klyubin

Ripping out v2 signatures makes the APK invalid on Android 7.0 and newer. This is because the v1 signature contains a special header X-Android-APK-Signed in its META-INF/*.SF files. When Android 7.0 or newer encounters this header without having encountered a valid v2 signature, it rejects the APK.

Installing a v1-only signed update to an APK which is v2 signed is permitted. However, the update has to be the same versionCode or higher to be accepted, meaning it can't be a downgrade in terms of versionCode. Thus, as long as you don't produce updates/upgrades which are v1-only signed, you should be protected against this vulnerability on Android 7.0 and newer.

The vuln affects all APKs on 5.0 <= Android < 7.0, and APKs not signed with APK Signature Scheme v2 on Android 7.0 and newer.

MD5 APK signatures are still supported by Android and are accepted by Google Play when you upload an APK there.

See https://forum.f-droid.org/t/many-old-unmaintained-apps-have-... for more discussion about this in the context of F-Droid. I believe F-Droid was (is) using Oracle jarsigner to verify APK signatures and this is what causing F-Droid to reject APKs with MD5 signatures.