What are some ways to verify that an app is untouched?
I see things that are released with the apk file like:
- PGP Signature
- Build Log
- guaranteed to correspond to source tarball
- If you would like to verify that you have downloaded the correct file, please use the following SHA256 hash.
- The APK signature can be verified using the apksigner bundled with the Android SDK by locating and executing
apksigner verify --print-certs APPNAME-*.apkwith the following output:
Signer #1 certificate DN: CN= Signer #1 certificate SHA-256 digest: Signer #1 certificate SHA-1 digest: Signer #1 certificate MD5 digest: ...etc.
How these things could be used to verify that the application is untouched?