Checksums help confirm that delivered files match approved packages. Hash the final modified artifact.
Evaluation approach
Generate hashes after protection and signing. Link approval, storage and distribution to the same identity.
Application example
Recompressing a ZIP may change its hash while leaving the APK unchanged. Record inner artifact identity where useful.
Limits and considerations
A checksum proves a comparison, not that the file is secure.
ZIP and APK hashes serve different purposes
Archive integrity and application identity are separate comparisons. Retain both when needed rather than assuming repackaging changed the application.
Checks and decisions
- Hash final files
- Bind approval records
- Compare on delivery
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.