I want to check if an apk file is really from a specific developer and that the whole apk has no malware in it.
I unzipped the apk and in the sub-folder META/INF I used the following command in Ubuntu:
keytool -printcert -file RELEASE_.DSA
If I use this technique with a "clean.apk" and a "suspicious.apk" file from the same developer and the MD5 / SHA1 are the same ... does this mean that the "suspicious.apk" really is "clean" ?
Does this work like GnuPG verifying a file? Or is this not reliable to check for integrity / authencity of an apk file?