apksigner is a core tool for checking a final APK's signature information. Compare output with the expected release identity and approved artifact record; a valid signature is not a universal security verdict.
Evaluation approach
Assess APK signatures and supported signing schemes. Verify that the final file was not modified after signing.
Application example
Run verification on the protected, signed APK in CI and add certificate information to the release record.
Limits and considerations
A valid signature does not establish defect-free code or resistance to every attack.
Put signature verification at the release gate
Verify after protection and packaging are complete. A report for a correct intermediate file does not validate another package changed later. Bind the final digest and signature information to the release record.
Define expected identities for key changes and alternate distribution channels. A cryptographically valid signature may still be different from the organization's expected signature. Check both technical validity and correct release identity.
Technical assessment
Inspect the signature of the final APK
apksigner in Android SDK Build Tools can verify an APK you own or are authorized to inspect. This command does not sign or modify the file:
apksigner verify --verbose --print-certs application.apkCompare the reported certificate with the approved release record. Checking only an intermediate, unprotected package provides insufficient evidence about final distribution. Account for protection, repackaging and signing order.
A verification failure needs investigation. Success establishes only the conditions covered by signature verification. It does not prove that logs contain no secrets, API ownership checks work or the application cannot be bypassed.
Checks and decisions
- Verify the final APK
- Match the expected certificate
- Prevent changes after signing
Make signature verification a required, but not sole, part of release acceptance.
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.