Search code examples
javaandroidapkandroid-install-apkjarsigner

Add Metadata to Android APK without Breaking Signature

Is there a way to add metadata to an Android APK without impacting the signature?

Will adding files to the META-INF folder break the signature? What about modifying the file: MANIFAST.MF?

Solution

  • You can't modify an APK without breaking it's signature.

    The META-INF folder contains three files in:

    1. CERT.RSA This is your certificate
    2. MANIFEST.MF This is the nominal Jar manifest that contains the hashes for all files referenced in the APK
    3. CERT.SF Is the signature file for all entries in the MANIFEST.MF as well as the manifest file as a whole

    If you change any file in the APK, it's hash will change and signature verification will fail. As far adding arbitrary files to an APK, Android will only permit you to access files that are in the MANIFEST.MF and since you can not change this file without breaking its hash, you are effectively unable to add any files to the APK as well.

    More info on jar signing and verification