github-starred/android
2
0
Fork 0
mirror of https://github.com/bitwarden/android.git synced 2026-03-21 13:52:07 -05:00
Code Issues 144 Packages Projects Releases 116 Wiki Activity

APKs using deprecated MD5 signature #107

New Issue
Closed
opened 2025-11-07 08:26:34 -06:00 by GiteaMirror · 18 comments
GiteaMirror commented 2025-11-07 08:26:34 -06:00
Owner
Copy Link

Originally created by @IzzySoft on GitHub (Nov 1, 2017).

Just a note: your APKs are still signed using MD5, which is deprecated.

ERROR: JAR signer BITWARDE.RSA: Failed to verify JAR signature META-INF/BITWARDE.RSA against META-INF/BITWARDE.SF: java.security.SignatureException: Algorithm constraints check failed on disabled algorithm: MD5.

As you know, deprecated soon might mean unsupported – so you might wish to act on this 😉

Originally created by @IzzySoft on GitHub (Nov 1, 2017). Just a note: your APKs are still signed using MD5, which is deprecated. ERROR: JAR signer BITWARDE.RSA: Failed to verify JAR signature META-INF/BITWARDE.RSA against META-INF/BITWARDE.SF: java.security.SignatureException: Algorithm constraints check failed on disabled algorithm: MD5. As you know, deprecated soon might mean unsupported – so you might wish to act on this :wink:
GiteaMirror commented 2025-11-07 08:26:35 -06:00
Author
Owner
Copy Link

@kspearrin commented on GitHub (Nov 1, 2017):

Not sure where this setting is. I'm not aware of anywhere we are explicitly setting md5. Will have to investigate more.

@kspearrin commented on GitHub (Nov 1, 2017): Not sure where this setting is. I'm not aware of anywhere we are explicitly setting md5. Will have to investigate more.
GiteaMirror commented 2025-11-07 08:26:35 -06:00
Author
Owner
Copy Link

@IzzySoft commented on GitHub (Nov 1, 2017):

Sorry that I cannot be more helpful. I'm just running a repo, I'm no Android dev …

@IzzySoft commented on GitHub (Nov 1, 2017): Sorry that I cannot be more helpful. I'm just running a repo, I'm no Android dev …
GiteaMirror commented 2025-11-07 08:26:35 -06:00
Author
Owner
Copy Link

@IzzySoft commented on GitHub (Nov 1, 2017):

Pointer: It's probably your signing key (linking you there so you maybe can exchange helpful findings).

@IzzySoft commented on GitHub (Nov 1, 2017): Pointer: [It's probably your signing key](https://github.com/zxing/zxing/issues/900#issuecomment-341115661) (linking you there so you maybe can exchange helpful findings).
GiteaMirror commented 2025-11-07 08:26:35 -06:00
Author
Owner
Copy Link

@kspearrin commented on GitHub (Nov 1, 2017):

Thanks, I'll watch that issue for a possible fix.

@kspearrin commented on GitHub (Nov 1, 2017): Thanks, I'll watch that issue for a possible fix.
GiteaMirror commented 2025-11-07 08:26:36 -06:00
Author
Owner
Copy Link

@IzzySoft commented on GitHub (Nov 1, 2017):

If you happen to find a solution first, Sean certainly would be happy to know as well. Quoting him on that key issue:

That said I don't know, can it be changed?

ie. the current show-stopper for him is the question how to update the signing key accordingly. If you know an answer to that … 😉

@IzzySoft commented on GitHub (Nov 1, 2017): If you happen to find a solution first, Sean certainly would be happy to know as well. Quoting him on that key issue: > That said I don't know, can it be changed? ie. the current show-stopper for him is the question how to update the signing key accordingly. If you know an answer to that … :wink:
GiteaMirror commented 2025-11-07 08:26:36 -06:00
Author
Owner
Copy Link

@IzzySoft commented on GitHub (Dec 11, 2017):

@kspearrin update: at least one other project successfully solved the issue: AdGuard (see here). Their solution might apply to Bitwarden as well. Quoting:

The solution was clearly one of the:

  • Transition from Maven to Gradle build system.
  • Update of Android SDK and build tools.

But no change in certificates and keys was made.

Worth a look I'd say (a quick glance informs me you're not using Gradle, so it might apply).

@IzzySoft commented on GitHub (Dec 11, 2017): @kspearrin update: at least one other project successfully solved the issue: AdGuard (see [here](https://github.com/AdguardTeam/AdguardForAndroid/issues/1575#issuecomment-350717523)). Their solution might apply to Bitwarden as well. Quoting: > The solution was clearly one of the: > >* Transition from Maven to Gradle build system. >* Update of Android SDK and build tools. > > But no change in certificates and keys was made. Worth a look I'd say (a quick glance informs me you're not using Gradle, so it might apply).
GiteaMirror commented 2025-11-07 08:26:36 -06:00
Author
Owner
Copy Link

@kspearrin commented on GitHub (Jan 10, 2018):

@IzzySoft We use Xamarin, which is a completely different way of building Android apps (with C#) so using something like Gradle is not possible. We are using the latest Android SDK tools already though. Not sure how else we could resolve this. We could use a new signing key for FDroid since it is not being distributed there yet but I am not even sure where the option of dropping MD5 in that process is.

@kspearrin commented on GitHub (Jan 10, 2018): @IzzySoft We use Xamarin, which is a completely different way of building Android apps (with C#) so using something like Gradle is not possible. We are using the latest Android SDK tools already though. Not sure how else we could resolve this. We could use a new signing key for FDroid since it is not being distributed there yet but I am not even sure where the option of dropping MD5 in that process is.
GiteaMirror commented 2025-11-07 08:26:36 -06:00
Author
Owner
Copy Link

@kspearrin commented on GitHub (Jan 10, 2018):

Running keytool on the APK shows SHA256withRSA is the signing algorithm. Where is this MD5 reference coming from? We see it listed in the fingerprints here, but thats just a fingerprint hash, not what is used to sign.

$ keytool -printcert -file BITWARDE.RSA
Valid from: Fri Aug 26 22:57:00 EDT 2016 until: Tue Jan 12 21:57:00 EST 2044
Certificate fingerprints:
         MD5:  BE:9E:C3:1A:F7:2B:4E:1B:0F:69:A0:7D:4C:60:EC:BD
         SHA1: 75:41:85:CD:4C:DF:DE:59:87:48:B0:43:04:8B:FE:59:A1:72:64:C2
         SHA256: 24:E0:6C:04:C2:08:04:8F:19:F1:C9:93:B4:DD:A4:43:0E:A8:B0:6D:B8:37:5E:A0:E3:7B:83:46:96:B9:AC:3A
Signature algorithm name: SHA256withRSA
Subject Public Key Algorithm: 2048-bit RSA key
Version: 3
@kspearrin commented on GitHub (Jan 10, 2018): Running keytool on the APK shows `SHA256withRSA` is the signing algorithm. Where is this MD5 reference coming from? We see it listed in the fingerprints here, but thats just a fingerprint hash, not what is used to sign. ``` $ keytool -printcert -file BITWARDE.RSA Valid from: Fri Aug 26 22:57:00 EDT 2016 until: Tue Jan 12 21:57:00 EST 2044 Certificate fingerprints: MD5: BE:9E:C3:1A:F7:2B:4E:1B:0F:69:A0:7D:4C:60:EC:BD SHA1: 75:41:85:CD:4C:DF:DE:59:87:48:B0:43:04:8B:FE:59:A1:72:64:C2 SHA256: 24:E0:6C:04:C2:08:04:8F:19:F1:C9:93:B4:DD:A4:43:0E:A8:B0:6D:B8:37:5E:A0:E3:7B:83:46:96:B9:AC:3A Signature algorithm name: SHA256withRSA Subject Public Key Algorithm: 2048-bit RSA key Version: 3 ```
GiteaMirror commented 2025-11-07 08:26:37 -06:00
Author
Owner
Copy Link

@anortiz08 commented on GitHub (Jan 10, 2018):

@kspearrin See this post which discusses the root cause: https://forums.xamarin.com/discussion/101114/visual-studio-build-jarsigner-algorithm

@anortiz08 commented on GitHub (Jan 10, 2018): @kspearrin See this post which discusses the root cause: https://forums.xamarin.com/discussion/101114/visual-studio-build-jarsigner-algorithm
GiteaMirror commented 2025-11-07 08:26:37 -06:00
Author
Owner
Copy Link

@kspearrin commented on GitHub (Jan 10, 2018):

@anortiz08 Awesome. Thanks for that. Looks like a Xamarin issue then. I can confirm our build output is using -sigalg md5withRSA:

  C:\Program Files\Java\jdk1.8.0\\bin\jarsigner.exe -keystore 8bit.keystore -storepass ***** -keypass ***** -digestalg SHA1 -sigalg md5withRSA -signedjar bin\FDroid\\com.x8bit.bitwarden-Signed-Unaligned.apk C:\projects\mobile\src\Android\obj\FDroid\android\bin\com.x8bit.bitwarden.apk bitwarden

According to that post they are suppose to be switching to apksigner which will support SHA256withRSA. Looks like the change has already landed but not sure if it is live in latest Xamarin.Android/VS version. Need to investigate more.

@kspearrin commented on GitHub (Jan 10, 2018): @anortiz08 Awesome. Thanks for that. Looks like a Xamarin issue then. I can confirm [our build output](https://ci.appveyor.com/project/bitwarden/mobile) is using `-sigalg md5withRSA`: ``` C:\Program Files\Java\jdk1.8.0\\bin\jarsigner.exe -keystore 8bit.keystore -storepass ***** -keypass ***** -digestalg SHA1 -sigalg md5withRSA -signedjar bin\FDroid\\com.x8bit.bitwarden-Signed-Unaligned.apk C:\projects\mobile\src\Android\obj\FDroid\android\bin\com.x8bit.bitwarden.apk bitwarden ``` According to that post they are suppose to be switching to apksigner which will support `SHA256withRSA`. Looks like the change has already landed but not sure if it is live in latest Xamarin.Android/VS version. Need to investigate more.
GiteaMirror commented 2025-11-07 08:26:37 -06:00
Author
Owner
Copy Link

@kspearrin commented on GitHub (Jan 10, 2018):

See https://bugzilla.xamarin.com/show_bug.cgi?id=57914

Target milestone shows 15.6 so hopefully that will be available soon. Current VS is 15.5.

@kspearrin commented on GitHub (Jan 10, 2018): See https://bugzilla.xamarin.com/show_bug.cgi?id=57914 Target milestone shows 15.6 so hopefully that will be available soon. Current VS is 15.5.
GiteaMirror commented 2025-11-07 08:26:37 -06:00
Author
Owner
Copy Link

@kspearrin commented on GitHub (Mar 12, 2018):

15.6 is now out. Could you check the latest dev builds here again? https://ci.appveyor.com/project/bitwarden/mobile/build/1370/artifacts

@kspearrin commented on GitHub (Mar 12, 2018): 15.6 is now out. Could you check the latest dev builds here again? https://ci.appveyor.com/project/bitwarden/mobile/build/1370/artifacts
GiteaMirror commented 2025-11-07 08:26:38 -06:00
Author
Owner
Copy Link

@IzzySoft commented on GitHub (Mar 12, 2018):

If you meant me, @kspearrin: I'd only do what you could check for yourself: apksigner verify <APKFile> 😉 Apart from that, all that page gives me is:

The build job does not contain any artifacts.

So there's nothing I could check, sorry.

@IzzySoft commented on GitHub (Mar 12, 2018): If you meant me, @kspearrin: I'd only do what you could check for yourself: `apksigner verify <APKFile>` :wink: Apart from that, all that page gives me is: > The build job does not contain any artifacts. So there's nothing I could check, sorry.
GiteaMirror commented 2025-11-07 08:26:38 -06:00
Author
Owner
Copy Link

@kspearrin commented on GitHub (Mar 12, 2018):

I updated the URI. It's at https://ci.appveyor.com/project/bitwarden/mobile/build/1370/artifacts

@kspearrin commented on GitHub (Mar 12, 2018): I updated the URI. It's at https://ci.appveyor.com/project/bitwarden/mobile/build/1370/artifacts
GiteaMirror commented 2025-11-07 08:26:38 -06:00
Author
Owner
Copy Link

@kspearrin commented on GitHub (Mar 12, 2018):

@IzzySoft I am having trouble getting this apksigner util to work on my dev machine. Could you check?

@kspearrin commented on GitHub (Mar 12, 2018): @IzzySoft I am having trouble getting this apksigner util to work on my dev machine. Could you check?
GiteaMirror commented 2025-11-07 08:26:38 -06:00
Author
Owner
Copy Link

@IzzySoft commented on GitHub (Mar 12, 2018):

com.x8bit.bitwarden-1370.apk doesn't provoke any error from apksigner, neither does com.x8bit.bitwarden-fdroid-1370.apk – so it looks fine to me from that point (including this issue seemingly solved).

Still wondering what keeps it from working on your machine; I don't even have a full dev install here (just the very basic binaries in a "fake environment") …

@IzzySoft commented on GitHub (Mar 12, 2018): `com.x8bit.bitwarden-1370.apk` doesn't provoke any error from `apksigner`, neither does `com.x8bit.bitwarden-fdroid-1370.apk` – so it looks fine to me from that point (including this issue seemingly solved). Still wondering what keeps it from working on your machine; I don't even have a full dev install here (just the very basic binaries in a "fake environment") …
GiteaMirror commented 2025-11-07 08:26:38 -06:00
Author
Owner
Copy Link

@kspearrin commented on GitHub (Mar 12, 2018):

I'm on windows, trying to run apksigner.bat verify com.x8bit.bitwarden and it keeps throwing errors about not finding the APK file. I've tried all kinds of file path variations. 😕

Oh well.

Thanks for testing! I will close this issue now.

@kspearrin commented on GitHub (Mar 12, 2018): I'm on windows, trying to run `apksigner.bat verify com.x8bit.bitwarden` and it keeps throwing errors about not finding the APK file. I've tried all kinds of file path variations. 😕 Oh well. Thanks for testing! I will close this issue now.
GiteaMirror commented 2025-11-07 08:26:39 -06:00
Author
Owner
Copy Link

@IzzySoft commented on GitHub (Mar 12, 2018):

Heh! Naturally not. Unless the file name is com.x8bit.bitwarden, which I don't think it is. What I was running (on Linux): apksigner verify com.x8bit.bitwarden-1370.apk (while being in the directory the .apk file is in, and having apksigner in my $PATH).

However that might be: Glad I could help!

@IzzySoft commented on GitHub (Mar 12, 2018): Heh! Naturally not. Unless the ***file*** name is `com.x8bit.bitwarden`, which I don't think it is. What I was running (on Linux): `apksigner verify com.x8bit.bitwarden-1370.apk` (while being in the directory the `.apk` file is in, and having `apksigner` in my `$PATH`). However that might be: Glad I could help!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
app:authenticator
app:password-manager
bug
bug-passkey
customer-support
duplicate
enhancement
good first issue
help wanted
needs-reply
needs-response
pull-request
Mirrored from GitHub Pull Request
 question
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#107
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?