Idea: check a signed APK against its rebuild, with no dependencies

[AmineYagoub]

The problem. With a reproducible build, anyone can rebuild an APK and confirm it matches the source, apart from its signature. The standard tool for that check is F-Droid's apksigcopier. It isn't always installed, and on locked-down machines installing it is the hard part.

What we did. When signing Minhajna 0.1.0 (djazairdev/minhajna#208), we wrote a check in about 50 lines of Python, standard library only. It proves a signed APK is its unsigned build plus a signature and nothing else. It checks that:

• the entries are byte for byte the same, up to the central directory;
• only zero bytes come between the entries and the APK Signing Block, which apksigner adds to align the block to 4096 bytes;
• the central directory and the end record are unchanged, except for the central directory's offset;
• no v1 (JAR) signature was added.

It passed for all three 0.1.0 APKs, and caught a single flipped byte in a test.

Who else it hits. Any app that publishes reproducible builds: F-Droid apps, security-minded apps, and anyone verifying a release on a machine where they can't install much.

What to build

• A single-file, dependency-free tool, apk-sigcheck <signed.apk> <unsigned.apk>, that explains why two files differ, not just that they do. It would be tested on APKs from apksigner with and without --alignment-preserved, and with v1 on and off.
• Maybe a GitHub Action that runs it in a release workflow.

Size: small. It's mostly tests and documentation. Apache-2.0 or MIT.

From Minhajna's work; drafted with Claude Code.