DEV Community

AI Release
AI Release

Posted on Originally published at ai-release.org

Installing the WordCraft Android Port: Verify the APK Before You Sideload

#android #tutorial #security #github

The WordCraft Android port isn't on Google Play. It lives in a GitHub repository, kanaaka/wordcraft-android, and the post that describes it calls the build third-party and non-official. That isn't a reason to skip it — it's a reason to look at the file before you hand it to your phone. The whole routine takes 15–20 minutes: pull the APK from the repo, check hash, signature and ABI, install over ADB, then confirm the package is actually running.

What you need before you start

  • A computer running a current Windows, macOS, or Linux install. The repository description in the source post doesn't list OS requirements.
  • An Android phone with an arm64-v8a CPU. That is the only ABI named for this port.
  • A USB cable and USB debugging turned on.
  • Android SDK Platform-Tools (adb) plus Build-Tools (apksigner, aapt).
  • Permission to enable "Install unknown apps" for whichever browser or file manager opens the APK.
  • Free space for the APK and any temporary extraction. The post doesn't state the APK size or the minimum Android version, so check the repo documentation.

One regional detail worth knowing up front: Google's newer sideloading restriction is active in Brazil, Indonesia, Singapore, and Thailand, and it is expanding. It can add a 24-hour wait before installing an APK that isn't from Play, even after you've allowed unknown sources.

Sanity checklist before anything else:

  • adb devices lists your phone as device, not unauthorized
  • adb shell getprop ro.product.cpu.abi returns arm64-v8a
  • "Install unknown apps" is allowed for your browser or file manager
  • apksigner and aapt respond in your terminal
  • You've read the repo description and know this build is unofficial

If adb devices says unauthorized, unlock the phone and accept the debugging prompt. Expected output:

List of devices attached
R58M1234567    device
Enter fullscreen mode Exit fullscreen mode

Step 1: take the APK from the repository itself

Open https://github.com/kanaaka/wordcraft-android. I prefer cloning it anyway, because then I can read the source while the download finishes:

git clone https://github.com/kanaaka/wordcraft-android.git
cd wordcraft-android
find . -maxdepth 2 -type f | sort
Enter fullscreen mode Exit fullscreen mode

You should see the shell crate, the patch against the upstream project, migration notes, and build scripts. The post names those components but not their exact filenames, so treat whatever find prints as the real layout.

Grab the APK the repository distributes and write down its exact filename — you'll retype it a dozen times. No release tag or asset name is given in the source post, so use the file that is actually there.

Worth saying plainly: this is not an official WordCraft release, and this repository is the only distribution path the post confirms. If a prebuilt binary alone isn't enough for you, read the patch and build scripts and build it locally. The post doesn't list build commands, so that part is on you.

Step 2: verify the file before you install it

Four checks: hash, signature, ABI, package name. Run them from the folder holding the APK.

Hash on Linux or macOS:

sha256sum <apk-name>.apk
Enter fullscreen mode Exit fullscreen mode

Hash on Windows PowerShell:

Get-FileHash .\<apk-name>.apk -Algorithm SHA256
Enter fullscreen mode Exit fullscreen mode

You get a 64-character hex string. Compare it against any checksum the repo publishes. The post includes none, so if the repo doesn't either, record the hash yourself and treat the file as unverified.

Signature:

apksigner verify --verbose --print-certs <apk-name>.apk
Enter fullscreen mode Exit fullscreen mode

A good result opens like this:

Verifies
Verified using v1 scheme (JAR signing): true
Verified using v2 scheme (APK Signature Scheme v2): true
Enter fullscreen mode Exit fullscreen mode

If the certificate DN contains CN=Android Debug, the build was signed with a debug certificate. That proves the file is signed — not that it is safe.

ABI:

unzip -l <apk-name>.apk | grep -E 'lib/.*/lib.*\.so'
Enter fullscreen mode Exit fullscreen mode

You want paths under lib/arm64-v8a/. Seeing only lib/armeabi-v7a/ or lib/x86/? Then it isn't the arm64-v8a build the post describes — stop here.

Package name:

aapt dump badging <apk-name>.apk | head
Enter fullscreen mode Exit fullscreen mode

Look for the package: name='...' line and, if present, native-code: 'arm64-v8a':

package: name='com.example.wordcraft' versionCode='1' versionName='1.0'
native-code: 'arm64-v8a'
Enter fullscreen mode Exit fullscreen mode

That package name is a placeholder. Copy the value your own command prints — you need it in the next step.

Step 3: install and confirm the package

Re-check the device ABI before touching anything:

adb shell getprop ro.product.cpu.abi
Enter fullscreen mode Exit fullscreen mode

arm64-v8a, or stop. Then install:

adb install -r <apk-name>.apk
Enter fullscreen mode Exit fullscreen mode

The final line should read Success. Confirm the package landed:

adb shell pm list packages | grep <package-name>
Enter fullscreen mode Exit fullscreen mode

Which prints package:<package-name>. Now check that Android selected the expected ABI:

adb shell dumpsys package <package-name> | grep primaryCpuAbi
Enter fullscreen mode Exit fullscreen mode

Expect primaryCpuAbi=arm64-v8a. Finally, launch it:

adb shell monkey -p <package-name> -c android.intent.category.LAUNCHER 1
Enter fullscreen mode Exit fullscreen mode

The app should open on the phone and the command should exit without an error.

Prefer to skip ADB? Go to Settings → Apps → Special app access → Install unknown apps, allow it for your browser or file manager, then open the APK from the file manager and accept the install prompt.

The three failures I'd expect to hit

INSTALL_FAILED_NO_MATCHING_ABIS (res=-113). Either the phone isn't arm64-v8a, or the APK carries no arm64-v8a native library. Run adb shell getprop ro.product.cpu.abi. Not arm64-v8a? This build cannot run on that device. Is it arm64-v8a? Then re-check the archive with unzip -l <apk-name>.apk | grep lib/arm64-v8a and re-download the correct file from the repository.

DOES NOT VERIFY from apksigner. The APK is unsigned, the signature is broken, or your download was incomplete. Don't install it. Re-download from the repo, compare the SHA-256 again, and rerun apksigner verify --verbose --print-certs <apk-name>.apk. Still failing? Ask the maintainer for a signed build.

INSTALL_FAILED_VERIFICATION_FAILURE from adb install. The device's package verifier or Play Protect is blocking the sideload. On a test device only, you can disable ADB install verification and retry. I wouldn't do that on my daily driver.

Takeaway

None of this is exotic — it's the standard "look before you sideload" loop, applied to one specific port. Clone the repo so you can read the patch and build scripts, record the SHA-256, get apksigner to say Verifies, and confirm that lib/arm64-v8a/ really exists inside the archive. Ten minutes of checking turns an unknown binary into a file you understand. And if a check fails, the right move is to leave it uninstalled — the app will still be there tomorrow.

This article was originally published on AI Release — https://ai-release.org. More hands-on guides land on the channel: https://t.me/ai_release1.

Top comments (0)