Carampa 0 Posted ... (edited) Hi, I'd like to know how to verify Android version Eddie's signature. we can verify the SHA256 hash here, but that's only part of the necessary verification steps. The level of information required for verification is provided, for example, by Signal Apksigner on Eddie.apk returns: $ apksigner verify -v --print-certs --min-sdk-version 24 "EddieAndroid-4.1.0VC40.apk" Verifies Verified using v1 scheme (JAR signing): false Verified using v2 scheme (APK Signature Scheme v2): true Verified using v3 scheme (APK Signature Scheme v3): false Verified using v3.1 scheme (APK Signature Scheme v3.1): false Verified using v4 scheme (APK Signature Scheme v4): false Verified for SourceStamp: false Number of signers: 1 Signer #1 certificate DN: CN="Air, C=IT" Signer #1 certificate SHA-256 digest: 7a3208c06e93971cd1bfb95d7fcf05014228ca7382c14e300d733fa432b8de66 Signer #1 certificate SHA-1 digest: 6d1fbc839f7a4e52da3b095a38775466521c3ed2 Signer #1 certificate MD5 digest: 343f044d8b785c8af0de4d66a3246df7 Signer #1 key algorithm: RSA Signer #1 key size (bits): 2048 Signer #1 public key SHA-256 digest: 3ceb2ce2be86033be3fa25a673eb9e6d826ed6f6bbcd64043385a2a098b1783f Signer #1 public key SHA-1 digest: e7af70cd8d246173881bf10d87c03c30b805a9d5 Signer #1 public key MD5 digest: b303aa430dc1728d16296a252030c390 Can anyone provide info to compare and verify? Many thanks! Edited ... by Carampa Quote Share this post Link to post
Staff 10638 Posted ... Hello! The SHA-256 checksum published on our website is provided specifically to allow users who sideload Eddie to verify the APK they downloaded. The APK is also cryptographically signed. The certificate fingerprint shown by apksigner can be used to verify the signing certificate of the APK, but the SHA-256 checksum published on our website is the reference we currently provide for independently verifying the downloaded APK. We may consider publishing the signing certificate fingerprint as additional information, now that we publish the APK already signed. Kind regards Quote Share this post Link to post