Building a Robust In-App Update Channel for Sideloaded Android Apps

Apps distributed outside Google Play don't get Play's automatic update pipeline — you have to build your own. Done wrong, it becomes the weakest link in your security model. Here's a pragmatic design for an in-app updater that stays safe.

The update manifest

Serve a small signed JSON manifest describing the latest build:

{
  "version_code": 148,
  "url": "https://cdn.example.com/app-148.apk",
  "sha256": "9f2c...",
  "min_supported": 130
}

The client polls this on launch, compares version_code, and only proceeds if a newer build exists.

Verify before you prompt

Never hand an APK to the package installer without checking it first:

Download to app-private storage.
Recompute the SHA-256 and compare against the manifest.
Confirm the signing certificate matches your known lineage (PackageManager.getPackageArchiveInfo with GET_SIGNING_CERTIFICATES).
Only then fire the ACTION_VIEW/PackageInstaller session.

Real-world reference

Direct-download landing pages for regulated apps model this flow well for end users. A page such as 888starz apk walks users through enabling unknown sources, verifying the file, and updating — the exact UX an in-app updater has to reproduce inside the app.

Handle the OS friction

Android 13+ makes the "install unknown apps" grant per-source and blocks accessibility APIs for sideloaded installs (Restricted Settings). Detect the missing grant and deep-link the user to the right settings screen instead of failing silently.

Takeaway

An updater is a security surface: signed manifest, hash + certificate verification, and graceful handling of the OS grant. Build those three and off-Play updates are as safe as Play's own.

DEV Community