v811_spc009/compatibility/cdd/4_application-packaging/4_0_intro.md

4. Application Packaging Compatibility

Devices implementations:

• [C-0-1] MUST be capable of installing and running Android “.apk” files as generated by the “aapt” tool included in the official Android SDK.
• As the above requirement may be challenging, device implementations are RECOMMENDED to use the AOSP reference implementation's package management system.

Device implementations:

• [C-0-2] MUST support verifying “.apk” files using the APK Signature Scheme v3 , APK Signature Scheme v2 and JAR signing.

• [C-0-3] MUST NOT extend either the .apk, Android Manifest, Dalvik bytecode, or RenderScript bytecode formats in such a way that would prevent those files from installing and running correctly on other compatible devices.

• [C-0-4] MUST NOT allow apps other than the current "installer of record" for the package to silently uninstall the app without any user confirmation, as documented in the SDK for the DELETE_PACKAGE permission. The only exceptions are the system package verifier app handling PACKAGE_NEEDS_VERIFICATION intent and the storage manager app handling ACTION_MANAGE_STORAGE intent.

• [C-0-5] MUST have an activity that handles the android.settings.MANAGE_UNKNOWN_APP_SOURCES intent.

• [C-0-6] MUST NOT install application packages from unknown sources, unless the app that requests the installation meets all the following requirements:

*   It MUST declare the [`REQUEST_INSTALL_PACKAGES`](http://developer.android.com/reference/android/Manifest.permission.html#REQUEST_INSTALL_PACKAGES)
permission or have the `android:targetSdkVersion` set at 24 or lower.
*   It MUST have been granted permission by the user to install apps from
unknown sources.

• SHOULD provide a user affordance to grant/revoke the permission to install apps from unknown sources per application, but MAY choose to implement this as a no-op and return RESULT_CANCELED for startActivityForResult(), if the device implementation does not want to allow users to have this choice. However, even in such cases, they SHOULD indicate to the user why there is no such choice presented.

• [C-0-7] MUST display a warning dialog with the warning string that is provided through the system API PackageManager.setHarmfulAppWarning to the user before launching an activity in an application that has been marked by the same system API PackageManager.setHarmfulAppWarning as potentially harmful.

• SHOULD provide a user affordance to choose to uninstall or launch an application on the warning dialog.

• [C-0-8] MUST implement support for Incremental File System as documented here.

• [C-0-9] MUST support verifying .apk files using the APK Signature Scheme v4.

• If device implementations are already launched on an earlier Android version and cannot meet the requirements [C-0-8] and [C-0-9] through a system software update, they MAY be exempted from these requirements.