Comparing signatures of apks

Question

I have two .apk files that are supposed to be different versions of the same app. What is the best way to check if they where both signed with the same key?

I want to make sure no mistakes were done and the newer version would be treated as an update of the same app.

Answer 1

For updating an APK file two properties must match:

1. The app package name (can be seen in AndroidManifest.xml after decompiling it)
2. The app signature must match (the used signature certificate must be the same).

The best way to verify a signature of an APK file and viewing the used signature certificate and public key to use apksigner.jar for the Android SDK (build-tools):

The following example executes verifies two versions of the Samsung E-Mail app using apksigner:

java -jar <path to apksigner>\apksigner.jar verify -verbose --print-certs "Samsung Email_v4.2.74.1_apkpure.com.apk"
java -jar <path to apksigner>\apksigner.jar verify -verbose --print-certs "Samsung Email_v4.1.43-5_apkpure.com.apk"

Each time you are getting an output like this:

Verifies
Verified using v1 scheme (JAR signing): false
Verified using v2 scheme (APK Signature Scheme v2): true
Number of signers: 1
Signer #1 certificate DN: [email protected], CN=Samsung Cert, OU=DMC, O=Samsung Corporation, L=Suwon City, ST=South Korea, C=KR
Signer #1 certificate SHA-256 digest: 34df0e7a9f1cf1892e45c056b4973cd81ccf148a4050d11aea4ac5a65f900a42
Signer #1 certificate SHA-1 digest: 9ca5170f381919dfe0446fcdab18b19a143b3163
Signer #1 certificate MD5 digest: d087e72912fba064cafa78dc34aea839
Signer #1 key algorithm: RSA
Signer #1 key size (bits): 2048
Signer #1 public key SHA-256 digest: 0470be656b9375d253fbb94c3a87dc7040e2f2760c19c4292eb62cc68e02de4a
Signer #1 public key SHA-1 digest: df1e4fd4fc2ebfc187f79309dfc6a4c662bda4d0
Signer #1 public key MD5 digest: 7c6371f33db3b4361504cb13beb6e818

You only need to compare the sha256 digest of the certificate and/or of the public key. If for both APKs they are the same you can be sure that they have been released by the same person or company (as long as the app owner did not sell the app to someone else or the private key was stolen).

Answer 2

You'd need to check two things:

1. whether the package names are identical
   see: Read the package name of an Android APK on our sister-site. In short: Run aapt dump badging file.apk and watch out for package:. If the package names are identical, it should be the same app – but it's still unclear if they are from the same dev and thus whether the "new one" would be considered a "valid update" – or the "signature check" would fail in that process.
2. whether the signatures match
   This means, whether they are signed with the same key – which should guarantee they have been (created and signed) by the same dev, who should have kept his/her signing key secret. Again, see on our sister site: How to view the identity of person who signed the apk on Android device? // Getting certificate details from an apk.

Note that the tasks described need at least a basic install of Android developer tools. aapt is even part of a minimal ADB installation – jarsigner and keytool would need a more complete package (though if you're on Linux, openssl provides a different approach – details can be found in the linked posts from Stack Overflow.