Check if Cromite apks are signed

[uazo]

Preliminary checklist

• I have read the README.
• I have searched the existing issues for my problem. This is a new ticket, NOT a duplicate or related to another open issue.
• I have read the FAQs.
• I have updated Cromite to the latest version. The bug is reproducible on this latest version.
• This is a bug report about the Cromite browser; not the website nor F-Droid nor anything else.

Can the bug be reproduced with corresponding Chromium version?

Yes

Cromite version

all

Device architecture

all

Platform version

I prefer not to write it/No matter

Android Device model

n/a

Is the device rooted?

I prefer not to write it

Changed flags

none

Is this bug happening in an incognito tab?

No

Is this bug caused by the adblocker?

No

Is this bug a crash?

no

Describe the bug

It seems that the apks are not signed.

try with:
keytool -printcert -jarfile xxx.apk

Steps to reproduce the bug

n/a

Expected behavior

I am probably doing something wrong during the build

Screenshots

n/a

[uazo]

so, what am I doing wrong?

gn args: https://github.com/uazo/cromite/blob/master/tools/images/bromite-build/build_args.gni#L17-L21
during build: https://github.com/uazo/cromite/actions/runs/6717728243/job/18256843368#step:4:66

[uazo]

so:

apksigner verify --verbose ChromePublic.apk

Verifies
Verified using v1 scheme (JAR signing): false
Verified using v2 scheme (APK Signature Scheme v2): true
Verified using v3 scheme (APK Signature Scheme v3): false
Verified using v4 scheme (APK Signature Scheme v4): false
Verified for SourceStamp: false
Number of signers: 1

while

jarsigner -verify -verbose -certs ChromePublic.apk   

  s = signature was verified 
  m = entry is listed in manifest
  k = at least one certificate was found in keystore

no manifest.

jar is unsigned.

apk are signed with Signature Scheme v2

If your min API is lower than 24, v1 signing will be included in apk (inside META_INF). 
And because of that, these two tools will "poop out" your cert keys.

If using min API 24 or higher, v1 signing will be excluded (unless you enable it on your own
in build.gradle). In this case keytool or jarsigner don't work. They will output Not a 
signed jar file or jar is unsigned. To verify v2+ signature, you should use apksigner instead.

see https://source.android.com/docs/security/features/apksigning

[basilgello]

You can try uber-apk-signer with custom keystore

[uazo]

apks are automatically signed by build process, whereas for aabs it has to be done.