Verify the exact artifact
Work on the file you intend to install or distribute:
apksigner verify --verbose --print-certs app-release.apk
Check the process exit status and the complete verification output. Do not stop at the first line containing a certificate fingerprint. Use an appropriate installed SDK Build Tools version and consult its supported options. apksigner reference.
Separate three results
| Result | What it establishes |
|---|---|
| Signing metadata is readable | A parser found certificate or scheme information |
| Cryptographic verification succeeds | Protected content passes the applicable signature checks |
| Fingerprint matches a trusted record | The signer matches the identity you intended to trust |
Even the third result is not a full security audit. A trusted publisher can ship a vulnerable release, and a malicious publisher can correctly sign its own software.
Understand why ZIP edits matter
APK Signature Scheme v2 protects APK content through a signing block and integrity calculations. Altering protected content after signing can invalidate verification. A repackaging utility that preserves META-INF files has not necessarily preserved a valid modern APK signature. v2 specification.
Run alignment and other required packaging operations before the final signing step. If a post-processing tool modifies the package, verify the resulting artifact rather than reusing the earlier verification report.
Compare the right fingerprint
Use a known-good release, an official publisher record or your Play signing configuration as the reference. Compare the same hash algorithm and account for documented key rotation or distribution-specific signing.
Do not confuse the APK file hash with the certificate fingerprint. The file hash normally changes with a new build; a signing-certificate fingerprint can remain stable across many releases.
Investigate failures instead of suppressing them
A failed check may indicate corruption, unsupported tooling assumptions or actual modification. Obtain a fresh authorized artifact, compare hashes and reproduce the verification with the documented toolchain. Do not distribute a file simply because another viewer can display its icon.
APKLint's signature checker exposes signing structures and certificate metadata. It is useful for orientation, but it does not replace apksigner cryptographic verification or a trusted publisher-identity comparison.
Separate a new build from a new signer
Take two authorized releases of the same application. Their APK file hashes should be recorded independently because their contents can differ, while their signing-certificate fingerprints may remain the same. Comparing a file's SHA-256 with a certificate's SHA-256 is a category error even though both values have similar hexadecimal formatting. Label the field and hash algorithm beside every value.
If the certificate fingerprint changes, first determine the release's signing arrangement and whether a documented rotation or distribution difference applies. Use the trusted release record, not a fingerprint copied from the candidate itself. A signing-aware tool may also expose lineage information that a simple certificate viewer omits. Keep that information with the verification result when it is relevant to update compatibility.
Verify the copy that will actually be distributed
Imagine the build job verifies an APK, then a packaging job modifies an archive entry before publishing it. The earlier successful verification belongs to the earlier bytes. Compute the final file hash and run verification on the published candidate after every transformation. The apksigner reference documents verification options; checking that a certificate can be printed is not the same as checking the process result.
Capture a failed command's exit status and output in your release logs. Distinguish a tool-launch problem, unreadable input and an actual verification rejection. A script that ignores a nonzero exit code can publish a report containing certificate text while the important failure scrolls past unnoticed. Make the release gate depend on the intended verification result for the exact candidate.
Retain the trusted comparison source and the final artifact hash with the report. This allows a later recipient to confirm that the report applies to their copy. Continue separate testing for vulnerabilities, permissions and application behavior; a valid signature identifies integrity and signing relationships, not a universal verdict that the app is safe.
Sources and further reading
Reference review: 29 September 2026. Examples illustrate the workflow; check your installed versions, release artifact and account-specific Console requirements before applying them. This guide is not a claim that APKLint executed your project or verified your private account.
Android inspection tools and practical release guides. About APKLint · Report a correction
