android - Apk 元信息警告

Question

当我尝试验证 .apk(andriod 应用程序)是否已签名时，我看到以下错误。

我不确定这个错误的确切含义是什么？

这会引起任何安全问题吗？

root@kali:~/Downloads# apksigner verify --verbose magni_v1.2.8_apkpure.com.apk 
Verifies
Verified using v1 scheme (JAR signing): true
Verified using v2 scheme (APK Signature Scheme v2): true
Number of signers: 1
WARNING: META-INF/android.arch.core_runtime.version not protected by signature. Unauthorized modifications to this JAR entry will not be detected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/android.arch.lifecycle_livedata-core.version not protected by signature. Unauthorized modifications to this JAR entry will not be detected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/android.arch.lifecycle_runtime.version not protected by signature. Unauthorized modifications to this JAR entry will not be detected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/android.arch.lifecycle_viewmodel.version not protected by signature. Unauthorized modifications to this JAR entry will not be detected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/com.android.support_support-compat.version not protected by signature. Unauthorized modifications to this JAR entry will not be detected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/com.android.support_support-core-ui.version not protected by signature. Unauthorized modifications to this JAR entry will not be detected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/com.android.support_support-core-utils.version not protected by signature. Unauthorized modifications to this JAR entry will not be detected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/com.android.support_support-fragment.version not protected by signature. Unauthorized modifications to this JAR entry will not be detected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/com.android.support_support-media-compat.version not protected by signature. Unauthorized modifications to this JAR entry will not be detected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/com.android.support_support-v4.version not protected by signature. Unauthorized modifications to this JAR entry will not be detected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/rxjava.properties not protected by signature. Unauthorized modifications to this JAR entry will not be detected. Delete or move the entry outside of META-INF/.

谢谢

Answer 1

APK的签名保证签名后如果APK中的文件发生变化，则无法在Android设备上安装(签名会失效)。

APK的签名存放在APK的META-INF目录下，也就是说如果META-INF目录下存放了其他一些文件，则不被签名覆盖。您看到的警告显示您的 APK 中的某些文件位于 META-INF 目录中，不受签名保护。

实际上，这些文件并不重要，它们主要是你所依赖的库的版本(只是版本号，而不是那些已经编译在dex代码中的库的实际代码)，所以即使有人修改了那些，它不会对您的应用程序产生任何影响。这就是为什么它只是一个警告:你的 APK 中的那些文件可以被其他人修改，同时仍然假装 APK 是由你签名的，但这些文件并不重要。

这在 APK 中很常见，所以我不会担心。