[Bug] Signature verification V3 is not disabled

[kiber-io]

What happened/什么情况

When trying to install a modifying application that had a V3 signature an installation failure message appears:

Failure [INSTALL_PARSE_FAILED_NO_CERTIFICATES: Failed to collect certificates from /data/app/vmdl735001179.tmp/base.apk using APK Signature Scheme v3: APK content size did not verify]

LSPosed version/LSPosed 版本

1.9.2 (7024)

Android version/Android 版本

13

Version of Core Patch/核心破解版本

4.5

Logs/日志

LSPosed_2024-03-22T12_33_04.087589.zip

Module settings screenshot/模块设置截图

[Kyr4l]

This also happens on android 12

[alryaz]

Confirming this issue, A15, Neoteric, Ishtar. Same exact one.

Magisk Kitsune + LSPosed are used. Hide is enabled, SUList is enabled.

[squaredfe]

Also confirming this issue, Android 15, Magisk V28.1, ZygiskNext V1.2.9 using CorePatch 4.7

Device: Redmi 23053RN02A | MIUI | Android 15 | Using FilterApkSource ApkSource implementation |

pm install-commit 380641479 Exit code: 1 Out: Failure [INSTALL_PARSE_FAILED_NO_CERTIFICATES: Failed to collect certificates from /data/app/vmdl380641479.tmp/0.apk using APK Signature Scheme v3: SHA-256 digest of contents did not verify] 

[UsubaShihori]

Confirming this issue, A15, Realme UI6.0
KernelSU + LSPosed 1.9.2-it(7394)

[kiber-io]

I tried to fix this issue (now only for a13+), you can test it with this release (note: it has a different signature from the original apk)

[vt220]

From a changelog for v4.8 it seems that a fix for this issue is included in that release, but I nonetheless still get the error:

adb: failed to install YouTube-20.14.43.apk: Failure [INSTALL_PARSE_FAILED_NO_CERTIFICATES: Failed to collect certificates from /data/app/vmdl836741543.tmp/base.apk using APK Signature Scheme v3: Failed to parse/verify signer #0 block: SHA256withRSA signature did not verify]
Android 15 (ColorOS), Magisk 30.6, ReZygisk 1.0.0-rc.4, LSPosed 1.10.1(7182), CorePatch 4.8

[rubenvereecken]

For anyone else running into this problem, I had a quick look at the CorePatch source and it looks like it roughly works this way:

1. Force v2/v3 verification down to v1
2. Patch v1 verification

My apk doesn't have a v1 signature, as I assume is increasingly common, so it still fails for me, as there's no valid fallback. Worth trying to add a v1 signature if you can to work around this.

I'm taking a look at patching v3 signature verification.

[rubenvereecken]

I've written a full v3 scheme patch that works for me and solves INSTALL_PARSE_FAILED_NO_CERTIFICATES.

For those interested, working branch in #145. Debug APK here.