What are the ways to analyze the source of downloading / installing Android applications?

Question

Java

Good afternoon!
There was a task to analyze the source of traffic from which the application is installed. The problem is that the application is not downloaded and installed via GooglePlay. The source is a site ID (number) in the ad network and is not known in advance.
Hence the question arose, are there adequate ways to somehow tag apk so that after successful installation, the application reports information (successful conversion) to Google Analytics?
So far I have found one way - to dynamically create apk:
Knowing that apk is a zip archive, I create a file with the site ID in the assets folder, then I sign the resulting apk using jarsigner.
Cons is jarsigner speed. It takes 4-6 seconds to sign an apk weighing 500kb. Accordingly, the user who downloads the apk may not like it.
Here, too, questions arose:
- Maybe there is a way to sign only a modified file (not familiar with the application signing algorithm)?
- Is there an alternative to jarsigner?
- Perhaps there is a way not to sign the application?
I would be grateful for any ideas.

Answer 1

The zip (apk) format allows you to add a comment to the archive. Moreover, if you comment on an already signed APK, then after commenting, the signature remains valid.
In the application, we find the location of our APK on the disk and read the comment in which we store the ID.

Answer 2

https://developer.android.com/intl/en/reference/co...
but not suitable for you.
Unfortunately, other methods could not be found at the time.

Answer 3

We don't have many partners, and we created builds for each partner. There is also a script that rebuilds all builds when changes are made and uploads them to the site.

Answer 4

The last time it worked was adding n bytes to the tail of an already signed apk. Then, already at runtime, you can access the downloaded apk and read them.