Jump to content
Not connected, Your IP: 216.73.217.75
Sign in to follow this  
Carampa

How to verify Android version Eddie's signature

Recommended Posts

Posted ... (edited)

Hi, 

I'd like to know how to verify Android version Eddie's signature.
we can verify the SHA256 hash here, but that's only part of the necessary verification steps.
The level of information required for verification is provided, for example, by Signal
Apksigner on Eddie.apk returns:

$ apksigner verify -v --print-certs --min-sdk-version 24 "EddieAndroid-4.1.0VC40.apk"
Verifies
Verified using v1 scheme (JAR signing): false
Verified using v2 scheme (APK Signature Scheme v2): true
Verified using v3 scheme (APK Signature Scheme v3): false
Verified using v3.1 scheme (APK Signature Scheme v3.1): false
Verified using v4 scheme (APK Signature Scheme v4): false
Verified for SourceStamp: false
Number of signers: 1
Signer #1 certificate DN: CN="Air, C=IT"
Signer #1 certificate SHA-256 digest: 7a3208c06e93971cd1bfb95d7fcf05014228ca7382c14e300d733fa432b8de66
Signer #1 certificate SHA-1 digest: 6d1fbc839f7a4e52da3b095a38775466521c3ed2
Signer #1 certificate MD5 digest: 343f044d8b785c8af0de4d66a3246df7
Signer #1 key algorithm: RSA
Signer #1 key size (bits): 2048
Signer #1 public key SHA-256 digest: 3ceb2ce2be86033be3fa25a673eb9e6d826ed6f6bbcd64043385a2a098b1783f
Signer #1 public key SHA-1 digest: e7af70cd8d246173881bf10d87c03c30b805a9d5
Signer #1 public key MD5 digest: b303aa430dc1728d16296a252030c390

Can anyone provide info to compare and verify?
Many thanks! Edited ... by Carampa

Share this post


Link to post

Hello!

The SHA-256 checksum published on our website is provided specifically to allow users who sideload Eddie to verify the APK they downloaded.

The APK is also cryptographically signed. The certificate fingerprint shown by apksigner can be used to verify the signing certificate of the APK, but the SHA-256 checksum published on our website is the reference we currently provide for independently verifying the downloaded APK.

We may consider publishing the signing certificate fingerprint as additional information, now that we publish the APK already signed.

Kind regards
 

Share this post


Link to post

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
  • Security Check
    Play CAPTCHA Audio
    Refresh Image
Sign in to follow this  

×
×
  • Create New...