scripts to make apks reproducible
Project description
reproducible-apk-tools
scripts to make apks reproducible
fix-newlines.py
If the signed APK was built on Windows and has e.g. META-INF/services/
files
with CRLF line endings whereas the unsigned APK was build on Linux/macOS and has
LF line endings, this script may help.
$ fix-newlines.py --help
Usage: fix-newlines.py [--from-crlf] [--verbose] INPUT_APK OUTPUT_APK PATTERN...
$ apksigcopier compare signed.apk --unsigned unsigned.apk
DOES NOT VERIFY
[...]
$ fix-newlines.py unsigned.apk fixed.apk 'META-INF/services/*'
$ zipalign -f 4 fixed.apk fixed-aligned.apk
$ apksigcopier compare signed.apk --unsigned fixed-aligned.apk && echo OK
OK
sort-apk.py
Sorts (and w/o --no-realign
also realigns) the ZIP entries of an APK.
$ sort-apk.py --help
Usage: sort-apk.py [--no-realign] INPUT_APK OUTPUT_APK
$ unzip -l some.apk
Archive: some.apk
Length Date Time Name
--------- ---------- ----- ----
6 2017-05-15 11:24 lib/armeabi/fake.so
1672 2009-01-01 00:00 AndroidManifest.xml
896 2009-01-01 00:00 resources.arsc
1536 2009-01-01 00:00 classes.dex
--------- -------
4110 4 files
$ sort-apk.py some.apk sorted.apk
$ unzip -l sorted.apk
Archive: sorted.apk
Length Date Time Name
--------- ---------- ----- ----
1672 2009-01-01 00:00 AndroidManifest.xml
1536 2009-01-01 00:00 classes.dex
6 2017-05-15 11:24 lib/armeabi/fake.so
896 2009-01-01 00:00 resources.arsc
--------- -------
4110 4 files
CLI
NB: you can just use the scripts stand-alone; alternatively, you can install the
repro-apk
Python package and use them as subcommands of repro-apk
.
Installing
From git
NB: this installs the latest development version, not the latest release.
$ git clone https://github.com/obfusk/reproducible-apk-tools.git
$ cd reproducible-apk-tools
$ pip install -e .
NB: you may need to add e.g. ~/.local/bin
to your $PATH
in order
to run repro-apk
.
To update to the latest development version:
$ cd reproducible-apk-tools
$ git pull --rebase
Dependencies
- Python >= 3.8 + click (
repro-apk
package only, the stand-alone scripts have no dependencies besides Python).
Debian/Ubuntu
$ apt install python3-click
License
Project details
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Hashes for repro_apk-0.1.0-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | c4b86bb6fb68736f39ea09a70b30a3c1ddaeff0f6742d2507dde35c493e374dd |
|
MD5 | 0b41f75d4a7f0f0372939234d9ad2a03 |
|
BLAKE2b-256 | 13727c237018a8f1f27c1ce7c8388ce7022d9341893e48fe23ec5e2d5f67aba0 |