How to create a secure sideloading zip bundle for enterprise Android

Updated 2026-10-31

Guide to creating a secure sideloading zip bundle for enterprise Android TV deployment

Why enterprises need locked-down Android TV bundles

Android TV now supports enterprise deployment configurations through sideloading, but the feature is easy to misuse if developers don’t enforce proper verification. In production environments, every app installed on a kiosk-grade TV must be known, signed, and auditable. The CleanYourTV launcher makes this easier, yet a carelessly packaged zip can embed malicious or outdated software alongside the intended installer.

A secure sideloading workflow starts before the bundle reaches the device: you generate a signed install package, attach a checksum, and distribute it through a trusted channel. The TV itself validates the signature before execution, rejecting anything that fails verification. This approach keeps consumer-facing devices clean while still giving IT teams a fast path to push custom content into enterprise kiosks and digital signage installations.

Building a verifiable zip bundle from scratch

The core steps are identical to any enterprise code-management pipeline, and they apply whether your target platform is a 4K Android TV box or a set-top box running a custom ROM.

First, prepare the app APKs you intend to deploy. Each APK should come from a controlled build pipeline that uses a dedicated enterprise signing key, not a developer account used for public releases. The key must be kept offline in an air-gapped keystore, and its passphrase stored separately from the machine that builds the bundle.

Second, compute a SHA-256 hash of the entire zip file. This lets the installation script check the bundle’s integrity on the TV side: if the hash changes, the install is aborted. Record the hash in a signed manifest that also lists every APK included, its version number, and the build SHA of the source source code.

Third, compress everything into a single zip. Android’s standard installer format (the same format used by the Google Play Installer) works well, but include a small text file at the root named bundle-manifest.txt that enumerates each component and its expected SHA-256 value. A typical structure looks like this:

android.tvsdk/
├── install.zip
├── bundle-manifest.txt
├── verify.sh
├── README.md
├── com.example.kioskapp_1.2.3.apk
└── libs/
    └── ...

What goes into a secure installation script

The verification script that runs on the TV must do more than just unzip. It needs to follow a strict sequence:

Confirm the ZIP structure contains only expected top-level entries (no stray executables in the root folder).
Extract all files to a temporary staging directory.
Calculate the SHA-256 digest of install.zip and compare it against the manifest record.
Run apksigner verify --staging-mode=1 --verify-keysystem --presig-verity --insecure on each APK inside the staging area.
Move approved files to /system/app or /data/local/tmp, depending on the TV’s partition layout.

If any step fails, the script rolls back immediately and reports an error to the console. The script itself should be stored in the enterprise repository with a readable commit message, so any audit can trace which version of the bundle was deployed when.

Optionally, wrap the script in a small wrapper shell that logs every action to /data/local/trace.log. On a production TV, rotate the log daily and ship it to your SIEM.

Signing and encryption of the final package

Signing is the last line of defense. Use APK signing with a certificate that your company controls, and never reuse keys from public developer accounts. For extra protection, encrypt the zip bundle with AES-256 using ZIP properties, so the file cannot be trivially copied and injected onto unmanaged hardware.

On the distribution side, deliver the bundle via a mounted USB stick (common in kiosk setups), a secure internal file share, or a signed HTTP endpoint that requires client certificate authentication. Avoid sending the bundle over public networks without TLS 1.3, and verify the server’s certificate chain against a pin in your deployment tool.

Testing the bundle before rollout

Test every bundle on the exact model of TV you intend to deploy. Some OEMs ship slightly altered hardware that affects background processes, and a bundle that passes on one device may crash on another. Run the install script on a clean, factory-reset TV and confirm the following:

No APK outside the allowed list executes.
The launcher shows the expected icon and disables any launch buttons for files that do not match the manifest.
The system logs contain no unexpected warnings during the verification phase.

If you use CleanYourTV or a similar launcher, check that it recognizes the new app’s package name and that it appears under the enterprise configuration scope, not as a regular consumer app.

Common pitfalls and how to avoid them

Skipping the manifest. Without one, the TV has nothing to compare against, so verification becomes a no-op. Always pair the hash with a human-readable list of components.
Storing the signing key on the same device as the bundle. That defeats the purpose of a locked-down TV. Keep the key on a separate, secured workstation and generate the zip on a separate build machine.
Using weak compression that includes executable scripts. Plain ZIP does not execute code, but a crafted archive with a named entry pointing to a script that runs decompiles to Java source can be dangerous on some TV firmware versions. Stick to standard zip compression and avoid vendor-provided archivers that might introduce hidden entries.
Ignoring the launcher’s own audit features. Many enterprise Android TV launchers (including CleanYourTV) add a runtime guard that hides unfamiliar packages from the home screen. Make sure the launcher is the device you configure, not a consumer launcher shipped pre-installed.

Maintaining the bundle over time

Android updates can break signature verification if the boot image changes, so regenerate a new bundle for every major OS update you install. Keep an automated build job in your CI pipeline that produces a signed, hashed, encrypted zip and publishes it to a protected S3 bucket. Your deployment team then pulls from that bucket when it is time to replace a kiosk display.

By treating the bundle as a release artifact with the same rigor as production software, you get tamper detection on first touch, auditability across the rollout, and a simple way to recall a faulty image from any deployed TV in your estate. CleanYourTV makes the packaging straightforward, but the security still comes from you: keep the key offline, sign every release, and verify on the device before anything runs.