Android

Inspecting Android distribution packages with bundletool

Tools for inspecting packages, source code and binaries.

Analysis tools1 min readEditorial methods

bundletool helps evaluate Android distribution packages against device conditions. Security tests should cover actual installation structures as well as a universal APK.

Evaluation approach

It supports APK-set generation and package evaluation from bundles. Signing settings and device specifications affect the output.

Application example

Generate packages for varied device configurations from a protected AAB and verify that critical libraries are present.

Limits and considerations

Do not assume locally generated packages match store distribution in every detail.

Inspect the components delivered to users

Generating installation outputs for particular device configurations helps establish distribution scope. Language, screen and architecture choices may change package composition. Record the representative device conditions.

Verify that the module containing a security control is actually installed. Test conditional and later-delivered features separately. Account for signing and distribution differences between local packages and store-installed releases.

Checks and decisions

  • Record device specifications
  • Separate signing settings
  • Check actual distribution

Use bundletool to make the path to the end-user package visible.

Sources

The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.