Hacker News Reader

Comment by dredmorbius | Hacker News Reader

Disclaimer: I know next to nothing about Android development.

I do know a bit about PKI. And one option might be that the workflow be something like:

Dev signs bundle => Google signs bundle (including dev signature) => User/Client verifies both signatures.

Google are still signing here, but if the dev signature doesn't verify (or isn't present), there's a post-build modification occurring, which is the principle issue raised in the tweet thread.

View on HN

Post-build modifications are the whole point of App Bundles :) See https://developer.android.com/platform/technology/app-bundle... for details.

The entire reason this exists is because of post-build modifications. A huge portion of an APK file is not useful on a given device. To save disk space and bandwidth and improve load times, Google will automatically remove content from APK files that aren't relevant for the particular device downloading the app. But doing this would break the signature unless Google possesses the signing keys.

One the one hand yes, but on the other hand unfortunately it also complicates backups and makes them somewhat non-portable.

While APK backups aren't officially supported and therefore might not factor into the decision making, curiously enough Google itself only recently added a feature to the Play Store which apparently allows direct sharing of APKs between nearby devices. Split APKs however mean that you can only sensibly share apps with devices having the same screen density, language, etc. as your own device, somewhat devaluating that feature again.

Reply on news.ycombinator.com