I'm trying to manually verify an APK file in the way Android would do when such file is installed in some old system (<7). I have one problem I can't really solve.
They say the following:
As you can see, the signature file contains digest entries for the archive's files that look similar to the digest-value entries in the manifest. However, while the digest values in the manifest are computed from the files themselves, the digest values in the signature file are computed from the corresponding entries in the manifest.
So in this case, we have an example entry from the META-INF/MANIFEST.MF
file, which is the following one:
Name: FingerprintProtocol.proto
SHA-256-Digest: WQ9R/MGV5m9Dye4Jtl3MiLRmX2RPoEPeinb3me7wnAU=
Now we take the corresponding entry from the META-INF/*.SF
file, which looks like this:
Name: FingerprintProtocol.proto
SHA-256-Digest: fWL5eppUj0x6UVdPqHusFkpDbXpq7P0sqchfublqEnA=
The question is: How was fWL5eppUj0x6UVdPqHusFkpDbXpq7P0sqchfublqEnA
calculated?