I'm trying to manually verify an APK file in the way Android would do when such file is installed in some old system (<7). I have one problem I can't really solve.
They say the following:
As you can see, the signature file contains digest entries for the archive's files that look similar to the digest-value entries in the manifest. However, while the digest values in the manifest are computed from the files themselves, the digest values in the signature file are computed from the corresponding entries in the manifest.
So in this case, we have an example entry from the
META-INF/MANIFEST.MF file, which is the following one:
Name: FingerprintProtocol.proto SHA-256-Digest: WQ9R/MGV5m9Dye4Jtl3MiLRmX2RPoEPeinb3me7wnAU=
Now we take the corresponding entry from the
META-INF/*.SF file, which looks like this:
Name: FingerprintProtocol.proto SHA-256-Digest: fWL5eppUj0x6UVdPqHusFkpDbXpq7P0sqchfublqEnA=
The question is: How was