Verify the exact artifact
Work on the file you intend to install or distribute:
apksigner verify --verbose --print-certs app-release.apk
Check the process exit status and the complete verification output. Do not stop at the first line containing a certificate fingerprint. Use an appropriate installed SDK Build Tools version and consult its supported options. apksigner reference.
Separate three results
| Result | What it establishes |
|---|---|
| Signing metadata is readable | A parser found certificate or scheme information |
| Cryptographic verification succeeds | Protected content passes the applicable signature checks |
| Fingerprint matches a trusted record | The signer matches the identity you intended to trust |
Even the third result is not a full security audit. A trusted publisher can ship a vulnerable release, and a malicious publisher can correctly sign its own software.
Understand why ZIP edits matter
APK Signature Scheme v2 protects APK content through a signing block and integrity calculations. Altering protected content after signing can invalidate verification. A repackaging utility that preserves META-INF files has not necessarily preserved a valid modern APK signature. v2 specification.
Run alignment and other required packaging operations before the final signing step. If a post-processing tool modifies the package, verify the resulting artifact rather than reusing the earlier verification report.
Compare the right fingerprint
Use a known-good release, an official publisher record or your Play signing configuration as the reference. Compare the same hash algorithm and account for documented key rotation or distribution-specific signing.
Do not confuse the APK file hash with the certificate fingerprint. The file hash normally changes with a new build; a signing-certificate fingerprint can remain stable across many releases.
Investigate failures instead of suppressing them
A failed check may indicate corruption, unsupported tooling assumptions or actual modification. Obtain a fresh authorized artifact, compare hashes and reproduce the verification with the documented toolchain. Do not distribute a file simply because another viewer can display its icon.
APKLint's signature checker exposes signing structures and certificate metadata. It is useful for orientation, but it does not replace apksigner cryptographic verification or a trusted publisher-identity comparison.
Sources and further reading
Reference review: 22 September 2026. Examples illustrate the workflow; check your installed versions, release artifact and account-specific Console requirements before applying them. This guide is not a claim that APKLint executed your project or verified your private account.
Android inspection tools and practical release guides. About APKLint · Report a correction
