Hacker News new | ask | show | jobs
by tgsovlerkhgsel 1870 days ago
A good workaround could be that you sign a manifest containing all the files and a version number, and Google signs the APK.

(The version number prevents mix-and-match attacks where e.g. an old vulnerable file is reused in a new APK.)