androidgoogle-playandroid-app-bundlebinary-reproducibility

How to compare google-generated apks with appbundle


I published my first android App in the play store. Since google manages the signing keys, I need to rely on google to publish my app and not modify it. To verify my package, I downloaded all the distributed APKs, extracted them and tried to compare them to my original uploaded appbundle file. A lot of the files differ and I don't know why.

Is there a way to easily compare these archives or to reproduce the steps google took to modify the files?

Edit: I had a deeper look and basically the files are now at different places. E.g the playstore moved all property files from base/root to base, the base/dex/classes.dex to base/classes.dex, base/root/kotlin to base/kotlin. All .xml files changed (probably compressed).

Keep also in mind to extract apks for all architectures and all resolutions to compare all files.

Thank you


Solution

  • Google Play uses bundletool to generate the APKs from the App Bundle. The tool is open-source at https://github.com/google/bundletool so you could check the code to see what is done or you can simply download the tool and run it yourself (although I'd expect the APKs to be the same than the ones you downloaded from the Play Console).

    It would be good to clarify also what files differ and how you measured the difference. For example, the AndroidManifest.xml file is not in the same format in the AAB and in the APK, so the bytes and the size would be obviously quite different, but it doesn't mean that the "content" has necessarily changed.