[0x05a] Add APK Signature Scheme (v4)

[Saket-taneja]

References - https://source.android.com/security/apksigning/v4
https://source.android.com/security/features/apk-verity

Thank you for submitting a Pull Request to the Mobile Security Testing Guide. Please make sure that:

• Your contribution is written in the 2nd person (e.g. you)
• Your contribution is written in an active present form for as much as possible.
• You have made sure that the reference section is up to date (e.g. please add sources you have used, make sure that the references to MITRE/MASVS/etc. are up to date)
• Your contribution has proper formatted markdown and/or code
• Any references to website have been formatted as [TEXT](URL “NAME”)
• You verified/tested the effectiveness of your contribution (e.g.: is the code really an effective remediation? Please verify it works!)

If your PR is related to an issue. Please end your PR test with the following line:
This PR closes #< insert number here >.

[Saket-taneja]

@cpholguera Check this one too

[cpholguera]

Thanks for sending the PR @Saket-taneja. With this we stay up-to-date with the signature schemes ;) Please take a look at the suggestions. In the one about "v4" I put the focus more on "what we can tell about it that can be relevant to the tester, why was this introduced?" rather than on what can be anyway read on Android dev. docs (anyone interested e.g. on the crypto behind can open the links and keep reading). And to that I added the only thing I think it's relevant for testers for now which is the flag for the verification. What do you think?

[Saket-taneja]

This is to give the basic understanding about the signature scheme to the security researchers as well as developers

[cpholguera]

Let's fix the linting and we can merge ;)

[cpholguera]

Thanks @Saket-taneja for the nice addition! Keep them coming 😊

[Saket-taneja]

@cpholguera This is again showing as rejected , can you check

[cpholguera]

Hi @Saket-taneja I've already merged it so everything is fine.

The "links check" it's not being very reliable so usually you can ignore it. We'll discuss internally how to deal with it. But for now you don't need to worry about it.

For new PRs the most important check is the lint check. Bit as long as you use a markdown linter on your IDE you won't have issues with it.

[Saket-taneja]

@cpholguera But in this case it is not mine , it is taking this from the LAST PR , I Haven't added this link/content maybe some other researcher

[cpholguera]

@Saket-taneja don't worry, no one is to blame. As I explained the link check has issues on it's own. So please don't worry, everything is alright. We'll take care of that :)