1

I'm wondering if a chrome app I upload to the Chrome Webstore could potentially be manipulated (even by Google itself) without users downloading the app noticing it.

I just downloaded a packaged app to check if I can inspect its source code but it didn't allow me to. Is this true for all apps? If the source is hidden, how can I make sure that the app is in its original state?

Edit: I'm not asking about a chrome extension. I know that those can be signed.

2

The packages are signed, any modification of the package would cause the signature to be invalid.

Only you the app creator has access to the private key file so no other person could modify your file then re-sign it either. In fact if you loose your private key file you can't distribute updates to your extension because extensions will only update from packages signed with the same private key it was originally built with.

  • This answer is about extensions, but I was asking about packaged apps. There is no mention of code signing in Google's docs for publishing packaged apps: developer.chrome.com/webstore/publish – Nico Feb 8 '15 at 9:02
  • @Nico All app types have a manifest file. See the key attribute in the "Details: The manifest" on the hosted apps page. – Scott Chamberlain Feb 8 '15 at 16:23
  • I don't see any info about if that field can be used for packaged apps. developer.chrome.com/webstore/publish doesn't mention needing to generate a cert and crx file as with chrome extensions. I don't see any info from Google if code signing is supported for packaged apps. That's why I'm asking here. – Nico Feb 8 '15 at 18:43
  • Does anyone have any confirmation on this? Can packaged apps (NOT chrome extensions) be signed? Links? – Nico Feb 14 '15 at 12:06
1

Just to add, if you are using an SDK or third party libs, then those pieces can change and inject unwanted software in "your" app. That has been the recent case for some Android apps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.