For updating an APK file two properties must match:
- The app package name (can be seen in
AndroidManifest.xml after decompiling it)
- The app signature must match (the used signature certificate must be the same).
The best way to verify a signature of an APK file and viewing the used signature certificate and public key to use
apksigner.jar for the Android SDK (build-tools):
The following example executes verifies two versions of the Samsung E-Mail app using
java -jar <path to apksigner>\apksigner.jar verify -verbose --print-certs "Samsung Email_v22.214.171.124_apkpure.com.apk"
java -jar <path to apksigner>\apksigner.jar verify -verbose --print-certs "Samsung Email_v4.1.43-5_apkpure.com.apk"
Each time you are getting an output like this:
Verified using v1 scheme (JAR signing): false
Verified using v2 scheme (APK Signature Scheme v2): true
Number of signers: 1
Signer #1 certificate DN: EMAILADDRESSfirstname.lastname@example.org, CN=Samsung Cert, OU=DMC, O=Samsung Corporation, L=Suwon City, ST=South Korea, C=KR
Signer #1 certificate SHA-256 digest: 34df0e7a9f1cf1892e45c056b4973cd81ccf148a4050d11aea4ac5a65f900a42
Signer #1 certificate SHA-1 digest: 9ca5170f381919dfe0446fcdab18b19a143b3163
Signer #1 certificate MD5 digest: d087e72912fba064cafa78dc34aea839
Signer #1 key algorithm: RSA
Signer #1 key size (bits): 2048
Signer #1 public key SHA-256 digest: 0470be656b9375d253fbb94c3a87dc7040e2f2760c19c4292eb62cc68e02de4a
Signer #1 public key SHA-1 digest: df1e4fd4fc2ebfc187f79309dfc6a4c662bda4d0
Signer #1 public key MD5 digest: 7c6371f33db3b4361504cb13beb6e818
You only need to compare the sha256 digest of the certificate and/or of the public key. If for both APKs they are the same you can be sure that they have been released by the same person or company (as long as the app owner did not sell the app to someone else or the private key was stolen).