app-info 3.4.0 → 3.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8240bf7236451c5971d0ee28d067689605f6470b0f64cd3ff21d54f3dac415c7
-  data.tar.gz: bb88f65d0f66be67b0f94ddfa4d1061346b974b1974eb36b7be7c2fbe8be3c73
+  metadata.gz: 8741e1605402e8fc7436eaca068ad3de7a2c7006a98759cf02e57427aaa33ac8
+  data.tar.gz: 9dcb7617f9c02ebff05e138ac2959a294b107e6fbf97c378a2ec7a1d5be65a52
 SHA512:
-  metadata.gz: 9bea1da034bd88f84768c0d899cf5b03d4bc746e90fc1252d55e01d9006095287c83b23f3e5e865fb97386eb49d659f4ac475c8812c04bad30b39ee4b7a78f5a
-  data.tar.gz: 7ffeba0577eefc612f8963fd85005ecc763df7bf03f368807276a5537d00902e2ed2ce48da4297c331cc2b688c5e56024716c8a8ecf9fdbdc08f7167b1f809b2
+  metadata.gz: ee7e70a2f9cdf8fd167e166cf3ed97e69813a6f4afcd008f5749235e2f1197570761acf49d2be5bd6dfde0007a570faec8af200776687a50a1705afd64d768f4
+  data.tar.gz: b7b816b5efbc6c54f77ec7098dc597136c9a88e0142e0e1f3b5cb08ed7805e15bc26d98fbd04bd149e3a1e7df98c9c5f959c72d7334337ea78cef022eeeb6377

data/CHANGELOG.md

@@ -9,6 +9,12 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 > List all changes before release a new version.
 
+## [3.4.1] (2026-10-31)
+
+### Fixed
+
+- Fix APK Signature Scheme v2/v3 verification falsely reports `content_digest_mismatch` when the signing block contains Android verity digest algorithms (`0x0421`/`0x0423`/`0x0425`). Those digest records are now skipped because the plain SHA-256 content digest cannot verify them without the Android verity tree digest.
+
 ## [3.4.0] (2026-09-27)
 
 ### Added

data/README.md

@@ -522,9 +522,9 @@ It is possible to use this gem as a command line interface to parse mobile app:
 ```
 > app-info
 
-app-info (3.4.0)> p = AppInfo.parse('/path/to/app')
+app-info (3.4.1)> p = AppInfo.parse('/path/to/app')
 => #<AppInfo::APK::......>
-app-info (3.4.0)> p.name
+app-info (3.4.1)> p.name
 => "AppName"
 ```
 

data/lib/app_info/helper/signatures.rb

@@ -91,6 +91,12 @@ module AppInfo::Helper
         max_bytes: AppInfo::Android::Signature::UINT64_SIZE
       ) do |digest|
         algorithm = digest.read(AppInfo::Android::Signature::UINT32_SIZE).unpack('C*')
+        if verity_algorithm?(algorithm)
+          logger.debug "Skip verity content digest algorithm 0x#{algorithm.pack('C*').unpack1('H*')} " \
+                       'because its digest can not be verified without Android verity tree digest'
+          next
+        end
+
         digest_name = algorithm_match(algorithm)
         next unless digest_name
 
@@ -150,6 +156,12 @@ module AppInfo::Helper
         logger: logger
       ) do |signature|
         algorithm = signature.read(AppInfo::Android::Signature::UINT32_SIZE).unpack('C*')
+        if verity_algorithm?(algorithm)
+          logger.debug "Skip verity signature algorithm 0x#{algorithm.pack('C*').unpack1('H*')} " \
+                       'because its content digest can not be verified without Android verity tree digest'
+          next
+        end
+
         digest = algorithm_match(algorithm)
         next unless digest
 
@@ -182,6 +194,16 @@ module AppInfo::Helper
     SIG_STRIPPING_PROTECTION_ATTR_ID = [0x0d, 0xf0, 0xef, 0xbe].freeze       # 0xbeeff00d
     SIG_PROOF_OF_ROTATION_ATTR_ID = [0x8c, 0x6f, 0xa0, 0x3b].freeze # 0x3ba06f8c
 
+    # Verity digest algorithms. Their digest records are 40 bytes long
+    # (32 bytes digest + 8 bytes file size) and can NOT be verified against
+    # the plain SHA-256 content digest computed over the file. Skipping them
+    # keeps the signer verification on standard algorithm records.
+    SIG_VERITY_ALGORITHMS = [
+      SIG_VERITY_RSA_PKCS1_V1_5_WITH_SHA256,
+      SIG_VERITY_ECDSA_WITH_SHA256,
+      SIG_VERITY_DSA_WITH_SHA256
+    ].freeze
+
     def best_algorithem(algorithems)
       algorithems.max_by { |algorithem| algorithem_priority(algorithem[:id]) || -1 }
     end
@@ -195,6 +217,10 @@ module AppInfo::Helper
       end
     end
 
+    def verity_algorithm?(algorithm)
+      SIG_VERITY_ALGORITHMS.include?(algorithm)
+    end
+
     def algorithem_priority(algorithm)
       case algorithm
       when SIG_RSA_PSS_WITH_SHA256,

data/lib/app_info/png_uncrush.rb

@@ -111,7 +111,6 @@ module AppInfo
 
     def _dump_sections(dimensions: false)
       pos = @io.header.size
-      optimized = false
       [].tap do |sections|
         while pos < @io.size
           type = @io[pos + 4, 4]
@@ -120,10 +119,7 @@ module AppInfo
           crc = @io[pos + 8 + length, 4].unpack1('N')
           pos += length + 12
 
-          if type == 'CgBI'
-            optimized = true
-            next
-          end
+          next if type == 'CgBI'
 
           if type == 'IHDR'
             width = data[0, 4].unpack1('N')

data/lib/app_info/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module AppInfo
-  VERSION = '3.4.0'
+  VERSION = '3.4.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: app-info
 version: !ruby/object:Gem::Version
-  version: 3.4.0
+  version: 3.4.1
 platform: ruby
 authors:
 - icyleaf
@@ -227,6 +227,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '10.0'
+- !ruby/object:Gem::Dependency
+  name: logger
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: Teardown tool for ipa, apk, aab, hap mobile files and Windows, macOS
   and dSYM file, even support for info.plist and .mobileprovision files
 email:
@@ -320,7 +334,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Teardown tool for all most app, analysis metedata like version, name, icon
 test_files: []