Field Notes

entity

Android Package

StatusStableUpdatedStands on1 sourceSupportsnotes

An Android Package (APK) is the file format used to distribute and install applications on Android. It is a ZIP-based archive containing compiled code, resources, assets, and a manifest. Every APK must be digitally signed before Android will install or update it.

Security properties

Android enforces signature continuity: an update installs only if it is signed with the same key as the currently installed app. A valid signature proves integrity in transit and continuity of publisher. It does not prove that the signed APK corresponds to any particular source tree.

That gap is what Source-to-binary correspondence addresses, and it is the axis that separates one distribution channel from another. Android app distribution trust models runs that comparison. A Play Store APK, a GitHub release APK, and an F-Droid reproducible-build APK all carry valid signatures; the difference is whether a user can verify that the binary was built from inspectable source.

Relevance to the wiki

The APK format is the atomic unit of Android trust. Every distribution-channel debate in the wiki’s Android cluster — F-Droid versus Play Store, reproducible builds, signing-key custody — operates on APK files. The format is a technical constant; the trust model that surrounds it is the variable.

Built on 1 source (1 external).

Working out connections…