Signature schemes differ in integrity and compatibility properties. Evaluate signing configuration against supported Android targets.
Evaluation approach
Define device versions and inspect the final APK with official verification tools. Account for post-build protection in signing order.
Application example
Changing a signed artifact after protection should cause the appropriate verification failure.
Limits and considerations
A valid package signature does not establish secure business logic.
Which package should be checked?
Examine the final signed artifact users will receive. Later protection or packaging can change earlier outputs; link evidence to its hash.
Checks and decisions
- Record target versions
- Verify final packages
- Avoid post-signing changes
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.