Tencent/tinker · critical · TinkerRuntimeException

ShareSecurityCheck file %s, size %d verifyPatchMetaSignature

Error message

ShareSecurityCheck file %s, size %d verifyPatchMetaSignature fail

What it means

ShareSecurityCheck.verifyPatchMetaSignature opens the patch zip and validates that every *-meta entry is signed by a certificate matching the app's own signature. Any exception during iteration (broken zip, missing entry, cert read) is wrapped as TinkerRuntimeException("ShareSecurityCheck file %s, size %d verifyPatchMetaSignature fail"). Signature mismatch itself returns false; this throw means the check could not even complete.

Source

Thrown at tinker-android/tinker-android-loader/src/main/java/com/tencent/tinker/loader/shareutil/ShareSecurityCheck.java:130

                final String name = jarEntry.getName();
                if (name.startsWith("META-INF/")) {
                    continue;
                }
                //for faster, only check the meta.txt files
                //we will check other files's md5 written in meta files
                if (!name.endsWith(ShareConstants.META_SUFFIX)) {
                    continue;
                }
                metaContentMap.put(name, SharePatchFileUtil.loadDigestes(jarFile, jarEntry));
                Certificate[] certs = jarEntry.getCertificates();

                if (certs == null || !check(path, certs)) {
                    return false;
                }
            }
        } catch (Exception e) {
            throw new TinkerRuntimeException(
                String.format("ShareSecurityCheck file %s, size %d verifyPatchMetaSignature fail", path.getAbsolutePath(), path.length()), e);
        } finally {
            try {
                if (jarFile != null) {
                    jarFile.close();
                }
            } catch (IOException e) {
                ShareTinkerLog.e(TAG, path.getAbsolutePath(), e);
            }
        }
        return true;
    }


    // verify the signature of the Apk
    private boolean check(File path, Certificate[] certs) {
        if (certs.length > 0) {
            for (int i = certs.length - 1; i >= 0; i--) {

View on GitHub (pinned to 1b7ea02c23)

Solutions

1. Re-download or rebuild the patch package and verify its md5 against the server-side value before loading.
2. Sign the patch with the same certificate as the base APK and keep zip signing intact (no post-processing that strips signatures).
3. Catch TinkerRuntimeException around patch verification and treat the patch as invalid.
4. Check the chained cause: zip format error vs IO error to decide re-download vs rebuild.

Example fix

// before
securityCheck.verifyPatchMetaSignature(patchFile);
// after
try {
    if (!securityCheck.verifyPatchMetaSignature(patchFile)) {
        listener.onPatchPackageCheckFail(loadedPatch.getPatchFile(), PackageUtils.ERROR_PACKAGE_CHECK_SIGNATURE_FAIL);
        return;
    }
} catch (TinkerRuntimeException e) {
    listener.onPatchPackageCheckFail(patchFile, PackageUtils.ERROR_PACKAGE_CHECK_OK);
}

// Verify patch package integrity before security check
if (!patchFile.exists() || patchFile.length() == 0) { /* reject */ }
if (expectedMd5 != null && !expectedMd5.equals(SharePatchFileUtil.getMD5(patchFile))) {
    // corrupted download: reject before verifyPatchMetaSignature
}

try {
    if (!securityCheck.verifyPatchMetaSignature(patchFile)) {
        // signature mismatch: reject patch (returns false)
    }
} catch (TinkerRuntimeException e) {
    // verification could not complete (bad zip/io): reject and re-download
}

When it happens

Trigger: verifyPatchMetaSignature(path) when JarFile iteration or entry reading throws — truncated/invalid patch zip, unreadable meta entries, or filesystem errors reading the patch file.

Common situations: Corrupted or partially downloaded patch package; patch zip repacked without proper signing/v2 signature (or signed with a different key than the app); storage errors; patches built with tools that strip entry certificates.

Related errors

• get public key md5 is null
• ShareSecurityCheck init public key fail
• Could not create new AssetManager
• Corrupt by wrong patch file.
• Filename contains NUL byte: ${Arrays.toString(nameBytes)}

AI-assisted analysis of Tencent/tinker@1b7ea02c23 (2026-08-14). Data as JSON: /api/errors/a6de7901b2f15237. Report an issue: GitHub.