理解した気になるApplication Signing

2024/01/19 Shibuya.apk#46 で発表した内容です。

https://shibuya-apk.connpass.com/event/305120/

Transcript

1. TIJCVZBBQL
   +VNQFJ
   .BUTVEB
   !SFE@GBU@EBSVNB ͳΜͱͳ͘ɺ
   ͦ͜͸͔ͱͳ͘ɺ
   ͍͍͔Μ͡ʹɺ
   ;Θͬͱɺ
   ཧղͨ͠ؾʹͳΕΔ
   "QQMJDBUJPO
   4JHOJOH 1
2. "OESPJE
   ͷ
   "QQMJDBUJPO
   4JHOJOH
   ͱ͸ w "1,ϑΝΠϧʹॺ໊͢Δ͜ͱɺ·ͨ͸ͦͷॺ໊৘ใͦͷ΋ͷ
   w ॺ໊ͷݕূΛ௨ͯ͠ɺ"1,
   ϑΝΠϧͷ
   *OUFHSJUZ
   Λอূ͢Δ
   w *OUFHSJUZ
   ׬શੑ
   PS
   ੔߹ੑ
   w ͬ͘͟Γݴ͏ͱʮॺ໊ஈ֊͔Βվ͟Μ͞Ε͍ͯͳ͍͜ͱʯ͕෼͔Δ
   w ҟͳΔύοέʔδ໊Ͱ΋ಉ͡ॺ໊͸Ͱ͖Δ͠ɺಉ୺຤ʹΠϯετʔϧ͕Մೳ 2
3. Α͋͘Δޡղ w ❌
   ਖ਼͍͠ॺ໊Ͱ͋Ε͹ͦͷΞϓϦϑΝΠϧ͸҆શͰ͋Δ
   w ❌
   ͦͷॺ໊Λͨ͠ͻͱɾ૊৫ͷ਎ݩ͕อূ͞ΕΔ
   w ❌
   ࠓݱࡏ ݕূ࣌ ɺͦͷॺ໊ͷݩʹͳͬͨ伴͕։ൃݩʹ͓͍ͯ༗ޮͰ͋Δ
   w BOE
   TP
   PO 3
4. 🤯 4
5. *OUFHSJUZ
   ͕อূ͞ΕΔͱԿ͕خ͍͠ͷ w ةݥɾಛݖૢ࡞ʹ͓͍ͯ΋ਪఆͷอূΛ͢Δ͜ͱ͕Ͱ͖Δ
   w ྫ͑͹ΞϓϦͷΠϯετʔϧɾΞοϓσʔτ͸ຆͲͷૢ࡞͕ಛݖૢ࡞
   w ύοέʔδ໊͸໊લۭؒҎ্ͷ৴པੑΛ࣋ͨͳ͍ͷͰҰக͚ͩͰ͸ෆे෼
   w 㱺
   ΑΓ৴པͰ͖ΔԿ͔͕ඞཁ
   w *OUFHSJUZ
   Λߟ͑ͣʹ࣮ݱ͢Δʹ͸
   w ૢ࡞ऀݸਓͷ੹೚ͷ΋ͱɺಛݖΛڐՄ͢Δͱ͍ͬͨૢ࡞͕ඞཁ 5
6. *OUFHSJUZ
   ͕อূ͞ΕΔͱԿ͕خ͍͠ͷ w *OUFHSJUZ
   Λར༻ͨ͠৴པͷ࣮ྫ
   w ҟͳΔͭͷ"1,ϑΝΠϧ͕ಉॺ໊Λ࣋ͭ
   㱺
   ॴ༗ऀͷҰகΛ৴པ
   w ಉύοέʔδ໊Ͱಉॺ໊ͷϑΝΠϧ
   㱺
   ॴ༗ऀʹΑΔΞοϓσʔτͱਪఆ
   w ॴ༗ऀ͕ಉҰͷҟͳΔͭͷΞϓϦ
   㱺
   QFSNJTTJPOΛࣗಈ෇༩
   FUD
   w ͦͷอূͷ͔֬͞΍৘ใྔ૿ՃͳͲʹ͍ͭͯɺվળ͕ॏͶΒΕ͍ͯΔ
   w ೥ݱࡏɺछྨͷॺ໊ํࣜ 4JHOBUVSF
   4DIFNF ͕ଘࡏ͢Δ 6
7. "1,
   4JHOBUVSF
   4DIFNFT w ॺ໊৘ใͷ࢓༷ɾදݱܗࣜ
   w ݱࡏ
   W
   W
   W
   W
   W
   ͷ࢓༷ ࣌ܥྻॱ
   w W
   W
   W
   ͸ಉ͡ઃܭࢥ૝ͷͨΊɺW ͱ΋ݺ͹ΕΔ
   w ݕূͷखॱ΋ͦΕͧΕͰࢦఆ͕͋Δ
   w ͨͩ͠ॺ໊ݕূػߏ͸04࣮૷ʹ͋ΔͷͰɺ࣮ߦ୺຤ʹґଘ͢Δ
   w $54
   ͸͋ΔͷͰɺଟ͘ͷਓʹ͸໰୊͕ͳ͍
   w ڍಈมߋ΍ෆ۩߹౳Ͱ04όʔδϣϯ͝ͱʹएׯڍಈ͕ҟͳΔ͜ͱ΋ 7
8. "1,
   4JHOBUVSF
   4DIFNF
   ͷݕূ֓ཁ w ͦͷ୺຤͕ೝࣝͰ͖Δ࠷େ ͷ
   TDIFNF
   ͔Βॱ൪ʹԼΔܗͰݕূ
   w W
   ͕ෆਖ਼ͳΒ୅ΘΓʹ
   W
   Λݕূ͢Δɾɾɾͱ͸ͳΒͳ͍ 8 https://source.android.com/docs/security/features/apksigning/v4
9. "1,
   4JHOBUVSF
   4DIFNF
   W w +BS
   ͷॺ໊ʹجͮ͘
   "1,
   ޲͚ͷ֦ுํࣜ
   w 㲈
   ;*1
   ϑΝΠϧͱͯ͠ͷॺ໊
   w ηΩϡϦςΟతͳ໰୊ FH
   $7&r ͔Βݱࡏ͸ඇਪ঑
   w վ͟ΜΛݫີʹ๷͛ΔΘ͚Ͱ͸ͳ͍
   FH
   .&5"*/'
   ಺ͷϑΝΠϧ
   w ݕূ࣌ʹ
   VODPNQSFTT
   ͕ඞཁͳͷͰϦεΫɾίετ͕ߴ͍
   w ݱࡏͰ΋"1*
   
   ҎԼͷ୺຤Ͱಈ͔͢ͱ͖͸ඞཁʹͳͬͯ͠·͏
   w .JO
   4%,
   
   Ҏ্΁ͷઃఆΛڧ͘ਪ঑͠·͢ 9
10. "1,
    4JHOBUVSF
    4DIFNF
    WҎ্ڞ௨஌ࣝ w ݱঢ়ͷجૅͰ͋ΓɺWͱ͸શ͘ҟͳΔํࣜ
    w ;*1
    Ͱ͸ͳ͘όΠφϦͱͯ͠ѻ͍ɺϑΝΠϧશମͷอޢ͕Մೳʹ
    w WؚΊɺ֤
    4DIFNF
    ͱ૊Έ߹Θͤ͸ڞଘՄೳ Ұ෦௥Ճཁ݅༗Γ
    w 4DIFNF
    ͝ͱʹఆٛ͞Εͨ*%Λ࣋ͭॺ໊ϒϩοΫΛԼهྖҬʹ௥Ճ͢Δ
    w ͦͷϒϩοΫ*%Λ஌Βͳ͍
    04
    ͸ೝࣝͰ͖ͳ͍ ෆਖ਼ͱ΋ࢥΘͳ͍ 10 https://source.android.com/docs/security/features/apksigning/v2
11. "1,
    4JHOBUVSF
    4DIFNF
    W w ϑΝΠϧશମʹରͯ͠վ͟Μݕ஌͕Ͱ͖ΔΑ͏ʹͳͬͨॳΊͯͷॺ໊ํࣜ
    w "1*
    
    "OESPJE
    /
    ͔Βಋೖ
    w 5BSHFU
    4%,
    
    Ҏ্ͩͱɺ"1*
    
    Ҏ߱ͷ୺຤Ͱඞਢʹ
    w "1*
    
    ҎԼ͸
    W
    ॺ໊͔͠ೝࣝͰ͖ͳ͍఺ʹ஫ҙ
    w Ωʔϩʔςʔγϣϯʹ͸ରԠ͍ͯ͠ͳ͍ 11
12. "1,
    4JHOBUVSF
    4DIFNF
    W w Ωʔϩʔςʔγϣϯ͕ՄೳʹͳͬͨॳΊͯͷॺ໊ํࣜ
    w "1*
    
    "OESPJE
    1
    ͔Βಋೖ
    w ݪଇɺ"1*
    
    ҎԼ༻ʹ
    W
    ॺ໊ ϩʔςʔγϣϯલͷॺ໊ Λ͢Δ
    w Ҏલͷॺ໊΁໭͢ SPMMCBDL ڐՄͳͲͷDBQBCJMJUZͷ؅ཧ΋Ͱ͖Δ
    w ෳ਺伴ʹΑΔॺ໊͸αϙʔτ͍ͯ͠ͳ͍
    w "1*
    
    Ͱෆ۩߹΍ഁյతมߋ͕ೖΔͳͲɺ࢓༷͕ෆ҆ఆʹ 12
13. "1,
    4JHOBUVSF
    4DIFNF
    W w ετϦʔϛϯάରԠΛͨ͠ॳΊͯͷॺ໊ํࣜͰɺݱঢ়͸།Ұ
    w "1*
    
    "OESPJE
    3
    ͔Βಋೖ
    w W
    ͱิ׬తʹಈ࡞͢Δ΋ͷͰɺW
    ͷ७ਮ֦ுͰ͸ͳ͍
    w Wͷॺ໊৘ใ͸ผϑΝΠϧ
    JETJH
    ͱͯ͠อଘ͞ΕΔ
    w "1,αΠζ͕େ͖͘ͳ͍ͱԸܙʹؾ͖ͮͮΒ͍͔΋
    w BEC
    JOTUBMM
    JODSFNFOUBM
    ࣌ʹॺ໊ݕূ͕ૣ͘ऴΘͬͯخ͍͠
    w ·ͨݱࡏɺ(PPHMF
    1MBZ͔ΒΠϯετʔϧ͢Δ৔߹ʹ࢖ΘΕ͍ͯΔ 13
14. "1,
    4JHOBUVSF
    4DIFNF
    W w ೥ݱࡏɺΩʔϩʔςʔγϣϯΛ͢Δ৔߹ͷਪ঑ॺ໊ํࣜ
    w "1*
    
    "OESPJE
    5
    Ͱಋೖ
    w "1*
    
    Ͱద༻͞Εͨ
    W
    ΁ͷվળΛؚΜ֦ͩு
    w ॺ໊ϒϩοΫʹ
    5BSHFU
    "1*
    Λࢦఆग़དྷΔΑ͏ʹͳͬͨ
    w "1*
    ͕࠷৽ͷݱঢ়ͩͱಛஈҙࣝ͠ͳ͍͕ɺࠓޙޮ͍ͯ͘Δ ͸ͣ 14 (API 31, API 32 ͱมߋ͕ೖͬͨͳΒ v3.3 Ͱ͸ɾɾɾ?)
15. ૊Έ߹Θͤʹ͍ͭͯ w ٕज़తʹ͸೚ҙͷ૊Έ߹Θ͕ͤ༗ΓಘΔ
    w ࣮ͨͩ͠༻ੑΛߟྀ͢Δͱ
    .JO
    4%,
    ʹ݁ہҾ͖ͣΒΕΔ
    w ͦͷ
    "1*
    Ϩϕϧ͕৴པ͍ͯ͠Δॺ໊ํ͕ࣜͭͰ΋͋Ε͹
    WBMJE
    ѻ͍ 15 API Ϩϕϧ v1 v2 v3 v3.1 24 28 33
16. ͏ʔΜɾɾɾ w ͦͷΞϓϦͷ։ൃݩͬͯຊ౰ʹ෼͔Βͳ͍ͷ
    w 04͝ͱʹೝࣝͰ͖Δॺ໊ํ͕ࣜҧ͏ͳΒɺݹ͍୺຤͸੬ऑͳͷͰ͸
    w ϩʔςʔγϣϯޙͷ伴Λೝࣝ͢Δ͚ͩ͡Όͪΐͬͱෆ଍ͯ͠ͳ͍
    w લͷ伴Λࣦޮ͍ͤͨ͞Μ͚ͩͲɾɾɾ
    w ͜ͷόʔδϣϯҎ্͸৽͍͠伴͡Όͳ͍ͱΠϯετʔϧͤͨ͘͞ͳ͍Α 16
17. ॺ໊ݕূͱ࿈ಈ͢ΔՁ஋ͷྫ w Πϯετʔϧݩ FH
    (PPHMF
    1MBZ ʹΑΔΞϓϦ഑৴ऀͷ਎ݩอূ
    w 1MBZ
    "QQ
    4JHOJOH
    ʹΑΔ伴ͷ؅ཧ
    w ࠷ऴॺ໊ʹؔΘΔൿີ伴Λ։ൃऀ͕࣋ͭඞཁ͕ͳ͘ͳΔ
    w ϩʔςʔγϣϯʹؔ͢Δ伴৘ใͳͲΛ
    1MBZ
    1SPUFDU
    ΁ఏڙͰ͖Δ
    w 1MBZ
    1SPUFDU
    ʹΑΔΠϯετʔϧલݕূ
    w ݹ͍04Ͱ΋৽͍͠ॺ໊ํࣜͷݕূ΍ࣦޮͨ͠伴ͷڋ൱Λߦ͑Δ
    w ةݥͳΞϓϦΛΠϯετʔϧલʹ஄͘ 17
18. ࣗ෼Ͱ΋ͬͱֶͼ͍ͨ w ࣮ߦதͷ୺຤Ͱ
    1BDLBHF.BOBHFS
    "1*
    Λ࢖͏
    w ͨͩ͠'JSF04
    ͸
    Ұ෦
    "1*
    ͕ద੾ʹಈ࡞͠ͳ͍
    w 04
    ʹ͋Δ
    4JHOBUVSF
    ؔ܎ͷΫϥε͸ษڧ޲͖Ͱ͸ͳ͍
    w FH
    TDIFNF
    WFSTJPO
    ΍
    MJOFBHF
    ͕
    OPOQVCMJD
    "1*
    w CVJME
    UPPMT
    ͷ
    BQLTJHOFS
    Λ࢖͏
    w ΦϓγϣϯΛ͏·͘૊Έ߹Θͤͳ͍ͱॺ໊ํࣜผͷݕূ͕Ͱ͖ͳ͍
    w ΞϓϦݕূΛߦ͏
    7FSJ fi DBUJPO
    4FSWJDF
    "QQ
    Λ࡞Δ
    w 4ZTUFN
    QFSNJTTJPO
    ͳͷͰ໘౗͍͘͞
    
    $54
    ͘Β͍͔͠ࢀߟࢿྉ͸ͳ͍ 18
19. 😇 19
20. ·ͱΊ w "QQMJDBUJPO
    4JHOJOH
    ͸ϑΝΠϧͷ
    *OUFHSJUZ
    Λอূ͢Δ
    w ͦͷੑ࣭Λར༻ͨ͠ػೳ͕͍ͭ͘΋ఏڙ͞Ε͍ͯΔ
    w ৴པੑ޲্΍։ൃऀ΁ͷརศੑͷͨΊɺ৭ʑͳվળ͕Ճ͑ΒΕ͖ͯͨ
    w W
    
    W
    
    W
    
    ௒͑ΒΕͳ͍น
    
    W
    w W
    ͸
    W
    ͱซ༻͢ΔύϑΥʔϚϯεվળ༻్
    w ݪଇɺ1MBZ
    "QQ
    4JHOJOH
    Λ࢖͑͹ҙࣝ͠ͳͯ͘ࡁΉ
    w ೉ͦ͠͏ͳΒ.JO
    4%,
    
    WରԠόʔδϣϯ
    ʹ͠Α͏ 20
21. 3FGFSFODFT w IUUQTFOHJOFFSJOHMJOFDPSQDPNKBCMPHBJSHPBQLTJHOJOH
    w IUUQTTPVSDFBOESPJEDPNEPDTTFDVSJUZGFBUVSFTBQLTJHOJOH
    w IUUQTTVQQPSUHPPHMFDPNHPPHMFQMBZBOESPJEEFWFMPQFSBOTXFS  IMFO 21