[Moto Z Play Questions & Answers] echo92:
Yeah, it's not easy to find information on whether a ROM is signed or not. That 'signed by SignAPK' property appears to be also present on Motorola OTA images for both Moto G4 and Z Play OTA updates.

After some reading around this, this is my interpretation of some of the pointers regarding whether the stock ROMs we have are signed or not. As always, people are free to comment.

1)If you boot into fastboot/bootloader, connect your device to your computer via USB, then open an ADB terminal, you can type 'fastboot getvar all' without quotes. One of the parameters (at least on my G4 Plus) is: (bootloader) secure: yes This is different from the securestate which reports the unlocked/locked state of the bootloader. Looking at Google's documentation regarding fastboot, if secure is set to yes, the bootloader only accepts signed firmware https://android.googlesource.com/platform/system/core/+/master/fastboot/README.md :

This suggests that the stock ROMs we have need to be correctly cryptographically signed, else the bootloader may reject flashing them via fastboot. I don't know if this secure flag is still active in unlocked bootloaders (but given unlocked bootloaders can reject bootloader flashes, including downgrades, it suggests it may still be active for the bootloader at least).

2) As reported by others flashing the supercookie ROM and other stock ROMs, they can lock their bootloaders and boot with a locked bootloader, provided the firmware you're flashing is the same or newer patch level than your device bootloader.

From Google's documentation, a locked bootloader should verify a firmware - e.g. the boot firmware partition which is embedded with a public key https://source.android.com/security/verifiedboot/ - against the OEM key at least in the device https://source.android.com/security/verifiedboot/verified-boot Though Google's documentation recommends/requires that the OEM key be burnt into the device, I don't know if for our devices whether the OEM key is burnt into the device during manufacturing or is resident in the TrustZone environment (or both?), but I hope it's a hardware OEM key. Though this is an old article, if the OEM key is burnt in, the OEM key appears to reside in a blown QFuse during manufacture (at least for older Motorola devices) http://blog.azimuthsecurity.com/2013/04/unlocking-motorola-bootloader.html

Either way, this suggests a particular firmware, shown to be booting on a locked bootloader, is signed with the proper keys, else your device would fail to boot with a locked bootloader since the firmware does not match the signature keys expected in the chain of trust, or show you an error if the boot partition, for example, is only verifiable with the certificate rather that the OEM key. Now, in theory, you may be able to alter the bootloader and inject keys or change the expected OEM key, but it seems that a modified bootloader may itself fail the signature check by the upstream embedded bootloader http://newandroidbook.com/Articles/aboot.html . As an aside, I suspect that this check here is also a reason why devices may fail if hard bricked, by flashing old OTA updates on a newer bootloader as a result of downgrading.

3) In the descriptor files and the stock ROM build fingerprint itself, the ROM appears to be signed with release-keys e.g.

BUILD REQUEST INFO:
SW Version: addison-user 7.1.1 NPNS26.118-22-2-8 10 [B]release-keys[/B]M8953_10229.50.04.65R
MBM Version: C1.13
Modem Version: M8953_10229.50.04.65R
FSG Version: FSG-8953-04.90
Build Fingerprint: motorola/addison/addison:7.1.1/NPNS26.118-22-2-8/10:user/[B]release-keys[/B]

As far as I understand it, release keys are unique keys provided by the issuing OEM or someone with access to the private key used to make the release keys. Unless someone has somehow gained access to the private cryptographic keys, it's likely that only Motorola has signed the stock ROM files with the public key and provided the correct signing certificates. https://source.android.com/devices/tech/ota/sign_builds Of course, you could modify the text file in the stock ROMs, but your device should report release-keys in its build fingerprint in the 'fastboot getvar all' command or your build.prop if you've flashed stock firmware.

4) Many of these stock ROMs are leaked from the Motorola RSD server. Looking at the old Motorola RSD documentation from a Google search: https://rsddownload.motorola.com/download/RSD_PC_CLIENT_USER_GUIDE.pdf it looks like the primary audience for this server and RSD are service centres. I think it'd be highly unlikely for Motorola to be issuing unsigned builds to service centres for flashing to customer devices...

5)Say hypothetically these stock files are altered and that they could be flashed onto a device. They'd likely fail an OTA update if a device was issued one by Motorola servers - regardless of an unlocked or locked bootloader, as the signatures in the OTA, generated by Motorola before issue, would likely not match that of the stock ROM recovery and system (unless somehow you got hold of the Motorola private keys) and also may fail the partition validation checks too. https://source.android.com/devices/tech/ota/sign_builds

However, it looks like OTA updates are downloading and installing okay onto devices flashed with the correct stock ROM build for their software channel https://xdaforums.com/showpost.php?p=75393838&postcount=200

Taken all together, this suggests that the stock ROMs we have access to are signed, given they flash onto and lock device bootloaders, and accept official OTAs. Of course, users should always verify, as far as possible, the originating source of the stock ROM before flashing, particularly stock firmware that can affect their entire device. Short of the release-keys indicator, I admit these are not direct checks that a firmware is genuine without installing said firmware as these checks happen behind the scenes, though the bootloader should be the primary check of this status. I don't know if you can view the public key/certificate in the files and if there even is a way to verify the key is the correct one. As always, be careful and caveat emptor.

As an aside, I ran an md5 comparison between SupahCookie's Google Drive stock ROM - the one labelled BootloaderLockFiles and the NPNS26.118-22-2-8 stock ROM (from here https://androidfilehost.com/?fid=817906626617956890 ) and md5 checksums are the same. Have a look at the attached file - files without a path are from the BootloaderLockFiles zip. Timestamps are the same too, as are file sizes. Therefore, that indicates that the Google Drive ROM is likely to be the extracted NPNS26.118-22-2-8 stock ROM, without the flash scripts and descriptors attached to it.