adb shell command to check the apk is debug or release signed?

Question

How to check if apk is debug or release signed?
Is there any direct adb command to verify apk signature?

Tried the following dumpsys and aapt commands, but I am not able to find the exact flag

adb shell dumpsys package <package name>
aapt dump badging <apk file>

How to find out the given apk is debug or release signed? How to know which builds (user, userdebug or eng) we can install this apk?

Loseff

to check if an installed app is debuggable see https://mcmap.net/q/1160750/-how-to-list-all-debuggable-applications – Outlay

Answer 1

If you want to check whether the apk is debuggable use the below aapt command.

aapt dump badging /path/to/apk | grep -c application-debuggable

Outputs 1: Debuggable Outputs 0: Not Debuggable.

Mariken

Correct me if I'm wrong, but I believe Google Play installed apps are not allowed to be debuggable. – Showmanship

On Windows, this tool is in %ANDROID_SDK%\build-tools\<version>\aapt.exe – Latimer

Not sure if it changed since this answer was posted but trying with the aapt command from SKD 30, it looks like if you see "application-debuggable" in the output, it is a debug app, otherwise a release app. – Claudiaclaudian

Answer 2

i've tried a lot of stuff and came upon the following solution:

adb shell dumpsys package <package name> | findstr flags

if the build is debuggable, the "flags" line will have "DEBUGGABLE" parameter present. If it's not there, the build is not debug

Abject

This should be the accepted answer because it works on older devices and specifically devices that do not have aapt installed as is the case on my Android 4.3 custom device. – Montelongo

Thanks! Please note this works for windows only. For linux you have to use grep to find that particular line – Abject

Answer 3

You seem to be confused. Apks usually have debug and release versions. And eng, userdebug and user build types are used for the whole firmware images.

You can find build information (if properly populated by builder) by using

adb shell getprop ro.build.fingerprint

Outlay

in what way does this command link to the apk/the installed application I want to check? This always returns me the same result, no matter what I have installed – Pressor

Answer 4

run-as might provide a hint:

$ adb shell run-as com.example.foo.bar
run-as: package not debuggable: com.example.foo.bar

Rip