Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary

Utilities

Verify APK signatures from a supplied file

Check APK signature integrity and save native signer-certificate fingerprints.

Agent
Record signer fingerprints from an owned APKReject content changes without stripping the signature blockKeep verification separate from signing and device use

overview

What apksigner-verify does

Supply an APK FILE. The adapter runs the source-built AOSP verifier with fixed verify, --verbose and --print-certs options, then saves native text after a successful verification. It exposes no signing operation, private-key input or device connection.

The report identifies signature-scheme results and certificate fingerprints. Cryptographic integrity alone does not establish a trusted publisher, malware absence or app runtime behavior. Compare signer identity against a reference you trust.

The APK must be a nonempty regular file of at most 20 MiB, with at most 5,000 ZIP entries, at most 20 MiB declared size per entry and at most 64 MiB declared total expansion. It must contain AndroidManifest.xml. The Java subprocess has a 90-second timeout and a 256 MiB maximum Java heap. Native output/logs and the combined report are checked against 4 MiB after the process exits; these checks do not bound peak process memory or disk use.

source hub.docker.com/r/nenadzaric/skills-android-apksigner-verify

use cases

Where apksigner-verify fits

Record signer fingerprints from an owned APK

Save the native certificate digest and signature-scheme report alongside an artifact. The owned fixture verifies and reports its public certificate SHA-256 digest.

Reject content changes without stripping the signature block

The retained-block fixture changes one central-directory bit while keeping the APK signature block intact. Native verification reports a digest mismatch and the adapter fails without publishing a success report.

Keep verification separate from signing and device use

Process a supplied APK between file-producing workflow nodes. Signing credentials, detached-signature inputs, installed-app collection and device execution are not exposed.

reference

apksigner-verify inputs and flags

1 inputs
NameTypeFlagDescription
apkFILE--apkLocal APK FILE, nonempty and at most 20 MiB, within declared ZIP bounds.

Showing key inputs. apksigner-verify exposes 1 inputs in total.

example

Run apksigner-verify

apksigner-verify · command
apksigner-verify --apk owned-signed.apk -o verified.txt
sample output
Verifies
Verified using v1 scheme (JAR signing): true
Verified using v2 scheme (APK Signature Scheme v2): true
Verified using v3 scheme (APK Signature Scheme v3): true
Verified using v3.1 scheme (APK Signature Scheme v3.1): false
Verified using v4 scheme (APK Signature Scheme v4): false
Verified for SourceStamp: false
Number of signers: 1
Signer #1 certificate DN: CN=Trickest Owned Fixture
Signer #1 certificate SHA-256 digest: 95c33ae35527669d4130b7ccad26d029a5658678665cc37ba97a3705c2ec5a29
Signer #1 certificate SHA-1 digest: 615ee51a55ec9920bf9ba3ce6f4668caa04777e1
Signer #1 certificate MD5 digest: 49d14f23fb15a1c3ad0d509e407a7044
Signer #1 key algorithm: RSA
Signer #1 key size (bits): 2048
Signer #1 public key SHA-256 digest: b5e8f5b0184732700df00da1993e8f987227899c1c34912e72976cbcd87ef502
Signer #1 public key SHA-1 digest: 8a890cad0c2230885df8c4c7c3cd6101773cd27a
Signer #1 public key MD5 digest: e6068258b8499a29deb0b179e8b3371b

guidance

Choosing apksigner-verify

Choose this node when you need signature-integrity results and certificate fingerprints for a supplied APK. Use apkeditor-info for APK metadata or jadx-decompile for code inspection; those artifacts do not replace a signature-verification result.

apkeditor-info

Extract APK metadata into JSON rather than verify signatures and report signer certificates.

jadx-decompile

Inspect APK/DEX code as generated source; successful decompilation does not establish signature integrity.

faq

apksigner-verify questions

No. It checks the supplied artifact with the pinned verifier and reports certificate information. Publisher trust needs a known certificate reference or other evidence; a valid signature does not establish malware absence or runtime safety.

No. The only input is the APK FILE. The adapter invokes the verify operation with fixed verbose and certificate-reporting options. It exposes no signing, private-key or detached-signature input.

The native report lists individual scheme and source-stamp results. The owned positive fixture reports successful verification with v1, v2 and v3 true, while v3.1, v4 and source-stamp fields are false. Those fixture results do not establish every scheme for every APK.

The APK must be a nonempty regular file of at most 20 MiB, with at most 5,000 ZIP entries, at most 20 MiB declared size per entry and at most 64 MiB declared total expansion. It must contain AndroidManifest.xml. The Java subprocess has a 90-second timeout and a 256 MiB maximum Java heap. Native output/logs and the combined report are checked against 4 MiB after the process exits; these checks do not bound peak process memory or disk use. Unsafe or duplicate paths, symlinks and encrypted ZIP entries are rejected. A nonzero native verification exit becomes adapter exit 2. Success requires the native Verifies marker; nonempty native stderr on success is appended to the report. Existing nonempty output is preserved.

The CLI is built from unmodified AOSP android-16.0.0_r1 source at commit 61f88cbe6f81b4536d1ef124daf3caa4ad014afd, with upstream KMS exclusions and pinned Conscrypt 2.5.2. Its native 0.9 string is a source constant; no SDK Build Tools 37 version equivalence or bit-reproducible build is claimed.

The final source-built image passed nine native cases, including a worker-style filename and retained-signature-block digest tampering. Its three-node platform workflow also passed with downloaded signed APK, native report and verifier checks, matching the fixture certificate fingerprint. Public image and source/notices downloads have been verified anonymously. The original tool ID is public in the Library.

The source link provides immutable ORAS retrieval directions and a bundle SHA-256 for the actual adapter/build files, captured AOSP source archives with pinned Git bindings, original notices, full Conscrypt/JNI and matching BoringSSL source, and matching Java runtime source. The AOSP core uses Apache-2.0 with original component terms retained. No bit-reproducible build or exhaustive composition claim is made.

related

More Utilities tools

  1. browser-fetch

    Headless Chromium render: requested URL, final URL, status, and title next to the page.

  2. cewl

    Spider a URL and return a wordlist for password crackers.

  3. csvkit

    SQL on one CSV. The table name is the file stem.

  4. dnsgen

    Wordlist and mined-word subdomain permutation.

  5. duckdb

    In-process SQL on CSV, JSON, and Parquet. No server.

  6. edge-tts

    Microsoft Edge neural speech from text or a script file. No API key.

Run apksigner-verify yourself

Complete native report downloaded from the owned signed-fixture platform run. The public certificate identifies a demo fixture, not a production trust reference; the report verifies signature integrity rather than publisher trust.

Open apksigner-verify in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.