Installation validates the package, not brand authorization
Android verifies APK structure and signature consistency. After changing DEX, resources, or the manifest, an attacker can sign the result with another certificate and create a technically complete package.
System acceptance does not grant an official publishing identity. Installation checks do not decide whether the channel is legitimate, an account may sign in, or a high-risk API request should proceed.
Re-signing breaks official upgrade continuity
An in-place upgrade normally requires signing continuity. A package signed by another certificate cannot simply replace the official installation and may require a changed package name, uninstall, or separate installation.
Test both clean installation and upgrade from the production version. Testing only the install screen misses signing continuity, retained data, and channel configuration.
- Approved certificate digest
- Upgrade from the production version
- Legal package and version set
- Channel changes before final signing
Turn client signals into a server decision
A client can present package, version, signing, and platform integrity signals, but they are not absolute truth. High-risk operations should be decided server-side with account, legal version, device risk, and request behavior context.
The policy also needs rollout, false-positive handling, and emergency recovery. If the server ignores version and signing identity, client protection cannot stop a modified package from calling real business APIs.
Make the final APK uniquely traceable
Record build source, package name, version, signing certificate digest, file digest, and channel order for every candidate. Static checks, installation, upgrade, and business regression must refer to the same file identity.
A rebuild, re-sign, or channel modification creates a new candidate. It must return to validation instead of inheriting the conclusion of another file.
- Reproducible final file digest
- Consistent release certificate
- Fixed channel order
- Regression bound to one file
Apply the guidance to a real application
Provide the stack, critical paths, target systems, and current candidate so Yudun can recommend a focused protection and compatibility review.