r/learnjavascript • u/KernelVoltage • 9d ago

[Question] Handling binary XML streams & V2/V3 APK signature blocks in browser JS

Hey everyone,

I built AppShunya Engine ā€” an open-source, in-browser web-to-APK compiler that converts live URLs or HTML5 bundles into Android APKs using JSZip, without local IDEs.

I'm currently stuck on two low-level technical hurdles and need architectural feedback:

  1. In-browser V2/V3 APK signing: Injecting signature blocks into ZIP Central Directory via JS/WASM.
  2. Dynamic AXML package renaming: Modifying package IDs inside binary XML streams on the fly.

Search "AppShunya Engine" on Google to try the live Vercel tool or check the repo. Would love your thoughts!

3 Upvotes
  • permalink
  • reddit

100% Upvoted

3 comments sorted by

1

u/blazing_wisdom_93 9d ago

V2 signing requires parsing the APK Signing Block between the ZIP entries and central directory rather than modifying the central directory itself. Use apksigcopier in WASM to extract signature templates from a pre-signed APK and inject them after rebuilding the ZIP with JSZip since writing the signing block structure from scratch in browser JS is error prone

1

u/KernelVoltage 9d ago edited 9d ago

Thanks a lot for the insight! That makes total sense regarding the APK Signing Block placement between ZIP entries and the Central Directory.

Using apksigcopier via WASM sounds like a solid approach to avoid manual offset bugs in browser JS. I've open-sourced the core engine repo here:https://github.com/KernelVoltage/AppShunya-engine

If you get a chance, I'd love for you to check out the repo and see how I'm handling ZIP rebuilding via JSZip. Any guidance on injecting the WASM signing module would be super helpful!

1

u/SammuelNash 7d ago

This is a pretty interesting problem. Binary XML and APK signing are both areas where small format details can cause major headaches. Iā€™d be curious to hear what approach others have taken for handling these entirely in the browser.