AppVerifier shows sandboxed Google Play Services (& Framework) as non-genuine

wagg3r

Hey all, going through the process of setting up GOS to suit what I need and I noticed that Google Play Services and Google Services Framework are both showing in AppVerifier as failing the check against the database. I'm sure I checked it all last week and everything was fine. Is this because of a version mismatch that didn't get to Graphene yet? Anything to worry about?

Thanks in advance for the help!

GrapheneOS

wagg3r It's wrong, the App Verifier database is out-of-date and missing the Android 15 signing keys for these.

soupslurpr

wagg3r what version of Google Play Services and Google Services Framework are you on? You can check this from App Store.

Dumdum

GrapheneOS
Why does it show 2 signatures for both apps? I feel like that shouldn't be happening, since any other app only has one hash?

The signatures are:
F0:FD:6C:5B:41:0F:25:CB:25:C3:B5:33:46:C8:97:2F:AE:30:F8:EE:74:11:DF:91:04:80:AD:6B:2D:60:DB:83
and
7C:E8:3C:1B:71:F3:D5:72:FE:D0:4C:8D:40:C5:CB:10:FF:75:E6:D8:7D:9D:F6:FB:D5:3F:04:68:C2:90:50:53

wagg3r

GrapheneOS Thanks very much, glad to hear!

DeletedUser5

What if App Verifier does not have any data regardless of the Android Version? How do verify apps then? If it's not in the database, can I get it elsewhere for each app?

wagg3r

DeletedUser5 You need to find the signing key for the apk you are installing. Most of the time you can find it on the app website or something like that.

FOSSOS

soupslurpr a month later it still says Failure for me in AppVerifier. I'm on on GOS 2024112700 with AppVerifier 0.8.1 version code 11 from Accrescent.
It gives two hashes for GSF

com.google.android.gsf
F0:FD:6C:5B:41:0F:25:CB:25:C3:B5:33:46:C8:97:2F:AE:30:F8:EE:74:11:DF:91:04:80:AD:6B:2D:60:DB:83
7C:E8:3C:1B:71:F3:D5:72:FE:D0:4C:8D:40:C5:CB:10:FF:75:E6:D8:7D:9D:F6:FB:D5:3F:04:68:C2:90:50:53

These are the same hashes Dumdum has and they show as Failure in AppVerifier on Android 15 that has Google Play Services 24.44.43 installed from the GOS App store.

soupslurpr

Also, are you on AppVerifier 0.8.1? That release updated the Google Play Services and Google Services Framework hashes.

Dumdum

soupslurpr are you on AppVerifier 0.8.1?

I am. It still fails to match (and shows two hashes as I mentioned above).

soupslurpr

Dumdum what Google Play Services and Google Services Framework versions are you on?

Dumdum

soupslurpr
Google Play services 24.41.34
Google Services Framework 14

soupslurpr

Dumdum weird, I'm also on 24.41.34 and it has 3 hashes, as expected since they rotated the key.

com.google.android.gms
F0:FD:6C:5B:41:0F:25:CB:25:C3:B5:33:46:C8:97:2F:AE:30:F8:EE:74:11:DF:91:04:80:AD:6B:2D:60:DB:83
7C:E8:3C:1B:71:F3:D5:72:FE:D0:4C:8D:40:C5:CB:10:FF:75:E6:D8:7D:9D:F6:FB:D5:3F:04:68:C2:90:50:53
5F:23:91:27:7B:1D:BD:48:90:00:46:7E:4C:2F:A6:AF:80:24:30:08:04:57:DC:E2:F6:18:99:2E:9D:FB:54:02

soupslurpr

Dumdum what build number of GrapheneOS are you on? The issue must be that the Android 14 and older variant hasn't rotated the keys, while Android 15 and above has.

Dumdum

soupslurpr
2024101200 (aka Android 14)

soupslurpr

So it's most likely that since I'm on an Android 15 build

Audacity0780

Seems to be fixed in this commit: https://github.com/soupslurpr/AppVerifier/commit/b3131fdcb1f421bb28a8f3e1c32e24d295ea5006