There are two possibilities here: Malice or Incompetence. We'll take Hanlon's razor and assume Incompetence, but it is gross incompetence. It is unacceptable.
> It changes from "We guarantee we will distribute your app unmodified" to ... well, I don't know what you are promising, but it's not that.
The closest analogy would be a universe in which UPS insists you delegate the packaging of your product to them. Your product remains unchanged, but it's packaged with UPS's packaging which (for the sake of this example) may come with better assurance guarantees relative to your own packaging of the product you're shipping.
Point being: (edit: assuming no malicious supply chain interference; I'll get to this) the app is unmodified. Even with Google doing the signing.
I don't inherently see anything wrong with this, though I also don't think any physical carriers have tried this. Anyone have any examples? Even from other subdomains within logistics?
---
Edit: with supply chain interference (compromising build pipelines, etc), who signs the app doesn't really matter; the app is still tampered before it gets to Google's marketplace. The trade with Google compelling their own signing infrastructure is that it reduces the risk of compromised keys for individual development shops enabling malicious actors to sign builds on behalf of the developers.
---
Edit 2: Some pretty great answers and counterpoints here, such as FBA and the resulting uptick in counterfeit goods. Unexpected but good food for thought.
Which to drive it home, if Bob included a signed photo with each of his items I would know if I got the item from Bob or someone else.
It is fraud in two ways: It misrepresents the seller, and it misrepresent the origin.
That it misrepresents the seller is simple: You don't know who provided you the inventory that Amazon is shipping you. You will often get inventory provided by company B when you receipt says company C. When and if you get a defective product, you have a legal case for compensation against company C, but when they didn't provide the product in the first place (company B did), the waters get muddied. You still have a legal case against company C (They're the seller of record, and you got a faulty product). Company C has a legal case against Amazon (they sent a faulty product on behalf of Company C), and Amazon has a legal case against Company B (They were provided a product that was misrepresented)
There's an alternate line of legal reasoning: Make Amazon the seller of record. This cuts the gordian knot quite nicely, but Amazon has repeatedly rejected it, because:
Sending you commingled product is fraud when the product is not represented correctly: When you buy a "Genuine Apple Charger" and you get a cheap piece of junk in similar packaging, you are being defrauded. Whenever Amazon commingles a non-genuine product with a genuine product and sends it on to the consumer, that's fraud.
This is a legal monty-hall problem. If you lay it all out and examine all of the branches individually, it is quite clear: At some point down each of the lines, Amazon has committed fraud. Either fraud against the consumer, or fraud against it's partners, but regardless: Harm has been done to the consumer and that harm was introduced by Amazon. The harm was introduced when Amazon bucketed the faulty products with the non-faulty products, and thereby destroyed the chain of custody of where it came from. IFF Amazon took careful notes and marked each item with it's origin, then they could pass the blame on to Company B (Where it really belongs), but they didn't, and as such are liable for Company B's misdeeds that they have laundered.
Problem: you have no way to prove it. Nobody can prove it.
That’s what developer signing proves - that is hasn't been modified.
The difference is that you used to be able to verify that Google didn’t modify the app. They simply couldn’t make a change while keeping the signature intact.
Now they can, they just say they won’t and expect you to trust their word.
In theory this can be verified by the developer though? Signing an app shouldn't (I haven't checked this in Google's case) change any integrity values for the app code itself, so the developer (though no one else) is still able to ensure Google wouldn't have tampered anything.
But your point makes sense.
So it is working as intended if what is installed on some device is not what the Dev built.
There are other models that Google could adopt to allow this functionality. Google could come up with a new app format whereupon there were a signed manifest of files, and Google could selectively leave some out (Git does something very similar: The commit includes a map of filenames to cryptographically-secure object IDs, which may be in one of many different packfiles). This would allow Google to strip the assets that are unnecessary for your device, while still giving the Developer control over what's shipped.
But more importantly: This is about control. Currently there's a nice check-and-balance system. The developer signs the package, and Google inspects and can choose not to distribute it. The new system gives all the control to Google; They sign, they distribute. This may have been effectively where the system was before, because only a sparse minority of users checked the developer keys directly, but there's a big leap between the trust being defacto with Google (because people trust them and don't check), and that trust being completely with Google (because there's no way to check, Google holds all the keys).
I do trust Google to distribute my app. I trust them where I can check their work. I trust them because I can check their work. I know there would be outrage if they started distributing things that were not what I signed. This is that outrage.
I used to do J2ME app development back in the day. It wasn’t unusual for our apps to have 200+ builds. These weren’t just different assets, they also included workarounds for device specific bugs (j2me phones were buggy as hell, especially Samsung phones). In some cases we even had multiple builds for one phone, because carriers liked messing with the firmware. Vodafone was notorious for this.
When Android and iOS took over we finally could leave that behind, at least for a while, then Android started fragmenting like crazy and now we’re almost back to square one.
I think you are underestimating the number of versions.
And why would developers want to do this? This adds a huge pain in the ass to all deployments.
> Google could come up with a new app format whereupon there were a signed manifest of files
They could. But this wouldn't be backwards compatible. So you are stuck waiting like eight years for the ecosystem to all adopt the new OS versions.
This is true and "too cumbersome" is worth expanding on. Without specific targeting what is delivered to the device, 100s of MB of storage can be wasted after the APK is uncompressed. The data that is unused can't be deleted but is unusable or unneeded on that device.
When specifically targeting a single device you have multiple axes to target:
* 4 native CPU architectures: [x86, x86_64, armeabi-v7a, arm64-v8a]
* resource DPIs: [ldpi, mdpi, hdpi, xhdpi, xxhdpi]
* 6+ SDK targetSdks with meaningful feature variances (basically potential features enabled/disable every year for the last 7-8 years).
* 80+ individual languages
If the goal is to exactly match the device/user in question, you'd need to generate and apply appropriate versionCodes for: 4 * 7 * 6 * 80 = 13440 individually, versioned, signed and uploaded APKs.
Of additional note, the versionCodes must be precisely ordered to ensure the right version is selected. A device will get the highest version which is compatible with the device. So if an x86 version is higher than x86_64 a 64 bit device that can handle both will still get the x86 instead of the x86_64 version. Same goes for DPI ordering and SDK ordering.
Think the worry is google (and perhaps certain US agencies) will use this new requirement to do essentially the same approach with certain apps.