An Android signature establishes a release identity. A protection system must match its expected certificate to the package that the store or another distribution channel actually delivers.
Evaluation approach
The upload key and app signing key may differ. If the store-distributed package uses a certificate different from the test signature, prepare verification settings accordingly.
Application example
After verifying the CI output, also check that an application installed from the store has the expected signature.
Limits and considerations
An incorrect certificate expectation can block a legitimate release. Plan key transitions before making them.
Do not confuse three different artifacts
A development APK, an upload-key-signed output and the store release delivered to users may have different signing contexts. Protection policy needs the correct expectation for the application an end user receives.
Review RASP configuration, API verification and support for older releases together when changing signatures or upgrading keys. Testing a fresh installation is insufficient; existing users' upgrade path must work too. Otherwise, a security improvement can cause widespread loss of access.
Checks and decisions
- Record the distribution certificate
- Separate keys by role
- Test transition releases
Check the final artifact's signature after every package-processing step is complete.
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.