What are some ways to verify that an app is untouched?

I see things that are released with the apk file like:

  1. PGP Signature
  2. Build Log
  3. guaranteed to correspond to source tarball
  4. If you would like to verify that you have downloaded the correct file, please use the following SHA256 hash.
  5. The APK signature can be verified using the apksigner bundled with the Android SDK by locating and executing apksigner verify --print-certs APPNAME-*.apk with the following output:

Signer #1 certificate DN: CN= Signer #1 certificate SHA-256 digest: Signer #1 certificate SHA-1 digest: Signer #1 certificate MD5 digest: ...etc.

How these things could be used to verify that the application is untouched?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.