I see what's going on. The misconfiguration is on the Autograph side. No matter the APK we provide, Autograph forces[1] the `--min-sdk-version` flag to either API level 9[2] or 18[3]. Both levels are ancient[4] and actually predate the minimum API level Fenix (and Focus) require[5]. This implementation[6] was suited for Fennec but it's of no use today. As a matter of fact `apksigner` uses the value defined in the APK metadata[7]. We should just do that. Here's what happens when I sign an APK without forcing the API level: ``` wget https://archive.mozilla.org/pub/fenix/releases/114.0/android/fenix-114.0-android-arm64-v8a/fenix-114.0.multi.android-arm64-v8a.apk -O fenix.apk keytool -genkeypair -alias somealias -keyalg RSA -keystore keystore.jks apksigner sign --v1-signing-enabled true --v2-signing-enabled true --v3-signing-enabled false --ks keystore.jks fenix.apk unzip -p fenix.apk META-INF/SOMEALIA.SF | tail ``` ``` Name: transport-runtime.properties SHA-256-Digest: NfdWH4HAp6JsGXf69miAW7x4gM+owOeuYpxtCsnvvv0= ``` Therefore, upgrading the digest hash has no risk and is will benefit users. [1] https://github.com/mozilla-services/autograph/blob/8a34847a0f546a9734a16e49460e6ba867ff6d29/signer/apk2/apk2.go#L161 [2] https://github.com/mozilla-services/autograph/blob/8a34847a0f546a9734a16e49460e6ba867ff6d29/signer/apk2/apk2.go#L86 [3] https://github.com/mozilla-services/autograph/blob/8a34847a0f546a9734a16e49460e6ba867ff6d29/signer/apk2/apk2.go#L82 [4] https://developer.android.com/tools/releases/platforms [5] https://github.com/mozilla-mobile/firefox-android/blob/3a2135d7a564e72c86198da1b43c67b0d6c5387f/android-components/.config.yml#L6 [6] https://github.com/mozilla-services/autograph/commit/8a81bd3b256bb9ddd499e15bcdadd26523b921a6#diff-4ee034ddcad5186c45b707fe39a7a68096d244ccedd6d705d143243cbdc39145R58 [7] https://developer.android.com/tools/apksigner#options-sign-general
Bug 1838680 Comment 1 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
I see what's going on. The misconfiguration is on the Autograph side. No matter the APK we provide, Autograph forces[1] the `--min-sdk-version` flag to either API level 9[2] or 18[3]. Both levels are ancient[4] and actually predate the minimum API level Fenix (and Focus) require[5]. This implementation[6] was suited for Fennec but it's of no use today. As a matter of fact `apksigner` uses the value defined in the APK metadata[7]. We should just do that. Here's what happens when I sign an APK without forcing the API level: ``` wget https://archive.mozilla.org/pub/fenix/releases/114.0/android/fenix-114.0-android-arm64-v8a/fenix-114.0.multi.android-arm64-v8a.apk -O fenix.apk keytool -genkeypair -alias somealias -keyalg RSA -keystore keystore.jks apksigner sign --v1-signing-enabled true --v2-signing-enabled true --v3-signing-enabled false --ks keystore.jks fenix.apk unzip -p fenix.apk META-INF/SOMEALIA.SF | tail ``` ``` Name: transport-runtime.properties SHA-256-Digest: NfdWH4HAp6JsGXf69miAW7x4gM+owOeuYpxtCsnvvv0= ``` I also checked what API level switches to sha256: it's API level 18. Fenix ships API level 21. Therefore, upgrading the digest hash has no risk and is will benefit users. [1] https://github.com/mozilla-services/autograph/blob/8a34847a0f546a9734a16e49460e6ba867ff6d29/signer/apk2/apk2.go#L161 [2] https://github.com/mozilla-services/autograph/blob/8a34847a0f546a9734a16e49460e6ba867ff6d29/signer/apk2/apk2.go#L86 [3] https://github.com/mozilla-services/autograph/blob/8a34847a0f546a9734a16e49460e6ba867ff6d29/signer/apk2/apk2.go#L82 [4] https://developer.android.com/tools/releases/platforms [5] https://github.com/mozilla-mobile/firefox-android/blob/3a2135d7a564e72c86198da1b43c67b0d6c5387f/android-components/.config.yml#L6 [6] https://github.com/mozilla-services/autograph/commit/8a81bd3b256bb9ddd499e15bcdadd26523b921a6#diff-4ee034ddcad5186c45b707fe39a7a68096d244ccedd6d705d143243cbdc39145R58 [7] https://developer.android.com/tools/apksigner#options-sign-general