I want to check if an apk file is really from a specific developer and that the whole apk has no malware in it.

I unzipped the apk and in the sub-folder META/INF I used the following command in Ubuntu:

keytool -printcert -file RELEASE_.DSA

If I use this technique with a "clean.apk" and a "suspicious.apk" file from the same developer and the MD5 / SHA1 are the same ... does this mean that the "suspicious.apk" really is "clean" ?

Does this work like GnuPG verifying a file? Or is this not reliable to check for integrity / authencity of an apk file?


Browse other questions tagged or ask your own question.