid.social/@drgroftehauge" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>drgroftehauge</span></a></span> <span class="h-card" translate="no"><a href="https://manganiello.social/users/fabio" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>fabio</span></a></span> <br> </p><p><a href="https://infosec.exchange/tags/TIL" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>TIL</span></a> <a href="https://infosec.exchange/tags/APK" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>APK</span></a> <a href="https://infosec.exchange/tags/APKsigningProcess" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>APKsigningProcess</span></a> <a href="https://infosec.exchange/tags/AndroidApps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AndroidApps</span></a></p>