EXPLANATION OF THE ISSUE

We're getting wrong results from the static analyzer for signing schemes. While the static analyzer says the apk is signed by the v1 signature scheme, Android's analyzer tool says v1 is disabled. I wonder why we get different results. Which result is consistent to reporting?

In fact, The application doesn't support the v1 signing. So, we must be able to see the v1 signing as false.

build.gradle

signingConfigs {

            v1SigningEnabled false
            v2SigningEnabled true
        }
    }

MobSF Result:

Apksigner Result:
Command: Android/sdk/build-tools/29.0.3/apksigner verify --print-certs xxx.apk

Output:

Verified using v1 scheme (JAR signing): false

Verified using v2 scheme (APK Signature Scheme v2): true

STEPS TO REPRODUCE THE ISSUE

1. Static analyze for the apk
2. Analyze the apk by using apksigner verify --print-certs xxx.apk
3. Compare the results for Signer Certificate

ENVIRONMENT

OS and Version: macOS Monterey, 12.2.1
Python Version: 3.10.6
MobSF Version: v3.6.3 Beta