APK Signing Schemes v1, v2, v3 and v4: What Each Adds

Understand the roles

Consult the v2, v3 and v4 specifications for precise verification behavior. This table is a conceptual map, not a complete compatibility matrix for every newer platform extension.

Do not infer schemes from META-INF alone

A modern signature block is not just another ordinary ZIP entry. An archive browser that sees no familiar v1 certificate file cannot conclude that the APK is unsigned. Conversely, a certificate file being present does not prove the package's current bytes verify.

Use a signing-aware tool:

apksigner verify --verbose --print-certs app.apk

Read the verification result for the relevant schemes and the tool's warnings. apksigner.

Match signing settings to supported devices

A release supporting older Android versions may need compatibility behavior different from a modern-only application. Let the supported Android build/signing tooling apply the appropriate configuration, and test the actual minimum-supported platform.

Do not disable a scheme simply to make a scanner show fewer entries or to imitate a screenshot from another app. The right configuration depends on the release's platform support and distribution arrangement.

Account for rotation and newer platform changes

Signing lineage can allow documented transitions between keys on supported platforms. Google Play's key-upgrade arrangements can also vary by platform version. A checker that displays only one certificate without explaining lineage may give an incomplete view.

When a release uses a newer signing feature, verify that the analysis tool understands it. “Not reported” and “cryptographically absent” are not interchangeable results.

Use the output as evidence, not a badge

Record the verifier version, artifact identifier, supported Android range and certificate comparison. Keep cryptographic verification separate from a malware or vulnerability assessment.

APKLint's signature viewer is designed for signing metadata and structural information. It should not be used to assert that every scheme was fully cryptographically verified, that a publisher is trustworthy or that a package will install on every device.