bundletool helps evaluate Android distribution packages against device conditions. Security tests should cover actual installation structures as well as a universal APK.
Evaluation approach
It supports APK-set generation and package evaluation from bundles. Signing settings and device specifications affect the output.
Application example
Generate packages for varied device configurations from a protected AAB and verify that critical libraries are present.
Limits and considerations
Do not assume locally generated packages match store distribution in every detail.
Inspect the components delivered to users
Generating installation outputs for particular device configurations helps establish distribution scope. Language, screen and architecture choices may change package composition. Record the representative device conditions.
Verify that the module containing a security control is actually installed. Test conditional and later-delivered features separately. Account for signing and distribution differences between local packages and store-installed releases.
Checks and decisions
- Record device specifications
- Separate signing settings
- Check actual distribution
Use bundletool to make the path to the end-user package visible.
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.