Inspect the container before choosing a file
Use a trusted archive viewer on an authorized copy and list its contents without installing anything. Look for multiple APKs, metadata files and asset directories. Different distributors can package containers differently, so do not assume a universal XAPK directory layout.
The Android concepts that matter are the application ID, version, signing identity and split dependencies. The Android App Bundle format explains how base and configuration packages relate, even though XAPK itself is not the official bundle format.
Separate three possible outcomes
| Contents | What extraction gives you |
|---|---|
| One standalone APK | A candidate installable package, subject to normal checks |
| Base plus configuration APKs | A package set that must be installed coherently |
| APKs plus external assets | Packages plus data whose delivery behavior needs verification |
Renaming base.apk to complete.apk does not merge splits. Similarly, putting assets beside an APK does not make the package installer import them automatically.
Verify package consistency
Compare application IDs and version codes across extracted APKs. They should belong to the same intended release. Inspect signing information and use a signing-aware verifier rather than relying on archive metadata supplied by an unknown distributor.
If a container mixes architectures or configurations, select the compatible set according to documented delivery information. Guessing by filename can omit a required split or combine mutually inappropriate variants.
Install only in a controlled test environment
For an authorized, coherent APK set, Android's package manager can install multiple files together through ADB. The exact files must match the target device and the release. Prefer bundletool and an original AAB for your own app's testing because that process generates the set from a known publishing artifact.
Do not solve an installation failure by disabling device protections or downloading missing splits from unrelated sources. The safer action is to obtain the official supported distribution.
Keep extraction and trust separate
An XAPK successfully opening as an archive says nothing about the app's safety. A working install also does not authenticate the publisher or establish redistribution rights.
APKLint can inspect selected APK files, but a report for the base alone should not be presented as a complete analysis of the XAPK's assets, split code or runtime downloads. Record exactly which extracted files were included in your review.
Interpret an example container without assuming a standard
Imagine an authorized container includes base.apk, two configuration APKs, a metadata JSON file and an asset directory. Make an inventory with each member's full path and size. Treat the JSON as distributor-supplied data to inspect, not as an instruction to install files or execute a helper. Determine which APK is the base and what each companion supplies using package-aware inspection rather than its name alone.
The presence of an asset directory raises a separate question: how does the supported distribution deliver and validate those assets? Copying them next to an APK on a desktop does not answer it. Look for documentation from the publisher or distributor, and leave the asset-delivery result unresolved if the format is undocumented. There is no universal extraction command that can infer every third-party container convention.
Reject mixed-release package sets
If two APKs identify different versions or signing identities, stop treating the container as one coherent release until the discrepancy is explained. Do not select the newer-looking base and keep old configuration files merely because the filenames match. For your own app, regenerate an appropriate set from the original bundle using Google's bundletool project so the selection has a known source.
For a compatible, authorized set, test on a controlled device with synthetic data. Record the exact files selected, the installation result and the feature paths exercised. A launch screen alone may not load a native library or request external assets, so include the operation those components support. If that operation fails, preserve the error rather than removing more files until installation succeeds.
Describe the outcome precisely: archive members extracted, individual APK signatures checked, selected set installed, or application workflow exercised. These are different milestones. Extraction by itself does not merge splits into one APK, verify external assets or establish the original publisher's trustworthiness. Keeping those boundaries visible makes the result useful without overstating it.
Sources and further reading
- Android Developers: App bundle format
- Android Developers: bundletool
- Android Developers: Android Debug Bridge
Reference review: 29 September 2026. Examples illustrate the workflow; check your installed versions, release artifact and account-specific Console requirements before applying them. This guide is not a claim that APKLint executed your project or verified your private account.
Android inspection tools and practical release guides. About APKLint · Report a correction
