BFE 0.8 — APK Cloner + Signer

BFE — standalone, sideload-only Android file manager & explorer with native archive extraction/compression, dual-pane commander mode, SAF + root app-storage browsing, and now an APK cloner + signer. GPL-3.0.

✨ New in 0.8 — APK Cloner + Signer

Clone

• Clone any .apk file (⋮ → Clone APK…) or any installed app (toolbar → Clone installed app…, picks up the app's base APK; split/bundle installs are merged into one APK first).
• Editor: new package name, app label, versionCode, versionName, icon (replaced at every density, adaptive icons handled), plus an Advanced section (minSdk/targetSdk, debuggable, allowBackup, extractNativeLibs).
• A proper rename, so clones actually install and run beside the original: relative component class names are made absolute under the old package (code keeps resolving), every ContentProvider authority is moved to the new package (no INSTALL_FAILED_CONFLICTING_PROVIDER), package-scoped permissions and their references are renamed, sharedUserId is dropped, taskAffinity is rewritten, and the manifest + resources.arsc package are renamed together. Every fixup applied is listed in the result.
• Clone & Install in one tap. Output goes next to the source as <name>-clone.apk (or -edited.apk for Edit APK…); SAF/root destinations supported.

Sign

• Sign APK… on any .apk: strips the old signature and re-signs with APK Signature Scheme v1 + v2 + v3 (per-sign toggles; v4 off), zipaligned (16 KB page alignment for native libs when extractNativeLibs=false), then verified — the result shows which schemes verified and the signer.
• Built-in "BFE Test Key" (RSA-2048, generated once on first use, kept private to the app) is the default for clone/edit/sign — so every clone shares one signature and can be updated in place.
• Key manager: import your own keystore (PKCS12 .p12/.pfx or BKS — JKS isn't supported by Android's crypto stack; convert with keytool -importkeystore -deststoretype PKCS12), or generate a new key (CN / org / validity); alias + passwords remembered.

Proven on a real APK (sandbox)

The exact rewrite + align + sign pipeline was run against BFE's own 0.7 release APK: result com.the412banner.bfe.clone / "BFE Clone" / vc 99, apksigner: v1 true · v2 true · v3 true, both provider authorities renamed, no sharedUserId, launcher activity correctly kept on the old-package class, zipalign -c -p clean; a second run with extractNativeLibs=false verified every .so at a 16 KB-aligned offset.

⚠️ Honest caveats (inherent to cloning — shown in-app too)

• Clones of apps that verify their own signature, Play-licensed apps, Firebase/Google-services-bound apps, and some split/bundle apps may not run. Plain apps clone fine.
• An app that builds its FileProvider authority in code from BuildConfig.APPLICATION_ID will mismatch the renamed manifest authority (sharing may break) — not fixable from the manifest.
• Not rewritten (by design): android:process names, <queries> / instrumentation targets, meta-data values that embed the package, and anything inside dex/strings.
• Nothing in 0.8 is device-run yet — the pipeline is JVM-proven; the icon-replacement path and split-merge on a real split app are untested. First thing to try on-device: Clone & Install a simple app, then an installed split app.
• Imported keystore passwords are stored in app-private prefs in plain text (convenience). Cancel takes effect between stages.

Everything else

Compress to zip/7z/tar/tar.gz/tar.xz/tzst/Winlator .wcp (0.7) · root any-app browsing with chown-to-app-uid safety (0.6) · pinnable SAF app storage (0.5) · dual-pane commander w/ shared toolbar + per-pane Grid/List/Compact & sort · full extraction stack (7z/zip/rar/iso, InnoSetup/GOG + DLC batch, FreeArc) · Open-with / Install-APK / Share.

Requirements & install

• Android 8.0+ (API 26), arm64-v8a only; grant All-files access on first run; root (Magisk) optional for root features.
• Sideload BFE-0.8.apk (allow "install unknown apps"). Separate app (com.the412banner.bfe).

Signing & integrity

• BFE itself is signed with the repo's public test key (CN=BFE Test), schemes v1 + v2 + v3 (verified). Only install builds from this repo's Releases; compare the SHA-256.
• APK SHA-256: 523a730939566474c490195f4bdd501ed8ef339ea19bf4120c31e89c94af2807

Built from 7c6b590 · CI run 33577251015.